Unpredictability and Predictability in security.

I am tasked to come up on which is more important in terms of security, if possible, on cyber security.

After reading through several articles on cyber security, i noticed many of the examples used falls under predictability, as most security engineers are dealing with known threats throughout the cyber world, however, is it possible to classify them as part of unpredictability as well. Since it is impossible to know when an attacker will attack, how he/she will attack, how much resources he/she will use.

Like a vaccine, you would not know when you will get sick, therefore, having regular vaccine shots will keep you safer, in a sense. 

However, similar to cyber security, if we are to discuss about unpredictability, we will not know what new kinds of attacks are developed and can our current defending system defend against such new attacks.

In my opinion, unpredictability is without a doubt the more important factor compared to predictability.  How am i to go about debating and explaining about this? Are there any references that I can look into to understand more about this factor?

P.S
Such a good question yet it is closed


  Is there any evidence that this actually leads to a significant reduction in successful credit card fraud?


Yes there is evidence, and Yes, it absolutely has resulted in reducing many types of card fraud:

The fraud prevention feature you are referring to is called Address Verification Service (AVS).  AVS service checks that the street number and/or the zip code presented at the terminal match the data present for the card holder at the issuing bank.

In real-time, the payment processor will return an AVS Response. Based on the response, the merchant can decide to reject a non-conforming transaction.

It has been adopted by nearly every card issuer in the US. 



See Merchant Guide to the Visa Address Verification Service

The possible response codes, and the configurable reject settings are shown here:



In a gas station terminal setting, the terminal might be set to reject AVS Response codes N and A, for example.
