SIM Swap E03 2024 01 21
John Dorsey’s twitter account was taken over by a SIM swap – European banks use an API to check with phone companies if the account has had a SIM change in the past 48 hours and if so fail the request.
Whenever someone experienced in a field says something is possible, they are usually right. Whenever someone experienced in a field says something is impossible, they are usually wrong. So I’m bucking a trend here. I want to talk about Risk Quantification. From a mathematical perspective, it is impossible to quantify risk. That is, whenever you use math on numbers that are approximations, as opposed to pure counts, you must preserve the level of accuracy. Five people is an exact number, while five minutes is an approximation with a certain degree of precision. When you calculate the riskiness of a cyberattack, you multiply that chance of a breach (a guess) with the cost of a breach (another guess). Mathematically, when you multiply a vanishingly small, estimated number with a very large, estimated number, the precision drops to zero. That is, you cannot create a meaningful answer – the result of the math is so imprecise that it is unquantifiable. Of course, you can always multiply 0.000013 times 45,000,000 (that’s what calculators are for) and get the number 585 – but there are no significant digits in that result. It could mean anything at all, or more precisely nothing at all.