Repeat Rant: Do not Perform Arithmetic on Ordinal Numbers
I've previously written on the topic here .
Today I attended a meeting of the Agora, a monthly symposium on networks and security at the University of Washington. It was my first meeting and I was impressed. Lots of local infosec celebrities. The last speaker jumped on my last nerve (as my housemate puts it), though.
Andrew Macpherson presented a draft of an unpublished paper on a Threat Calculator he and others developed at the U of New Hampshire as part of an outfit called Justiceworks. The dude has some background; during 9/11 he was at Dartmouth College's Institute for Security Technology Studies and did some work for the Feds during the aftermath. Also in his favor is the correct use of the term "Threat" - at least per Richard Bejtlich, who is smarter than me and probably you. A threat is an entity with the intent and capability to attack.
Where he goes wrong is basically...his whole project. He takes a bunch of factors (24, I believe) to describe threat-actors (ok, he waters down the term "threat" - deduct a couple points), assigns each factor a rating on a scale of 1-5, and adds them up. Highest possible score is 140 points.
Where do I begin.
Numbers used to rank items are called Ordinal Numbers. Apart from Set Theory, you can't do arithmetic on ordinal numbers. Why not? Think about it. There is no precise relationship between numbers on a ranking scale. 1 < 2, but 1 is not half of 2 nor is it one less than 2. One is just in a position to the left on the scale. It might help to think of "First, Second, etc." instead of "One, Two, etc." We are so used to "regular" numbers that it's easy to make this mistake, but basing any decisions on this fundamentally flawed reasoning is a blunder. And the seeming precision - "hey, we quantified this shit! gives resonance to the blunder. You just painted a qualitative assessment with quantitative coloring.
You can't do arithmetic on numbers where the units are different. 5 gallons plus 3 hectares = ???
There's a problem of weight. Is a 5 for technical capability = a 5 for National/Cultural Stability? They have the same weight in the calculator. Funny that all 24 factors are exactly equal in importance.
There's a problem of scale. Even given the appropriateness of addition for this exercise, is a 5 really only 4 places more than a 1? This scale encompasses the PRC and my technologically illiterate neighbor. Sure, something close to 140 is scarier than something close to 24, but what's the scare curve look like? Does the pucker factor zoom skyward as you cross 100? 50?
These combine in unwholesome ways to undermine the whole exercise. The Netherlands scores high in technical aptitude, national stability, infrastructure similarity (they use similar control systems so they know how to attack them), etc. All of which is totally blown away by low scores in ideological antagonism. Yet overall they probably score higher than outfits that WILL commit serious cyber attacks some day.
Finally, there's the fundamental problem of pulling numbers out of your ass 24 times and then munging each together and gazing lovingly on the results like it means more than a single number pulled out of your ass. Some of those numbers are intensely debatable, such as those relating to the motivation of organized crime to conduct strategic cyber attacks. Maybe they will rise to that level of extortion some day. Maybe not. Who knows? I don't - and they don't either. Write me an assessment arguing for one or the other, and include your reasoning. Don't sink your reasoning in a morass of bogus numbers (and take any prospect for debate with it because you can't argue with something as scientifically sound as a number!).
So why does this matter? The tools we use to help us think affect the decisions we make. The pervasive use of Powerpoint at NASA helped doom the shuttle Columbia. (Search "Columbia Powerpoint" for a host of articles detailing the official findings of the accident report, which faulted NASA for discussing the risks via Powerpoint presentations rather than technical reports.) Bad tools, bad decisions. If common sense will rescue us from dumb conclusions reached by this approach, the exercise is merely meaningless. We should have just gone with common sense at the beginning. But I would be very worried if this process really drives any actual resource allocation. "Gambia got a higher rating than Senegal, so prep some wargames..."
I've previously written on the topic here .
Today I attended a meeting of the Agora, a monthly symposium on networks and security at the University of Washington. It was my first meeting and I was impressed. Lots of local infosec celebrities. The last speaker jumped on my last nerve (as my housemate puts it), though.
Andrew Macpherson presented a draft of an unpublished paper on a Threat Calculator he and others developed at the U of New Hampshire as part of an outfit called Justiceworks. The dude has some background; during 9/11 he was at Dartmouth College's Institute for Security Technology Studies and did some work for the Feds during the aftermath. Also in his favor is the correct use of the term "Threat" - at least per Richard Bejtlich, who is smarter than me and probably you. A threat is an entity with the intent and capability to attack.
Where he goes wrong is basically...his whole project. He takes a bunch of factors (24, I believe) to describe threat-actors (ok, he waters down the term "threat" - deduct a couple points), assigns each factor a rating on a scale of 1-5, and adds them up. Highest possible score is 140 points.
Where do I begin.
Numbers used to rank items are called Ordinal Numbers. Apart from Set Theory, you can't do arithmetic on ordinal numbers. Why not? Think about it. There is no precise relationship between numbers on a ranking scale. 1 < 2, but 1 is not half of 2 nor is it one less than 2. One is just in a position to the left on the scale. It might help to think of "First, Second, etc." instead of "One, Two, etc." We are so used to "regular" numbers that it's easy to make this mistake, but basing any decisions on this fundamentally flawed reasoning is a blunder. And the seeming precision - "hey, we quantified this shit! gives resonance to the blunder. You just painted a qualitative assessment with quantitative coloring.
You can't do arithmetic on numbers where the units are different. 5 gallons plus 3 hectares = ???
There's a problem of weight. Is a 5 for technical capability = a 5 for National/Cultural Stability? They have the same weight in the calculator. Funny that all 24 factors are exactly equal in importance.
There's a problem of scale. Even given the appropriateness of addition for this exercise, is a 5 really only 4 places more than a 1? This scale encompasses the PRC and my technologically illiterate neighbor. Sure, something close to 140 is scarier than something close to 24, but what's the scare curve look like? Does the pucker factor zoom skyward as you cross 100? 50?
These combine in unwholesome ways to undermine the whole exercise. The Netherlands scores high in technical aptitude, national stability, infrastructure similarity (they use similar control systems so they know how to attack them), etc. All of which is totally blown away by low scores in ideological antagonism. Yet overall they probably score higher than outfits that WILL commit serious cyber attacks some day.
Finally, there's the fundamental problem of pulling numbers out of your ass 24 times and then munging each together and gazing lovingly on the results like it means more than a single number pulled out of your ass. Some of those numbers are intensely debatable, such as those relating to the motivation of organized crime to conduct strategic cyber attacks. Maybe they will rise to that level of extortion some day. Maybe not. Who knows? I don't - and they don't either. Write me an assessment arguing for one or the other, and include your reasoning. Don't sink your reasoning in a morass of bogus numbers (and take any prospect for debate with it because you can't argue with something as scientifically sound as a number!).
So why does this matter? The tools we use to help us think affect the decisions we make. The pervasive use of Powerpoint at NASA helped doom the shuttle Columbia. (Search "Columbia Powerpoint" for a host of articles detailing the official findings of the accident report, which faulted NASA for discussing the risks via Powerpoint presentations rather than technical reports.) Bad tools, bad decisions. If common sense will rescue us from dumb conclusions reached by this approach, the exercise is merely meaningless. We should have just gone with common sense at the beginning. But I would be very worried if this process really drives any actual resource allocation. "Gambia got a higher rating than Senegal, so prep some wargames..."
posted by JimmytheGeek at 1:30 PM
0 Comments:
Post a Comment
<< Home