Mathematical Model Helps Estimate Optimal Timing of Cyber Attack

sciencehabit writes "Have you been missing the grim mathematical war games that strategists once used to map out possible nuclear confrontations? Don't worry, the games are back — this time applied to computer security. Researchers have now mathematically formalized the strategy of computer hacking, potentially enabling anyone — governments, activist hackers, cybermafia — to determine the optimal timing of attacks."

Now

[Anonymous Coward]

If you don't do it now, *they* will.

Optimal attack time

[fatphil]

I've worked out the optimal time to pull down their coffee machine.
Where will these strategists be without their coffee, eh?

Obligatory

[Anonymous Coward]

What a strange game. The only winning move is not to play.

What about a nice game of chess?

Re:

[hcs_$reboot]

What about a nice game of chess?

With this [chessbase.com], you won't be disappointed.

Re:

[drainbramage]

For more detail check the newspaper, perhaps the Perl Harbor Gazette.

Re:

[sunderland56]

Hmm, the best time to attack is in the early morning local time?

No. Best time is about 6 PM on Friday - all of your *good* IT guys have left for the weekend, with only the newbies on the night shift left in the building; and all of your really good security people are getting drunk in a bar somewhere.

Re:

[fatphil]

Nope, saying "6" is an arithmetic solution, we need a mathematical one.

6 + Min[t>=0]:(Max[i]:(competence(staff_member_{i}, time 6+t)) <= target_competence)

Brought it upon ourselves

[pcwhalen]

The NSA encouraged weakening of number randomizers and randomization algorithms which weaken encryption. They don't report vulnerabilities in software.

We brought a world of less secure computer networks and electronic banking and commerce upon ourselves.

Hell we even gave hackers a damn fine model on how to attack.

From the article:"The Stuxnet worm, for instance, was supposed to quietly delete itself after doing its harm, but it was unintentionally released âoeinto the wild, where it is no doubt being t

Obvious

[Akratist]

While this is not quite what the article is talking about, right around the holidays is probably the best time to stage an attack, as I think the BBC (?) found out already. Where I work, the place was running on a skeleton crew, with the IT staff at a bare minimum and handling service calls instead of doing any network monitoring or maintenance (what do you deal with first -- system maintenance or someone in sales who can't connect to the server and is making a big stink about it?). Social engineering probably works great in the week or so before the holidays...figure out where the company Christmas party is going to be, then crash it. Find someone who's sloshed and start talking them up. If not that, people are still busy and distracted, gifts are often delivered, and so on. Everyone in a company, and especially IT managers, really need to step up their awareness during this time of year, not get lax about it.

Re:

[Anonymous Coward]

While this is not quite what the article is talking about, right around the holidays is probably the best time to stage an attack, as I think the BBC (?) found out already.

BBC? Other Targets will more more profitable to attack for sure.

Re:

[Akratist]

Probably, but someone thought it was valuable enough to: http://www.huffingtonpost.com/2013/12/29/bbc-hacked-christmas-access-britain_n_4515229.html [huffingtonpost.com]

Re:

[transporter_ii]

Yes, this. Someone had some taxpayer money to spend to come up with this crap. When the law and the NSA are playing S.H.I.E.L.D, this will look really cool on the monitors. And then they will time it for a holiday or other important day and release the DDoS.

The Rational Timing of Surprise ..

[DTentilhao]

"A classic example is the British decision in World War II to allow German spies to continue gathering damaging intelligence for Hitler years after the spies’ identities were discovered" link [sciencemag.org]

There were no spys allowed to freely operate prior to D-Day, they were all captured and utilized to feed the enemy false information. Reason being the British were reading the encrypted communications to the spies from Bletchley Park. link [wikipedia.org]

This is like Quantum Physics....

[3seas]

once you look at it.... and TELL EVERYONE....... it changes.

Mathematical Models?

[ruir]

Captain obvious called. Extended weekends, Xmas and summer holidays.

Re:

[rmdingler]

Major Obvious called.

Apparently, a penchant for the apparent is a promotable offense at his office.

Re:

[BonThomme]

he's just bitter because he's still only a Captain.

Re:

[aaronb1138]

I suspect lunchtime and towards the end of the day during M-F workdays are the best times. Nearby time zones still have enough late work day traffic that a minor issue might be dismissed as general internet congestion and at the same time, the target support people are more exhausted and likely to miss something / want to get out the door and go home.