Defending Security is Probabilistic, Not Deterministic: Get Over It
summary
Explains why security cannot be judged with binary yes/no answers and reframes assessment as changes in a system’s Trust Factor over time. Uses probabilistic reasoning rather than deterministic assertions to evaluate security posture, without presenting commercial products.
AI-written summary · about
chapters (9)
- 0:00Start
- 4:29Relational: Trust is the Inverse of Risk The Limits of Trust
- 4:44Quantum Computing is Probabilistic
- 9:12The Basis of Time-Based Security
- 15:12A Short Anatomy of Bayes Theorem
- 19:52Is Your Detection Vendor Telling You the Truth? How do They Come up With Numbers? • Vendor says: P(D)-99% accuracy
- 34:32Bayes and the Time-Based Flip-Flop
- 36:40Adjusting Probability with Time
- 45:20You Don't Need The Maths Yourself
related talks
01h 28mThe Unfalsifiability of Security Claims
51mThinking Differently About Security
24mSecurity by default
51mNavigating Faulty Assumptions and Magical Thinking in Cybersecurity
48mLevel Up Your Security Mindset
53mOptimistic Security
22mChange is Hard - Securing the Future Today
31mMaking a Case for Security Optimism