ContentsThe library

Thinking Like an Attacker

Most of the List Is Not Going to Be Fixed

Last timeDeciding What Matters

You will not fix most of what you found, and that is the correct outcome. Write each one down as a decision with a reason, an owner and a date, so it is not an oversight.

Most of the list

The ranked list from the previous lesson has thirty or forty items on it.

You are going to fix five or six.

That is not a failure of the exercise and it is not a confession. It is

the normal and correct outcome, and the alternative is worse in a specific

way: a plan that schedules a fix for every item will be abandoned at item

nine, which means the remaining thirty are accepted anyway, silently, with

no reason, no owner and no record. Deciding not to fix things explicitly

is the only way of not fixing them honestly.

FIG 1The two halves of the list
findings accepted, which is most of them and the part that needs writing down
findings the enumeration pass produced
findings actually scheduled for a fix, which is a small number by necessity
The number accepted a is the total found t minus the number fixed f. For a typical list that is thirty-six found and nine fixed, so twenty-seven accepted, and the twenty-seven is the part of the document that will matter in two years. Teams write the nine up carefully and leave the twenty-seven as an absence.
FIG 2The four ways a finding leaves the list
reason survivessomebody answers for itcan be revisitedhow much it helps, 0 to
fixed1113
quietly dropped0000
accepted, written down w1112
accepted in a meeting, n0101
The second row is all zeros and is the commonest outcome by a wide margin. The fourth row is what most teams believe they are doing, and it loses the reason within a quarter because the only record is in somebodys memory. Only the two marked rows are decisions.

What makes it a decision

An acceptance written badly is indistinguishable from an oversight six

months later, and that is the test to apply: would a new engineer reading

this know that somebody considered it.

FIG 3An accepted risk, written down
plaintext
accepted: no record of who read a customer record

  what           an operator can read any account, unlogged
  loss if used   40k, per the asset register
  rate           0.4 a year, because it has happened twice
  why accepted   the logging work needs the console rewrite,
                 which is already scheduled for next quarter
  owner          head of customer operations
  revisit        when the console rewrite starts, or 90 days,
                 whichever comes first
  would change   any regulated customer onboarding, or one
                 further incident of this kind
Seven fields and about ninety seconds of work per item. The last two are the ones most often left off and they are what keep it a decision: without the trigger it is a permanent state, and without the owner it is the security teams private opinion.

Four fields do the work. The two numbers come straight from the ranking

and they are what makes the acceptance proportionate rather than lazy. The

reason is one sentence and it must be a real reason: the fix is expensive

relative to the loss, or it depends on work already scheduled, or the

mitigation in place is adequate. Because we did not get to it is not a

reason, it is a description of what happened.

And the last field, what would change the answer, is the one that

distinguishes an acceptance from a permanent state. It names the condition

the decision rests on, which means somebody can notice when the condition

fails.

The lesson stops here

3 more paragraphs to go

You have read the opening. The rest of the argument, the problems that check whether it landed, and the lines worth keeping at the end all come with a plan.

The first lesson of every course in the library reads the whole way through, free, so you can see exactly what the rest of them are.

See the planThe contents

This is the reading half

Starting the course gives you your own copy of it. Every idea on every page has problems standing under it, marked with a reason rather than a tick, and any sentence you do not believe can be opened and argued with. None of that can happen on a page nobody owns.

The contents

The rest of this course

  1. 01Start With What You Would Hate to Lose
  2. 02The Drawing Is Where the Findings Areopening only
  3. 03Nobody Attacks You in Generalopening only
  4. 04A Checklist Beats Being Cleveropening only
  5. 05Three Harmless Things in a Rowopening only
  6. 06Rank by Loss, Not by Frightopening only
  7. 07Most of the List Is Not Going to Be Fixedyou are here
  8. 08Hook It to the Things That Changeopening only

Read alongside