COMP3441 Lecture 10: Risk/Case Studies

Transcription

1 COMP3441 Lecture 10: Risk/Case Studies Ron van der Meyden (University of New South Wales Sydney, Australia) May 20, 2013

2 Overview Risk Case Study: Banking

3 Risk If you are afraid that crooks might try to rip you off your staff might try to cheat you customers might sue you... then don t go into business!

4 Risk versus reward Business/investors accept risk as inevitable. What matters is the risk/reward tradeoff: low risk/low reward (e.g., cash in the bank, government bonds) moderate risk/moderate reward (stock of slow growth multinational, e.g. IBM) high risk/high reward (stock in a potentially high growth startup company) What type of business/investor are you?

5 Business Risk Concepts Exposure - what could be lost in the worst case? Volatility - how predictable and variable are losses? Probability - how likely is a particular type of loss event? Severity - what is the amount of loss likely to happen? Time Horizon - how long will the exposure last? Correlation - how are different risks related to each other? Capital - how much should I set aside for a rainy day? Some types of business risks are well understood and quantifiable, particularly in finance.

6 Example: credit risk The risk that a borrower will default on the loan. exposure: amount of the loan volatility: default more likely in a recession probability: can be estimated based on borrower s: credit history, age, employment, level of borrowings severity = exposure * probability of default time horizon: term of loan correlation: recession based defaults highly correlated capital: increase at time of recession

7 Risk Assessment Identifying degree of risk/severity can be quantitative: quantify exposure and probability calculate severity

8 Example: Quantitative Risk Assessment Consider a system with a random 4 digit password, and users locked out for one day after 3 failed login attempts within a single day. Question: What is the probability that a brute force attack will break in within k days? Answer: P(success after k days) = 3k 10 4

9 Quantitative risk assessment is often not feasible: Hard to get the numbers. How credible are the numbers when you can get them? Hard to get a model that captures all relevant detail. An alternative is a qualititative approach: High High Exposure / Low Probability High Exposure/ High Probability Exposure Low Low Exposure / Low Probability Low Exposure / High Probability 0 < Probability >1

10 Limits of Risk Assessment A poem by Donald Rumsfeld, US secretary of State 2003, on war on terror As we know There are known knowns There are things we know we know We also know There are known unknowns That is to say We know there are some things We do not know But there are also unknown unknowns The ones we don t know we don t know

11 Risk Management Deny it: that would never happen to us! Carry it: accept as part of the game mitigate it: e.g., make a borrower post collateral balance it: e.g., create a portfolio of uncorrelated risks transfer it: buy insurance against the losses cook it into a derivative and sell it (e.g., mortgage-backed securities) Which of these to apply? Depends on your risk profile, cost of strategy. Still more of an art than a science, even in finance.

12 Even mitigation and transfer leave residual risk: loss of market value of collateral counter-party risk: default of the insurer moral hazard: people with insurance are more likely to engage in risky behavior

13 Risk Mitigation: Security Example Risk: Virus borne attacks Mitigation Strategy: antivirus on firewall, on desktop residual risk: zero-day attacks

14 Balancing Risks: Security example A major company runs its web servers on a variety of platforms: Apache on Linux machines Windows Server on Windows MacHTTP on Macintosh Vulnerabilities on these platforms are unlikely to be correlated, leading to increased reliability overall. (Cf. genetic diversity in biological populations.)

15 Moral Hazard: Security Example This issue not much studied yet, but there is some evidence of it: E.g., users who believe they are protected by a firewall are more likely to choose weak passwords.

16 Transfer of Risk: Security example Insurance companies are starting to remove IT security risks from business insurance policies create new type of policy to cover these risks One example: Early days for this: how to quantify these risks, build actuarial models rapidly changing technology (cf. life expectancy models)

17 Case Study: The Credit Card Arms Race The history of credit card security illustrates an arms race between banks & the crooks. Each new defensive measure met with a new type of attack. The banks management of this reflects not just technological response, but also risk management practice.

18 Credit card transaction process (commission) switching centre (e.g. Visa) Merchant Merchant's bank (merchant discount 4-5%) Customer's bank (interest, loyalty)

19 First security approach Hot card lists paper local hot card list sent to merchants for transactions > limit1, merchant to call Visa for transactions > limit2, Visa to check with customer bank

20 Improved communications networks now allow most transactions to be verified back to customers bank. But not all: cost of ensuring 100% network uptime too high, dimishing returns approval on network failure risk: example of accepting risk

21 1970 s: rise of mail order Attack: use of credit card number acquired by crook Defenses: lower limits for calls to check cards (mitigate & accept risk) use expiry date as password (mitigate) require delivery to customer card address (mitigate) increase merchant discount (mitigate by increased capital) in case of customer complaint, debit amount back to merchant transfer risk to merchant insurance to customers (against card & merchant fraud, goods return), so attracts customer business Residual risk: the system won t be viable for merchants (so banks still need to ensure system is secure!)

22 1980 s: Card Forgery With rise of electronic terminals for authorization, crooks turn to faking cards: fish receipts with card number and expiry date from garbage encode card number and expiry date on a stolen/forged card s magnetic strip Defense: Card verification values (CVV) printed on card but not encoded on magnetic strip

23 1990 s: Skimming Attack: Criminal gangs run businesses (or plant members there as stafff), e.g. restaurants, to swipe cards through extra terminal to collect card data (and copy CVV) for fake card manufacture. Defense: Intrusion detection systems (mitigation) to identify merchants used preceding fraud detect unusual customer purchase patterns (e.g., out of town, higher rate of charge than usual)

24 Late 90 s: Invisible Skimming Attack: (hide from intrusion detection systems) Criminal merchants omit charging for transactions in which data was skimmed (carry loss) Wait (e.g. one year) for customer to forget about use of that merchant Manufacture fake card and use for large transaction(s) (recoop loss)

25 Mid 90 s-2000 s: E-commerce Original expected attack: theft of card data from plain-text , web traffic Defense: SSL/TLS, encryption of card data. Actual attacks: phishing theft of card data from hacked merchant websites

26 PIN based vulnerabilities Attack Example: crook working at merchant observes customer enter PIN on terminal crook returns fake card to customer: retains customer card or, crook s friend subsequently does grab and run on customer handbag. crook uses stolen card and PIN

27 2000 s: Automated Teller Machine skimming (images from all-about-skimmers/) (pinhole contains camera to capture PIN)

28 ATM skimming

29 Point-of-Sale terminal skimming Oct 2012: found inside POS terminals at an (undisclosed) major US retailer :

30 Current Defenses Visa/Mastercard requirements on merchants: Payment Card Industry Data Security Standard security_standards/pci_dss.shtml Security Breach disclosure Laws: legal requirement to publicly report theft of CC data from merchant machines report can affect merchant stock price, customer loyalty

31 Smart-card based credit cards PIN + cryptography based cards Several technologies: Static Data Authentication (shared key cryptography) Dynamic Data Authentication (+ digital signatures) Combined Data Authentication (+ digital signatures) Contactless cards (RFID) All with vulnerabilities, depending on overall design of the system.

32 Summary: Risk Management Identify exposure (assets) Identify risks (threats) Measure/qualify risk parameters Quantify response costs Prioritise responses Implement responses in order of priority monitor and adjust as needed watch out for unknown unknowns!