Secure Information Systems Notes

Why Learn About Secure Information Systems?

• Securing data and information is paramount.
• Protection against malicious acts, theft, or disruption is essential.
• There are complex trade-offs in IS security involving:
  • Security effort versus money spent.
  • Security versus system ease of use.
  • Pursuing prosecution versus avoiding negative publicity.

The Threat Landscape

• Cybercrime is continuously increasing.
• This negatively impacts brands, reputations, and earnings.
• Money spent on cybersecurity products and services is projected to exceed $1 trillion$ between 2017 and 2022.
• The average cost of cybersecurity incidents is $11.7 million$.
• Surveys indicate alarming results regarding the prevalence and impact of cybercrime.

Why Computer Incidents Are So Prevalent

• Increasing computer system complexity

  • Billions of communicating devices on networks.
  • Number of possible network points expanding continually.
  • Organizations constantly changing software by:
  • Adding new applications.
  • Modifying existing applications.
  • Replacing older, legacy information systems.
  • Bring your own device (BYOD) policies: both pros and cons.

• Using software with known vulnerabilities

  • Leads to potential exploits.
  • May expose zero-day attacks.
  • Difficult to keep up with patches.

• Increasing sophistication of those who would do harm

  • Computer troublemaker knowledge level has evolved over time
  • There's a growing number of software vulnerabilities identified annually, as shown in Figure 2.1 (example referenced: a graph showing total number of new software vulnerabilities identified annually).

Perpetrators Most Likely to Initiate a Cyberattack

• Careless insider: An inside (employee, business partner, contractor, consultant) who does not follow the organization’s security policies and enables a cyberattack to occur.
• Malicious employees: An insider who deliberately attempts to gain access to and/or disrupt a company’s information systems and business operations.
• Cybercriminal: Someone who attacks a computer system or network for financial gain.
• Hacktivist: An individual who hacks computers or websites to promote a political ideology.
• Lone wolf attacker: Someone who violates computer or Internet security maliciously or for illegal personal gain.
• Cyberterrorist: State-sponsored individual or group who attempts to destroy the infrastructure components of governments, financial institutions, corporations, utilities, and emergency response units.

Types of Attack Vectors

• Advanced Persistent Threat (APT): A network attack in which an intruder gains access to a network and stays there—undetected—with the intention of stealing data over a long period of time.
• Blended Threat: A sophisticated threat that combines the features of a virus, worm, Trojan horse, and other malicious code into a single payload.
• Phishing: The act of fraudulently using email to try to get the recipient to reveal personal data.
• Rootkit: A set of programs that enables its user to gain administrator-level access to a computer without the end user’s consent or knowledge. Once installed, the attacker can gain full control of the system and even obscure the presence of the rootkit from legitimate system administrators.
• Smishing: A variation of phishing that involves the use of texting.
• Social Engineering: The use of deception to trick individuals into divulging data needed to gain access to an information system or network.
• Spam: The use of email systems to send unsolicited email to large numbers of people.
• Trojan Horse: A seemingly harmless program in which malicious code is hidden. A victim on the receiving end of a Trojan horse is usually tricked into opening it because it appears to be useful software from a legitimate source.
• Virus: A piece of programming code, usually disguised as something else, that causes a computer to behave in an unexpected and usually undesirable manner.
• Vishing: Similar to smishing except that the victims receive a voice mail message telling them to call a phone number or access a Web site.
• Worm: A harmful program that resides in the active memory of the computer and duplicates itself. Worms differ from viruses in that they can propagate without human intervention, often sending copies of themselves to other computers by email.

Cyberattacks That Pose Serious Threats

• Ransomware: Stops computer until ransom paid.

  • Payment frequently demanded in Bitcoin.
  • Victims often pay.
  • Attacks are on the increase.
  • The average ransom demand is just over $1000$.
  • About 20% of victims never recover files.
  • Causes include infected email attachments or pop-up windows and vulnerabilities in software such as Microsoft’s Server Message Block (SMB).

• Distributed denial-of-service (DDoS) attacks: Hacker takes over computers via the Internet; the target computer responds to a stream of automated requests.

  • Botnet: Large group of targeted computers controlled by hackers from one or more remote locations; legitimate owners are unaware of control.

