Black and white photograph of a chain secured with a padlock
Image: Creative Commons, flickr.com/photos/onepointfour/12472399134

Your security is only as good as the weakest link

We've all heard it said; perhaps even said it. Why do I have a problem with this? It tends to imply that you should focus on the weakest link which often isn't the case - especially if the weakest link is hardest to solve (e.g. PBCaK). It's not necessarily the issue that's going to give you the quickest ROI (return on investment) and risk reduction. It's also usually mathematically inaccurate. It's not that the analogy is bad, in fact it's very good, it's just often used incorrectly. Consider this scenario:

A chain with five risks labelled on its links: risks 1, 2, 4 and 5 at 10% likelihood and risk 3 at 15% likelihood

So if your security is only as good as the weakest link. And the weakest link (Risk 3) has an annual likelihood of 15% you have a 15% chance of a breach in a year, right? WRONG!

Your security is in fact the combination of the weakness of every link

The simplest way is to calculate the likelihood of not being breached, and then converting this into the breach likelihood by subtracting from 1. So in this case the probability works out as:

1 − (1 − L1) × (1 − L2) × (1 − L3) × (1 − L4) × (1 − L5)
= 1 − 0.9 × 0.9 × 0.85 × 0.9 × 0.9
= 1 − 0.56
= 0.44

In other words there is a 44% chance you will be breached in the next year in the illustrated scenario. Note that this is less than the sum of the likelihoods which would be 55%; if you toss a coin (50% likelihood of tails) twice you are not guaranteed to get a tails, even though the likelihoods sum to 100%.

The key is to take a holistic view rather than focus on the weakest link (as many of us have been encouraged to do by the misleading adage). Otherwise you may be ignoring other issues that in aggregate could be more significant, and may be more tractable.

Thoughts, experience, and feedback always welcomed via direct message.

Cheers
Andy