INFO 644: Public Policy AssignmentPresidential Initiatives<br />Group #2:<br />Tamara Clark <br />Gustave R DeCoursey<br /...
Top five issues for the current administration	<br />Cyber-Terrorism<br />Insider Threats<br />Risk Mitigation<br />Inform...
CYBER-TERRORISM<br />
Cyber Terrorism<br />Threat will increase as terrorists become more high tech and computer savvy.<br />“A cyber attack cou...
Cyber Terrorism<br />What is Cyber Terrorism?<br />“Cyber Terrorism is a criminal act perpetrated by the use of computers ...
Cyber Terrorism<br />Two Types of Cyber Terrorism Attacks<br />Effects based - Disruptive enough to generate the same fear...
Cyber Terrorism<br />What terrorists have <br />done:<br />Email bombs<br />Publication of threatening material and conten...
Cyber Terrorism<br />Evidence of acquiring computer skills to use for<br />cyber attacks:<br />Al-Qaeda fighters left behi...
Cyber Terrorism<br />Iranian Cyber Army defaced Congress’ website after President Obama’s State of the Union speech <br />...
Cyber Terrorism<br />
Cyber Terrorism<br />Secretary of State, Hillary Clinton, is pushing for internet freedom for all. <br />Governments shoul...
Insider Threats<br />
Insider Threats<br />Businesses are most at risk from former and current employees<br />Motivated by work situations, oppo...
Insider Threats<br />Real World Example:<br />Donald Burleson, a computer programmer<br />Designed a virus after being sco...
Insider Threats<br />Simpler Real World Example:<br />Two credit union employees had access to alter credit reports based ...
Insider Threats<br />U.S. Secret Service National Threat Assessment Center and the CERT Coordination Center of Carnegie Me...
Insider Threats<br />Insider Threat Study (continued):<br />Most perpetrators planned their actions in advance <br />Only ...
Insider Threats<br />Business tend to concentrate on preventing outside intrusion and neglect insider threats<br />62% of ...
Insider Threats<br />Companies need more requirements for:<br />Clear and concise policies<br />Training<br />Background c...
Risk Mitigation<br />
Risk Mitigation <br />The most commonly considered risk management strategy <br />This involves fixing the flaw or providi...
Risk Mitigation - Purpose<br />Helps in communicating how specific risks will be dealt with and the action steps that are ...
Risk Mitigation Issues/Threats<br />Care should be taken while assessing and prioritizing risks, since it could result in ...
Why should Risk Mitigation be considered important?<br />If ignored:<br />Result in the failure to develop a strong organi...
Risk Mitigation – Opportunities<br />Provide opportunities for the project members to discuss improvements, including expl...
Information Security/ Corporate governance<br />
Corporate Irresponsibility<br />WorldCom & Enron<br />No ownership of liabilities<br />Difficult to prosecute<br />Legisla...
Governance<br />Top down methodology for ownership of corporate processes<br />Information governance is a subset of corpo...
Security Governance<br />Security roles and responsibilities<br />Provide strategic direction<br />Ensures objectives are ...
Management’s Involvement<br />Understand Risks when governance is nonexistent<br />Reputation damage<br />Loss of revenue<...
Deliverables<br />Security plan design<br />Plan Implementation<br />Monitor plan for desired outcomes<br />Ongoing educat...
Cloud computing<br />
Cloud Computing – Definition <br />Internet-based computing, which allows for shared resources, such as software and infor...
Cloud Computing – Service models<br />Software as a Service, through which applications are provided in the cloud; <br />P...
Clouds<br />Reduced costs<br />Resource sharing is more efficient<br />Management moves to cloud provider<br />Consumption...
Federal Cloud<br />Due to its growing popularity of cloud computing, the federal government is moving more quickly than th...
Security issues with the cloud<br />Privileged user access<br />Sensitive data processed outside the enterprise brings a l...
Security issues with the cloud<br />Recovery<br />Even if you don’t know where your data is, a cloud provider should tell ...
Cloud – summary <br />Client-plus-cloud computing offers enhanced choice, flexibility, operational efficiency, and cost sa...
Upcoming SlideShare
Loading in …5
×

Gp2 Public Policy Assign8 644 Sp10

697 views

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
697
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
5
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide
  • Much of the current set of industry standards of today’s computing environment come out of these. Corporate irresponsibility created legislation to govern what should have already been governed by integrity of the individuals at the top.
