Clean Campsite v. Outrun Fellow Campers
Dale Peterson
ICS Security Catalyst, Founder of S4 Events, Consultant, Speaker, Podcaster, Get my newsletter friday.dale-peterson.com/signup
A contestant in the S4x24 My Favorite Metric competition presented the classic:
I don't need to outrun the bear, I just have to outrun you.
While not really a metric, the idea was that an asset owner can benchmark their OT security posture against their peers. If they are markedly better than their peers, then the bears, the adversaries, cyber criminals and such, will attack the easier targets.
Maggie Morganti was one of the judges and came up with a different bear / camping analogy. It's an interesting twist by saying bears want food. If all the campers keep a clean campsite the bears won't be drawn to the food / campsite / campers. And one of the slower campers (weak security asset owners) won’t need to be sacrificed.
This is particularly applicable to criminals and ransomware, more so than adversaries that want to attack a particular target for non-monetary reasons. Criminals want money (food). If it is not easily seen, smelled or available, then they won't come to your camp/company/sector.
You could argue that this extends the outrun analogy to an industry sector or class of attack. If we make it difficult
XDR Detection & Response Delivery Manager | Accenture Federal Services | GCFA, GRID, GCIP, GICSP, DHS/CISA-301V & 401V, eCIR, eJPT, FSDA, NNCE
10 个月This is quite insightful Dale Peterson and Maggie M.. I agree that a "Clean Campsite" approach is preferable, but I'm sure that our best efforts will not deter all attackers, just the less skilled/motivated/funded. Assuming we are able to achieve a "Clean Campsite" state, won't we end up back in an "Outrun Fellow Campers" situation anyway?
VP of Policy and Standards at Gretel
11 个月“If you look like food, you will be eaten. It’s that simple. Criminals are looking for prey. They are looking for easy victims. If they wanted to work hard for a living, they’d get a job. When you pull a gun, you are no longer prey, you are work. It’s the same thing in cybersecurity.” - Anonymous
Managing Consultant - Industrial Cyber Security (OT/IACS/CPS) | CEng | GICSP | IEC 62443 | Security Engineering
11 个月Interesting idea, but they haven't noticed they are camping on the Isla Nublar and are also likely to be trampled by a bigger predator chasing larger prey.