• Data breach: Unauthorized individuals release or access sensitive data. Figure 2.2 references largest data breaches in the United States as examples (Yahoo, Adult Friend Finder, eBay, Equifax, Heartland Payment Systems, Target).

• Cyberespionage: Deployment of malware to secretly steal high-value data; data provides an unfair competitive advantage to the perpetrator.

• Cyberterrorism: Intimidation of government or civilian population; use of information technology to disable critical national infrastructure; achieve political, religious, or ideological goals.

• Figure 2.3 illustrates Percent of Data Breaches by Government and Industry Sector

Consequences of a Successful Cyberattack

• Direct impact

  • Stolen assets’ value: Cash, inventory, equipment, patents, copyrights, trade secrets, data.

• Business disruption: Organization cannot operate effectively; existing or potential business and customer loss.

• Recovery costs.

• Legal consequences.

• Reputation damage.

• Figure 2.4 summarizes the consequences of a successful cyberattack (Business disruption, Direct cost, Legal consequences, Recovery cost, Reputation damage).

Federal Laws for Prosecuting Computer Attacks

• Computer Fraud and Abuse Act (U.S. Code Title 18, Section 1030): Addresses fraud and related activities in association with computers, including:

  • Accessing a computer without authorization or exceeding authorized access.
  • Transmitting a program, code, or command that causes harm to a computer.
  • Trafficking of computer passwords.
  • Threatening to cause damage to a protected computer.

• Fraud and Related Activity in Connection with Access Devices Statute (U.S. Code Title 18, Section 1029): Covers false claims regarding unauthorized use of credit cards.

• Identity Theft and Assumption Deterrence Act (U.S. Code Title 18, Section 1028): Makes identity theft a federal crime, with penalties of up to 15 years of imprisonment and a maximum fine of $250,000$.

• Stored Wire and Electronic Communications and Transactional Records Access Statutes (U.S. Code Title 18, Chapter 121): Focuses on unlawful access to stored communications to obtain, alter, or prevent authorized access to a wire or electronic communication while it is in electronic storage.

• USA Patriot Act: Defines cyberterrorism and associated penalties.

The CIA Security Triad

• CIA security triad:

  • Confidentiality
  • Integrity
  • Availability

• Layered security solution design:

  • Make cyberattacks difficult.
  • Attacker eventually gives up.
  • Attacker detected before harm inflicted.

• Figure 2.5. illustrates a multi-layered security solution (Organizational, Network, Application, End user), against various cyberattacks (Distributed denial-of-service, Cyberterrorism, Ransomware, Cyberespionage, Data breach).

Implementing CIA at the Organizational Level

• Security strategy

  • Start with a risk assessment:
  • Identify and prioritize threats the organization faces.
  • Define a disaster recovery plan:
  • Ensures data and technology assets availability.
  • Review security policies guiding employees:
  • Follow recommended processes and practices.
  • Perform security audits:
  • Ensure established policies being followed.
  • Regulatory standards compliance.

• Example Risk assessment for a hypothetical company are given in tables 2.4

• Additional standards your organization may be required to meet are given in table 2.5 (Bank Secrecy Act; European Union–United States Privacy Shield; Federal Information Security Management Act; Foreign Corrupt Practices Act; Gramm-Leach-Bliley Act (GLBA); Health Insurance Portability and Accountability Act; Payment Card Industry Data Security Standard (PCI-DSS); Sarbanes-Oxley Act).

• Security dashboard: Comprehensive display of performance indicators which reduces effort to monitor and identify threats.

• Figure 2.6 shows an organizational security dashboard, listing Key Performance Indicators (KPI), Goals, Actual values, and Status (Red, Yellow, Green) for quick assessment.

Implementing CIA at the Network Level

• Authentication methods

  • Three types of user credentials:
  • Something you know.
  • Something you possess.
  • Something you are.
  • Use two-factor authorization.
  • Biometric authentication:
  • Physiological or behavioral measurements used.
  • Requires a reference model of the unique characteristics stored digitally.

• Firewall: Software, hardware, or a combination of both; stands between internal network and the Internet; limits access based on access policy.

