Learning How To Quantify Cyber Risk Using Bayes

A Case Study on Instance Security Groups in AWS

Mitigating risks in cloud environments like AWS is a challenging yet crucial task. A commonly proposed control is to remove specific ports like 22 (SSH) and 3389 (RDP) from all security group ingress rules to prevent unwanted access and reduce the probability of instance compromise. But how can we measure the effectiveness of such a strategy?

Enter Bayes

Bayes’ theorem is a fundamental concept in probability theory and statistics, providing a mathematical framework for updating probabilities based on new evidence. In the context of cybersecurity, it can be used to calculate the probability of an event (like an instance compromise in AWS) given that a control (like removing port 22 and 3389) is in place.

Bayes’ theorem is typically represented as:

P(A|B) = P(B|A) * P(A) / P(B)

In this context:

• P(A) is the prior probability or our initial guess about the likelihood of an instance compromise without the control.
• P(B) is the probability of implementing the control.
• P(B|A) is the likelihood of implementing the control given that an instance compromise has occurred (probability of B given A occurs).
• P(A|B) is the posterior probability or updated likelihood of an instance compromise given the control is in place (probability of A given B occurs).

Quantifying Risks

To use Bayes’ theorem, we need to understand and quantify these probabilities.

1. P(A): This can be estimated based on historical data on instance compromises within AWS. If 5% of instances were compromised last year, we can use that as our initial guess, P(A) = 0.05.
2. P(B): This is more straightforward. If the decision has been made to implement the control, then P(B) = 1.00.
3. P(B|A): This might be tricky, as it requires expert judgement. Let’s assume that an attacker who has successfully compromised an instance would trigger the implementation of this control. We might estimate this as being quite high, say P(B|A) = 0.90.

By plugging these values into the Bayes’ theorem formula, we can calculate P(A|B), the updated probability of an instance compromise given the control is in place.

P(A|B) = 0.90 * 0.05 / 1.00 = 0.045

So, given our control (B) of closing off ports 22 and 3389, the updated probability of an instance compromise (A) drops to 4.5%. It’s not much of a drop, but it is a quantifiable drop.

Assessing Control Effectiveness

As time progresses, we gather more data on instance compromises in AWS. Let’s say after implementing our control, we find that over the next quarter, the rate of instance compromise has further dropped to 3% (0.03). We can use this new evidence to update our probabilities.

Now, this new rate of 3% becomes our P(A’), the new prior probability. Let’s also say we have a new likelihood of implementing the control given an instance compromise, P(B|A’) = 0.85, perhaps because there are fewer overall compromises triggering the control.

Updating our Bayes’ formula with these new figures:

P(A’|B) = P(B|A’) * P(A’) / P(B)

And if we again assume that we are implementing the control, P(B) = 1.00, then:

P(A’|B) = 0.85 * 0.03 / 1.00 = 0.0255

The updated probability of an instance compromise given the control is now 2.55%, indicating further risk reduction.

This illustrates how Bayes’ theorem can help us iteratively update our risk models with fresh data, allowing for dynamic, evidence-based cybersecurity strategies.

Conclusion

It’s important to remember that the output of this model depends on the accuracy of our input probabilities, though not heavily. Our input probabilities will likely always be based on subject matter expert judgement, a small sample size of observed behavior, or industry reports. What matters is these probabilities should be reviewed and updated regularly based on new evidence or expert advice in order to continuously improve our risk measurements.

Using Bayes’ theorem can provide us a quantitative method to assess risk and the effectiveness of controls. In this example, removing port 22 and 3389 from all security group ingress rules reduce the risk of instance compromise in AWS, if implemented correctly.

Bayes’ theorem, though a powerful tool, is only a part of the solution. We can expand this measurement to include upper and lower bounds of expected financial losses, as well as run Monte Carlo simulations to get a better idea of our risk posture. Combining these tools and studying all possible controls and expected events can help communicate risk to the business, which is one of the most valuable outputs that a security program can provide.

This post was inspired by reading the updated version of How To Measure Anything in Cybersecurity Risk by Douglas Hubbard and Richard Seiersen. I highly recommend this book to anyone wanting to learn how to quantify risk and understand the why behind all of the controls, processes, and procedures we perform in cybersecurity.