week 7 :Discusses situational awareness. Much of the security efforts of the past have been centered around prevention and protection. The increasing sophistication of cyber attacks have shown that no controls are 100% effective

Cyber_Attacks_Chapter10_PowerPoint_Lecture_Slides.pdf

Home >Information Systems homework help >week 7 :Discusses situational awareness. Much of the security efforts of the past have been centered around prevention and protection. The increasing sophistication of cyber attacks have shown that no controls are 100% effective

Chapter 10

Awareness

Cyber Attacks Protecting National Infrastructure, 1st ed.

• Situational awareness is the real-time understanding within an organization of its security risk posture

• Awareness of security posture requires consideration of the following – Known vulnerabilities

– Security infrastructure

– Network and computing architecture

– Business environment

– Global threats

– Hardware and software profiles

C h a p te

r 1 0 –

A w

a re

n e s s

Introduction

Fig. 10.1 – Optimal period of system usage for cyber security

C h a p te

r 1 0 –

A w

a re

n e s s

• Factoring in all elements of situational awareness should create an overview of current security risk

• Descriptors such as high, medium, and low are too vague to be helpful

• Security risk levels should be linked with actionable items

C h a p te

r 1 0 –

A w

a re

n e s s

Introduction

Fig. 10.2 – Rough dashboard estimate of cyber security posture

C h a p te

r 1 0 –

A w

a re

n e s s

Fig. 10.3 – Security posture changes based on activity and response

C h a p te

r 1 0 –

A w

a re

n e s s

Detecting Infrastructure Attacks

• No security task is more difficult and complex than the detection of an ongoing attack

• Many tools for detecting attack, yet none comprehensive or foolproof

• Determination of risk level is a fluid process

C h a p te

r 1 0 –

A w

a re

n e s s

Fig. 10.4 – Attack confidence changes based on events

C h a p te

r 1 0 –

A w

a re

n e s s

Managing Vulnerability Information

• Situational awareness for national infrastructure protection requires a degree of attention to daily trivia around vulnerability information

• Practical heuristics for managing vulnerability information – Structured collection

– Worst case assumptions

– Nondefinitive conclusions

– Connection to all sources

C h a p te

r 1 0 –

A w

a re

n e s s

Fig. 10.5 – Vulnerability management structure

C h a p te

r 1 0 –

A w

a re

n e s s

Managing Vulnerability Information

• Three basic rules for managers – Always assume adversary knows as much or more about

your infrastructure

– Assume the adversary is always keeping vulnerability- related secrets from you

– Never assume you know everything relevant to the security of your infrastructure

C h a p te

r 1 0 –

A w

a re

n e s s

Cyber Security Intelligence Reports

• Daily cyber security intelligence reports are standard in government agencies

• They would be useful in enterprise settings

• A cyber security intelligence report would include – Current security posture

– Top and new security risks

– Automated metrics

– Human interpretation

C h a p te

r 1 0 –

A w

a re

n e s s

Cyber Security Intelligence Reports

• Tasks for creating a cyber security intelligence report – Intelligence gathering

– Interpretation and publication

– Dissemination and archiving

C h a p te

r 1 0 –

A w

a re

n e s s

Fig. 10.6 – Cyber security intelligence report creation and dissemination

C h a p te

r 1 0 –

A w

a re

n e s s

Risk Management Process

• Security risks must be tracked and prioritized

• Generally agreed upon approach to measuring risk associated with specific components begins with two estimations – Liklihood

– Consequences

• Actual numeric value of risk less important than overall relative risk

• A useful construct compares security risk against cost of recommended action

C h a p te

r 1 0 –

A w

a re

n e s s

Fig. 10.7 – Risk versus cost decision path structure

C h a p te

r 1 0 –

A w

a re

n e s s

Risk Management Process

• Increasing risks likely incur increased costs

• Summary of management considerations – Maintaining a prioritized list of security risks

– Justifying all decisions

C h a p te

r 1 0 –

A w

a re

n e s s

Security Operations Centers

• The security operations center (SOC) is the most visible realization of real-time security situational awareness

• Most SOC designs begin with centralized model – a facility tied closely to operation

• A global dispersal of SOC resources is an around-the- clock real-time analysis of security threats

C h a p te

r 1 0 –

A w

a re

n e s s

Fig. 10.8 – Security operations center (SOC) high-level design

C h a p te

r 1 0 –

A w

a re

n e s s

• A national-level view of security posture will require consideration of the following – Commercial versus government information

– Information classification

– Agency politics

– SOC responsibility

C h a p te

r 1 0 –

A w

a re

n e s s

National Awareness Program