• Next-generation firewall (NGFW): Hardware or software; detects and blocks sophisticated attacks; filters network traffic based on packet contents; goes deeper to inspect packet content; matches sequences of bytes for harmful activities.

• Routers: Networking device connecting multiple networks together; forwards data packets; uses passphrase for security; additional layer of security, and can restrict access to specific Web sites.

• Encryption: Scramble messages or data so that only authorized parties can read the data. An encryption key is a value applied to plaintext to produce ciphertext that is required to decipher ciphertext.

  • Encryption algorithms are either Symmetric or Asymmetric.
  • Advanced Encryption Standard (AES): Common symmetric algorithm used by the WPA2 security protocol.

• Transport Layer Security (TLS): Communications protocol ensuring privacy between communicating applications and their users on the Internet.

• Proxy Servers and Virtual Private Networks: Intermediary between a Web browser and another Internet server; makes requests to Web sites, servers, and services; Virtual private network (VPN) enables remote users to access computing and storage devices and share data securely.

  • Figure 2.7 illustrates a Proxy Server setup.

Implementing CIA at the Application Level

• Authentication: Authenticate users before they access applications and require two-factor authentication.

• User roles and accounts: Users have authority to perform responsibilities and nothing more, implementing proper separation-of-duties.

• Data encryption: Use data encryption on all enterprise systems.

Implementing CIA at the End-User Level

• Security education: Educate all workers and provide a security self-assessment.

• Authentication methods: Use multifactor schemes and fingerprints.

• Antivirus software: Antivirus software should be installed on each computer and scan for a virus signature.

• Data encryption: Employ full-disk encryption to protect data.

• Self-assessment security test questions are given in Table 2.6 (Do you have the most current version of your computer’s operating system installed? Do you have the most current version of firewall, antivirus, and malware software installed? etc.)

• Implementing safeguards against attacks by malicious insiders: Departing employees and contractors have their computer accounts, login IDs, and passwords promptly deleted.

• Define employee roles carefully, separating key responsibilities properly so that roles and user accounts have enough authority to perform responsibilities and nothing more.

Detection of a Cyberattack

• Intrusion detection system (IDS): Software and/or hardware that monitors system and network resources and activities; detects network traffic attempting to circumvent security measures; notifies network security personnel with two fundamentally different approaches:

  • Knowledge-based approaches
  • Behavior-based approaches

• Figure 2.8 shows how an IDS notifies network security personnel when it detects network traffic that attempts to circumvent the security measures of a networked computer environment.

Response

• Incident notification: Define who to notify and determine what to say.

• Protection of evidence and activity logs: Document as incident is resolved; capture evidence for future prosecution; capture system events, specific actions taken, and external conversations in a logbook; use data for incident eradication and follow-up.

• Incident containment: Follow incident response plan and shut down or disconnect critical system from the network.

• Eradication: Collect and log all possible criminal evidence, verify backups, and create forensic disk image of compromised system; after virus eradication, create a new backup.

• Incident follow-up: Determine exactly what happened; evaluate the response; write a formal incident report detailing event chronology and incident impact, and report key elements.

Using a Managed Security Service Provider (MSSP)

• It is difficult to keep up with computer criminals and with new laws and regulations so a Managed security service provider (MSSP) is a company that monitors, manages, and maintains computer and network security for other organizations.

• MSSPs provide a valuable service for IS departments, providing vulnerability scanning and Web blocking and filtering capabilities.

Computer Forensics

• Computer forensics combines elements of law and computer science to identify, collect, examine, and preserves data for admissibility in court. Asking questions when evaluating readiness for a security incident is important.

• Proper handling of a computer forensics investigation is key for success in court of law.

• Table 2.7 lists questions to be considered when evaluating an organization’s readiness for a security incident (Has a risk assessment been performed to identify investments in time and resources that can protect the organization from its most likely and most serious threats? Have senior management and employees involved in implementing security measures been educated about the concept of reasonable assurance? etc).

Summary

• Computer crime is rapidly growing.
• Many different types of people are responsible for cyberattacks.
• Many different attack types are being used.
• Countermeasures are needed at all levels (Organizational, network, application, end-user).
• Key countermeasures include security risk assessments, intrusion detection systems, authentication methods, and training.