Slides from Tony Martin-Vegue's presentation at SIRAcon (Cincinatti, OH) on May 1, 2019 Abstract: What do Tom Jones’ chest hair, alien abductions, and Tylenol’s brand recognition have in common? An actuary – somewhere in the world – determined the probability and impact of a loss event and reduced enough uncertainty to issue an insurance policy. Yet, in the field of risk management, we hear that this is impossible: we can’t measure intangibles; we can’t determine the probability of an event that’s never happened, and oftentimes, measuring probability itself is not possible. The insurance industry shows us that this just isn’t true, and they have the money to prove it. Insurance is a thriving business with excellent margins, built on uncertainty reduction. Why? The answer lies in incentives. Insurance is based on making uncertainty reduction profitable. With very few exceptions, cyber risk is set up to disincentivize good decisions. Using superstition and gut checks as a cheap replacement for data and utilizing debunked risk models are deemed “good enough” at best, and “really good!” at worst. Attendees will learn about how actuaries have historically tackled these challenges and receive practical tips on how companies and risk managers alike can be incentivized toward better risk decisions.

1. Incentivizing Better Risk Decisions:
Lessons from Rogue Actuaries
#SIRAcon

2. Forget cyber risk…

4. “It is impossible to
identify all critical
assets. It is
impossible to determine
value of IT assets. It
is impossible to manage
vulnerabilities. Risk
management is
impossible.”
- Richard Stiennon, Cyber Security leader,
author

5. Is cyber risk unique?

6. Medicine: The Constantly Mutating Influenza Virus

7. Oil and Gas Exploration: A
Business Based on Betting with
Incomplete Information

8. 2 1/2 million
NASA’s Space
Shuttle
(2.5 million moving
parts)

9. Seismic Hazard Assessments: 1,000 Year Earthquake

10. First SpaceX Falcon 1 Flight, July 14, 2009

11. The 4 Horsemen of Risk

12. War Quants

13. Economists
Adam Smith: First Modern Economist

14. Medium High
Low Medium
Impact
LikelihoodManagement
consultants

15. Actuaries

16. Bottomry – 1700’s BCE

17. Ship Owner
• Borrows
money
• Ship is
collateral
Voyage
• The ship
goes off
and makes
money
Repayment
• Ship
returns:
pay back
loan with
interest
• Doesn’t
return?
Loan is
forgiven
How Bottomry Works

18. Medium High
Low Medium
Impact
Likelihood
Hammurabi

21. What starts out as an
outlandish idea, often
turns into thriving
business later.

22. Quant
risk is
too hard.

23. The Current State of Cyber Risk Management

24. The Current State of Cyber Risk Management
Standards
Consulting & Auditors
Management
Cyber Risk Managers

26. Think Like a Rogue Actuary

27. Skin in the Game
1:

28. Risk Description Likelihood Impact Risk
Weak admin password
on SQL server
High High High
30 Windows servers out
of patch compliance
Medium High High
Data breach Very High Very High Very High
Server room lock is
broken
Low High Medium
“Risk to say we did it”

29. Bad bookies
Bad actuaries

30. Fantasy Football Prediction Market

31. Risk: Will there be a reportable data breach originating from public facing web servers
by December 31, 2019?
SME Probability Why are you making this prediction?
Pradeep 10%-20% No data to support increased threat level
Alice 5%-15% About the same as other companies in our sector
Bobby 10-20% Company has written patching policy; no past breaches
Susan 50%-60% Apache Struts patches are 6 months out of date
Internal Prediction Market

32. Find Superforecasters
through leaderboards
Feed KRIs, KPIs
Incentivizes good
decisions

33. (What would Fermi
do?)
2:
WWFD?

34. Classic Fermi Problem
What is the
circumference of the
Earth? ?

35. 24,000 mi
What is the circumference of
the Earth?
3
3,000
3,000/3=1000
24
24 * 1000 =

36. Source: www.google.com

37. Hold my beer.It is impossible
to identify all
critical assets.
WWFD?

38. 3:
Be the Business

39. Is this your Vuln scan report?

40. Decision maker
is trying to
solve a problem
Makes up mind
(use a hammer)
Justify use of
hammer to boss
Oh, risk
analysis
Engaging the Risk Team

41. Risk analysis:
Uncertainty reduction
when making a decision.

42. Decision Science the…

43. Choice
Information
Logic
Preference
Decision Essentials
Ronald A. Howard

44. Risk
assessment
request
Identify
choice
Identify
preferences
Identify
information
Form decision
statement
Decision
Maker: Fork
in the Road
A Risk-Based Decision
Start scoping
the risk
assessment

45. Risk analysts behave differently when they
have something on the line.
Be unafraid of measurement challenges.
Uncertainty reduction when making a
decision.
You are not alone.

46. Tony Martin-Vegue
@tdmv
www.tonym-v.com