Comments on: The Importance of Uncertainty http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/ A member of the Gartner Blog Network Fri, 11 Feb 2011 21:13:39 +0000 hourly 1 http://wordpress.org/?v=3.0.4 By: Ant http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/comment-page-1/#comment-392 Ant Tue, 01 Sep 2009 09:01:11 +0000 http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/#comment-392 OK, you had me for a moment there, Greg. The answer was obviously 50%. The chance of any child being a girl is 50% (plus or minus some small demographic deviation), so the chance of any child who happens to be one of twins being a girl is 50%. Thus, the chance of one *particular* child of a set of twins (firstborn, second-born) being a girl is 50%. As is the chance of *only* one of a set of twins being a girl. But, what you were asking was, what is the chance of *at least* one of a set of twins being a girl? Which is, as Richard illustrates, 75%. But that's not the way I’d initially read what you wrote. This illustrates another reason why we’re not better at security: We don’t always ask precisely the right questions. Attackers exploit ambiguities! — Ant OK, you had me for a moment there, Greg.

The answer was obviously 50%.

The chance of any child being a girl is 50% (plus or minus some small demographic deviation), so the chance of any child who happens to be one of twins being a girl is 50%. Thus, the chance of one *particular* child of a set of twins (firstborn, second-born) being a girl is 50%.

As is the chance of *only* one of a set of twins being a girl.

But, what you were asking was, what is the chance of *at least* one of a set of twins being a girl? Which is, as Richard illustrates, 75%.

But that’s not the way I’d initially read what you wrote.

This illustrates another reason why we’re not better at security: We don’t always ask precisely the right questions. Attackers exploit ambiguities!

— Ant

]]> By: Greg Young http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/comment-page-1/#comment-390 Greg Young Tue, 01 Sep 2009 04:18:52 +0000 http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/#comment-390 No sir - I said "Security budgets cannot continue to outpace IT spending indefinitely". Like the bad models for housing prices, the assumption that security spending can continue until it consumes 100% of IT spending is .. flawed. No sir – I said “Security budgets cannot continue to outpace IT spending indefinitely”. Like the bad models for housing prices, the assumption that security spending can continue until it consumes 100% of IT spending is .. flawed.

]]> By: Stiennon http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/comment-page-1/#comment-389 Stiennon Tue, 01 Sep 2009 03:36:52 +0000 http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/#comment-389 Cute. g-g, g-b, b-g, b-b. 3/4 include a girl, 3/4 include a boy. Can't continue to rise you say? What if the threat rises? I think a good assumption is that security spending rises in some relation to threats. Compliance is always a driver but somewhat discretionary. After all the PCI police are not very diligent. Let alone the COBIT or ITIL enforcement agencies. So what percent of spending on home improvements is security related? In Ottawa or Birmingham, Michigan it is pretty small. I replaced a lock set when we bought our house. ($26 out of umpty gagillion spent on paint and blinds). Yet in parts of Johannesburg, South Africa, people need to maintain ten foot walls topped by razor wire around their community, ten foot fences around their houses, and rape gates at the top of the stairs. What happens if cyber criminals, terrorists, and nation states actually start attacking the enterprise? What will security spending look like then? A lot more than is spent on patch management and AV today. Cute. g-g, g-b, b-g, b-b. 3/4 include a girl, 3/4 include a boy.

Can’t continue to rise you say? What if the threat rises? I think a good assumption is that security spending rises in some relation to threats. Compliance is always a driver but somewhat discretionary. After all the PCI police are not very diligent. Let alone the COBIT or ITIL enforcement agencies.

So what percent of spending on home improvements is security related? In Ottawa or Birmingham, Michigan it is pretty small. I replaced a lock set when we bought our house. ($26 out of umpty gagillion spent on paint and blinds). Yet in parts of Johannesburg, South Africa, people need to maintain ten foot walls topped by razor wire around their community, ten foot fences around their houses, and rape gates at the top of the stairs.

What happens if cyber criminals, terrorists, and nation states actually start attacking the enterprise? What will security spending look like then? A lot more than is spent on patch management and AV today.

]]> By: Twitter Trackbacks for The Importance of Uncertainty [gartner.com] on Topsy.com http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/comment-page-1/#comment-388 Twitter Trackbacks for The Importance of Uncertainty [gartner.com] on Topsy.com Mon, 31 Aug 2009 21:31:33 +0000 http://blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty/#comment-388 [...] The Importance of Uncertainty blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty – view page – cached [...] [...] The Importance of Uncertainty blogs.gartner.com/greg_young/2009/08/31/the-importance-of-uncertainty – view page – cached [...]

]]>