Why it’s not good to depend on common sense for really big perils:
The models these companies created differed from peril to peril, but they
all had one thing in common: they accepted that the past was an imperfect
guide to the future. No hurricane has hit the coast of Georgia, for
instance, since detailed records have been kept. And so if you relied
solely on the past, you would predict that no hurricane ever will hit the
Georgia coast. But that makes no sense: the coastline above, in South
Carolina, and below, in Florida, has been ravaged by storms. You are
dealing with a physical process, says Robert Muir-Wood, the chief
scientist for R.M.S. There is no physical reason why Georgia has not been
hit. Georgias just been lucky. To evaluate the threat to a Georgia beach
house, you need to see through Georgias luck. To do this, the R.M.S.
modeler creates a history that never happened: he uses what he knows about
actual hurricanes, plus what he knows about the forces that create and
fuel hurricanes, to invent a 100,000-year history of hurricanes. Real
history serves as a guide it enables him to see, for instance, that the
odds of big hurricanes making landfall north of Cape Hatteras are far
below the odds of them striking south of Cape Hatteras. It allows him to
assign different odds to different stretches of coastline without making
the random distinctions that actual hurricanes have made in the last 100
years. Generate a few hundred thousand hurricanes, and you generate not
only dozens of massive hurricanes that hit Georgia but also a few that
hit, say, Rhode Island.
—
In Nature’s Casino,
By Michael Lewis,
New York Times,
August 26, 2007
And of course
a hurricane did hit the Georgia coast before
detailed records were kept, in 1898.
The article notes that before Hurricane Andrew, insurers believed that a
Florida hurricane would cost max a few billion.
The actual cost was more like $15.5 billion,
predicted only by one woman: Karen Clark, founder of A.I.R.
Sure, the Georgia coast doesn’t have any single concentration of wealth
like Miami.
But it does have a swath of wealth that could be taken down by a single storm.
And complacent owners who think it can’t ever happen,
just like
people in Thailand didn’t believe
Smith Dharmasaroja before the 2004 Tsunami.
Meanwhile, on the Internet, the few insurers of Internet business continuity
are winging it and most companies have no insurance at all,
despite online crime becoming increasingly sophisticated,
leveraging the global reach of the Internet,
and
the possibility of a global worm that could cause $100 billion damage
still being out there.
-jsq
.
The
Anti-Phishing Working Group
is having one of its periodic member meetings,
this time in Pittsburgh.
Probably I shouldn’t report too much detail,
but I’ll say that interesting things are going on worldwide
that may spread to other countries.
For example, in Japan it seems that fake programming sites
are more popular than phishing.
Also, if I heard correctly, most phishing in the Japanese
language originates from phishers in Japan.
This would make sense, since it’s very hard for foreigners
to write well enough to pretend to be Japanese.
So that one probably won’t spread too widely,
but the fake programming scam could.
Adam Shostack
Why Internet security professionals are losing: