<br><div class="gmail_quote">On Tue, Dec 9, 2008 at 11:45 PM, Dave Aitel <span dir="ltr"><<a href="mailto:dave@immunityinc.com">dave@immunityinc.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
</div>One technique we're doing this week with a client is taking an attack<br>
tree and marking it up with dollar values. I.E. if you wanted to buy<br>
an 0day in X component, how much would it cost?<br>
<br>
This then is a simple summation to produce a "how much is it to get<br>
into the internal network from the internet" which the business can<br>
use to help them decide yay/nay on the project as a whole depending on<br>
their own view of the threat and the value of the information they are<br>
protecting.<br>
<br>
- -dave<br>
<div><div></div><br></div></blockquote></div><br>Care to share the generalized outcome? Perhaps something like the client chose a branch of 4 0days that had a value between $10,000 and $50,000? Assuming you had a way to state x, y, & z 0days exist (even if you didn't have access to them) with some level of certainty, then you probably have a very valid method of at least quantifying exposure. Heck, depending upon the level of certainty, I would pay you as a service to help me quantify my clients' exposures.<br>
<br>Jon Passki<br>pgp: 1BB0 A946 927B 93C3 ED6A 0466 6692 6C2C 84BE 4122<br>