  • The flow of the information within the chart depicts a possible path for all departments involved in the process of design, implementation and ongoing maintenance and management. The involvement of multiple levels of participants will help to make sure that all security needs are accounted for.
  • Security staff and management need to be constantly vigil about the information they are trying to protect. No plan implemented today will be sufficient in six months. New technology and applications are constantly bombarding the market. Corporations that want to maintain their leading edge on competition will ensue that security governance is a mission of the enterprise.
  • Gp2 Public Policy Assign8 644 Sp10

    1. 1. INFO 644: Public Policy AssignmentPresidential Initiatives<br />Group #2:<br />Tamara Clark <br />Gustave R DeCoursey<br />Deepa Devadas<br />Megan Dougherty <br />Chrystal Edwards<br />
    2. 2. Top five issues for the current administration <br />Cyber-Terrorism<br />Insider Threats<br />Risk Mitigation<br />Information Security/Corporate Governance<br />Working in the Cloud<br />
    3. 3. CYBER-TERRORISM<br />
    4. 4. Cyber Terrorism<br />Threat will increase as terrorists become more high tech and computer savvy.<br />“A cyber attack could have the same impact as a well-placed bomb” – Robert Mueller, III, Director of FBI<br />Terrorists look for and take advantage of vulnerabilities – network infrastructure security vulnerabilities<br />
    5. 5. Cyber Terrorism<br />What is Cyber Terrorism?<br />“Cyber Terrorism is a criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services, where the intended purpose is to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social or ideological agenda” - Keith Lourdeau, Deputy Asst Director of FBI’s Cyber Division<br />
    6. 6. Cyber Terrorism<br />Two Types of Cyber Terrorism Attacks<br />Effects based - Disruptive enough to generate the same fear within individuals as traditional types of terrorism <br />Intent based - Create severe economic harm or intimidate the government and individuals into supporting the terrorists’ political objectives<br />
    7. 7. Cyber Terrorism<br />What terrorists have <br />done:<br />Email bombs<br />Publication of threatening material and content<br />Denial-of-service<br />Defaced websites<br />What is possible?<br />Massive blackouts<br />Destruction of <br />Financial systems<br />Transportation systems<br />Defense infrastructure<br />National Security infrastructure<br />
    8. 8. Cyber Terrorism<br />Evidence of acquiring computer skills to use for<br />cyber attacks:<br />Al-Qaeda fighters left behind documents that contained information about Al-Qaeda operatives and their level of computer systems proficiency during an attack by the U.S <br />ImanSundra, the convicted Bali nightclub bomber, has written a book to influence Muslim youth to learn computer hacking skills in order to obtain credit card information and funds from U.S. companies.<br />
    9. 9. Cyber Terrorism<br />Iranian Cyber Army defaced Congress’ website after President Obama’s State of the Union speech <br />Google’s network infrastructure in China hacked for Gmail accounts of Chinese human rights activists<br />U.S. Department of Defense computer network attacked and malware installed on the network<br />
    10. 10. Cyber Terrorism<br />
    11. 11. Cyber Terrorism<br />Secretary of State, Hillary Clinton, is pushing for internet freedom for all. <br />Governments should not prevent people from connecting to the internet, web sites and each other.<br />Current administration will work with academia, the private sector, and foreign governments to provide new tools to the people so they may exercise their freedom of speech and expression towards their governments<br />Internet freedom will open the door to possible cyber terrorism attacks <br />
    12. 12. Insider Threats<br />
    13. 13. Insider Threats<br />Businesses are most at risk from former and current employees<br />Motivated by work situations, opportunities or other personal factors<br />Resultant action is computer abuse, fraud and theft, falsification, planting of malicious code, or sale of personal information<br />
    14. 14. Insider Threats<br />Real World Example:<br />Donald Burleson, a computer programmer<br />Designed a virus after being scolded for sotring personal letters on his company computer<br />Virus was designed to erase portions of the mainframe <br />After being fired, Burleson was able to employ an unauthorized backdoor password to execute the virus<br />
    15. 15. Insider Threats<br />Simpler Real World Example:<br />Two credit union employees had access to alter credit reports based on updated information received<br />Intentionally misused this authorization to alter credit reports in exchange for money <br />
    16. 16. Insider Threats<br />U.S. Secret Service National Threat Assessment Center and the CERT Coordination Center of Carnegie Mellon University’s Software Engineering Institute completed an Insider Threat Study and found:<br />Most insider events were triggered by a negative event in the workplace <br />Most were motivated by financial gain<br />Perpetrators did not share a common profile<br />
