Applying Game Theory to Cybersecurity: Game Theory at RSA Conference Europe 2012

Categories: IT Security

In the “The Game of Cybersecurity”, I suggested that we as security professionals should be doing more to take advantage of game theory for the insights it can provide into the threats that we face and into effective strategies for cyber defense. As it turns out, there were a several presentations at RSA Conference Europe 2012 (including one of my own) that did just that.

The first was the session on “FLIPIT: A Game-Theory Handle on Password Reset and Other Renewal Defenses” that Ari Juels, Chief Scientist here at RSA, presented on Tuesday of the conference. Ari described how the “FLIPIT game of Stealthy Takeover”, developed by Ari and colleagues at RSA Labs in cooperation with Ron Rivest of MIT, who first presented FLIPIT in his keynote at Crypto 2011. FLIPIT was also explored recently in a new paper to which I also contributed (and will be presenting next week at Gamesec), can be used to derive important and unexpected insights into effective strategies for passwords, keys and other defenses that can be renewed or rotated.

  

Ari showed how the FlipIt game could be used to understand the limitations of the traditional approach to password reset every 90 days (or some other fixed interval) compared to strategies that incorporated higher degrees of unpredictability. The same insight applied to a number of other security strategies, such as in key rotation and virtual server re-imaging. The insight itself is valuable. But even more important, from my point of view, is the demonstration of how game theory can provide a quantitative mechanism for evaluating strategies, complementing other existing quantitative and qualitative tools that we already use in threat analysis, risk assessment and strategy formulation. This is a topic that I also explored in my Thursday session “Games of Keys and Clouds: Finding a (Nash) Equilibrium of Trust”, exploring both attacker/defender games and investment games in terms of the insights that they can provide in terms of various deployment models for key management in the cloud.

.The other presentation in which game theory also played an important role was Bruce Schneier’s keynote on “Trust, Security, and Society” on Wednesday. Both in that keynote and in a book-signing session later in the day, Bruce explored the role of trust in human societies, drawing on the contents of and research for his book Liars and Outliers that I’ve already referenced a number of times in other blogs. Bruce’s talks certainly referenced particular games. But more importantly, Bruce used the Prisoner’s Dilemma as a central metaphor in his talks and in his book, exposing and exploring the fundamental tension between group interest and self-interest, something he also discussed in a recent Q&A pointed to in his September 2012 Cryptogram newsletter. Game theory (along with the many other disciplines that Bruce also drew on) provided insights in understanding not just the relationship between attacker and defender, but also critical security issues that we face in our interconnected world.

It was great to have the sessions by Ari and Bruce at RSA Conference Europe. I’ll be attending the Gamesec conference in Budapest next week and am looking forward to spending time focused on the intersection of game theory and security. I’ll be certain to let you know what I learn!

Bob Griffin
Author:

Bob Griffin is Chief Security Architect at RSA, the Security Division of EMC, where he is responsible for technical architecture, standards and strategy, particularly for RSA’s data security products. He represents EMC to several standards organization, including as co-chair of the OASIS Key Management Interoperability Protocol (KMIP) technical committee. Bob has extensive experience in security strategy, corporate governance, business process transformation and software development. He has had the primary architectural responsibility for a number of production systems environments and for major software engineering projects at RSA, Entrust and Digital Equipment Corporation,. He is a frequently requested speaker for professional and industry conferences and has instructed courses within both professional and university settings.