From Revenue Assurance to Assurance: The Importance of Measurement in Computer Security

Presented at Kiwicon 6: The Con of the Beast (2012), Nov. 17, 2012, 11:30 a.m. (30 minutes)

In the 19th century, Lord Kelvin supposedly said "If you cannot measure it, you cannot improve it" (although this was probably a later invention). When you're working with Victorian-era steam engines this isn't so hard, but it gets tougher with modern technology. After wandering around the age of steam for awhile, this talk looks at the problem that telcos faced in the 1990s when they found that, to their considerable surprise, their billing systems were incapable of properly managing mobile phone billing. The result was the field of revenue assurance, a systematic effort to measure and evaluate the performance of mobile phone systems, at least as it applied to billing users. With computer security things get even worse: If you can't measure it, you don't even know whether it's working or not. The rest of the talk looks at various failures of measurement in the field of computer security and applies lessons from the area of revenue assurance to computer security mechanisms. NB: Talk contains both the phrase "leverage the synergy of the cloud" *used legitimately* and a cute kitteh picture.

Presenters:

Links:

Similar Presentations: