Discretion

Dharma006

Cyber_Attacks_Chapter07_PowerPoint_Lecture_Slides1.pdf

Home >Information Systems homework help >Discretion

Chapter 7

Discretion

Cyber Attacks Protecting National Infrastructure, 1st ed.

• Proprietary information will be exposed if discovered by hackers

• National infrastructure protection initiatives most prevent leaks – Best approach: Avoid vulnerabilities in the first place – More practically: Include a customized program focused

mainly on the most critical information

C hapter 7 –

D iscretion

Introduction

• A trusted computing base (TCB) is the totality of hardware, software, processes, and individuals considered essential to system security

• A national infrastructure security protection program will include – Mandatory controls – Discretionary policy

• A smaller, less complext TCB is easier to protect

C hapter 7 –

D iscretion

Trusted Computing Base

Fig. 7.1 – Size comparison issues in a trusted computing base

C hapter 7 –

D iscretion

• Managing discretion is critical; questions about the following should be asked when information is being considered for disclosure – Assistance – Fixes – Limits – Legality – Damage – Need

C hapter 7 –

D iscretion

Trusted Computing Base

• Security through obscurity is often maligned and misunderstood by security experts – Long-term hiding of vulnerabilities – Long-term suppression of information

• Security through obscurity is not recommended for long-term protection, but it is an excellent complementary control – E.g., there’s no need to publish a system’s architecture – E.g., revealing a flaw before it’s fixed can lead to rushed

work and an unnecessary complication of the situation

C hapter 7 –

D iscretion

Security Through Obscurity

C hapter 7 –

D iscretion

Fig. 7.2 – Knowledge lifecycle for security through obscurity

C hapter 7 –

D iscretion

Fig. 7.3 – Vulnerability disclosure lifecycle

• Information sharing may be inadvertent, secretive, or willful

• Government most aggressive promoting information sharing

• Government requests information from industry for the following reasons – Government assistance to industry – Government situational awareness – Politics

• Government and industry have conflicting motivations

C hapter 7 –

D iscretion

Information Sharing

C hapter 7 –

D iscretion

Fig. 7.4 – Inverse value of information sharing for government and industry

• Adversaries regularly scout ahead and plan before an attack

• Reconnaissance planning levels – Level #1: Broad, wide-reaching collection from a variety of

sources – Level #2: Targeted collection, often involving automation – Level #3: Directly accessing the target

C hapter 7 –

D iscretion

Information Reconnaissance

C hapter 7 –

D iscretion

Fig. 7.5 – Three stages of reconnaissance for cyber security

• At each stage of reconnaissance, security engineers can introduce information obscurity

• The specific types of information that should be obscured are – Attributes – Protections – Vulnerabilities

C hapter 7 –

D iscretion

Information Reconnaissance

• Layering methods of obscurity and discretion adds depth to defensive security program

• Even with layered obscurity, asset information can find a way out – Public speaking – Approved external site – Search for leakage

C hapter 7 –

D iscretion

Obscurity Layers

C hapter 7 –

D iscretion

Fig. 7.6 – Obscurity layers to protect asset information

• Governments have been successful at protecting information by compartmentalizing information and individuals – Information is classified – Groups of individuals are granted clearance

• Compartmentalization defines boundaries, which helps guides decisions

• Private companies can benefit from this model

C hapter 7 –

D iscretion

Organizational Compartments

C hapter 7 –

D iscretion Fig. 7.7 – Using clearances and

classifications to control information disclosure

C hapter 7 –

D iscretion

Fig. 7.8 – Example commercial mapping of clearances and classifications

• To implement a national discretion program will require – TCB definition – Reduced emphasis on information sharing – Coexistence with hacking community – Obscurity layered model – Commercial information protection models

C hapter 7 –

D iscretion

National Discretion Program