On Friday I asked a simple question over Twitter and then let myself get dragged into a rat-hole of a debate that had people pulling out popcorn and checking the latest odds in Vegas. (Not the odds on who would win – that was clear – but rather on the potential for real bloodshed).
And while the debate strayed from my original question, it highlighted a major problem we often have in the security industry (and probably the rest of life, but I’m not qualified to talk about that).
A common logical fallacy is to assume that a possibility is a probability. That because something can happen, it will happen. It’s as if we tend to forget that the likelihood something will happen (under the circumstances in question) is essential to the risk equation – be it quantitative, qualitative, or whatever.
Throughout the security industry we continually burn our intellectual capital by emphasizing low-probability events.
“Mac malware might happen so all Mac users should buy antivirus or they’re smug and complacent”. Forgetting the fact that the odds of an average Mac user being infected by any type of malware are so low as to be unmeasurable, and lower than their system breaking due to problems with AV software. Sure, it might change. It will probably change; but we can’t predict that with any certainty and until then our response should match the actual (current) risk.
Bluetooth attacks are another example. Possible? Sure. Probable? Not unless you’re at a security or hacker conference.
There are times, especially during scenario planning, to assume that anything that can happen will happen. But when designing your actual security we can’t equate all threats.
Possible isn’t probable. The mere possibility of something is rarely a good reason to make a security investment.
Reader interactions
21 Replies to “Possibility is not Probability”
I get the point of your title, Rich, but I think it’s unfortunate to make it under the often-impassioned debate that is Mac malware.
Even despite numbers, there is still debate on what is probable. Some may find it far more probable that Mac malware will occur while others don’t think it is probable while others will say, “If it’s not here, it’s not probable at the present and I’ll worry about it tomorrow only after it actually happens.” Some simply believe you should just run AV, as a matter of best practice, regardless. It is, sadly, a passionate debate.
It might be another bad example (human life is always impassioned), but with Hurricane Katrina wasn’t that an unlikely event and a decision based on some scale between probable and cost? <--feel free to leave that as rhetorical. I try not to dive into that topic too much, as many people know far more about it than I do. This really reminds me also of Schneier's (or others, I'm not sure) remarks on risk and how we worry so much about improbable but possible events.