    17. 17. Insider Threats<br />Insider Threat Study (continued):<br />Most perpetrators planned their actions in advance <br />Only seventeen percent involved individuals with administrator access <br />Eighty-seven percent of the attacks used very simple user commands that didn't require any advanced knowledge <br />Most attacks were committed while at the workplace and during normal work hours<br />
    18. 18. Insider Threats<br />Business tend to concentrate on preventing outside intrusion and neglect insider threats<br />62% of large businesses have dealt with a security incident by a current or former employee.<br />Deloitte 2007 Global Security Survey found that 91% were concerned about employees and 79% cited the human factor as the root cause of Information Security failures.<br />Same survey showed 22% of respondents had provided no employee security training over the past year and less than a 33% said their staff was skilled enough to respond to security needs<br />
    19. 19. Insider Threats<br />Companies need more requirements for:<br />Clear and concise policies<br />Training<br />Background checks<br />Discipline actions<br />
    20. 20. Risk Mitigation<br />
    21. 21. Risk Mitigation <br />The most commonly considered risk management strategy <br />This involves fixing the flaw or providing some type of compensatory control to reduce the likelihood or impact associated with the flaw.<br />“Risk mitigation involves the process of prioritizing, evaluating and implementing appropriate controls. “<br />
    22. 22. Risk Mitigation - Purpose<br />Helps in communicating how specific risks will be dealt with and the action steps that are required to carry them out. <br />Provides a clear sense of the actions that the project team members are expected to take <br />Provides management with an understanding of what actions are being taken on their behalf to ameliorate project risk.<br />
    23. 23. Risk Mitigation Issues/Threats<br />Care should be taken while assessing and prioritizing risks, since it could result in time being wasted in dealing with risks that are not likely to occur. When there is too much time spent in assessing and managing unlikely risks, this diverts resources that could have been used more profitably. <br />If the risk management process is prioritized too highly, then this could keep an organization from ever completing a project or even getting started. <br />Another very important consideration in risk mitigation is to avoid any conflicts of interest. <br />
    24. 24. Why should Risk Mitigation be considered important?<br />If ignored:<br />Result in the failure to develop a strong organizational culture<br />Inefficient communication of information between levels of management<br />Insufficient risk assessment<br />Ineffective auditing and monitoring programs<br />
    25. 25. Risk Mitigation – Opportunities<br />Provide opportunities for the project members to discuss improvements, including explicit discussion of risk mitigation strategies and approaches, as well as what the probable impact of different risk mitigation measures might be<br /> These communications among organizational members offer opportunities to challenge assumptions, identify errors and voice issues. There are also opportunities for dispersed organizational members to grow and learn together.<br />Provides opportunities for clarification, for sense making, for organizational growth, and opportunities for people to discuss improvements to the organization and the impacts of different risk mitigation strategies<br />
    26. 26. Information Security/ Corporate governance<br />
    27. 27. Corporate Irresponsibility<br />WorldCom & Enron<br />No ownership of liabilities<br />Difficult to prosecute<br />Legislative Action<br />HIPAA<br />Sarbanes-Oxley Act<br />Graham-Leach-Bliley Act<br />
    28. 28. Governance<br />Top down methodology for ownership of corporate processes<br />Information governance is a subset of corporate governance<br />Deals with all aspects of information<br />Electronic<br />Written<br />Printed<br />Creation, transport and destruction <br />
    29. 29. Security Governance<br />Security roles and responsibilities<br />Provide strategic direction<br />Ensures objectives are met<br />Manages risk<br />Security policies<br />Address roles of individual<br />Address standards of implementation<br />Continual evaluation of security program<br />
    30. 30.
    31. 31. Management’s Involvement<br />Understand Risks when governance is nonexistent<br />Reputation damage<br />Loss of revenue<br />Litigious effects<br />Implementation works better with top involvement <br />
    32. 32. Deliverables<br />Security plan design<br />Plan Implementation<br />Monitor plan for desired outcomes<br />Ongoing education<br />Awareness of goals and initiatives<br />Maintain security education to highest levels <br />
    33. 33. Cloud computing<br />
    34. 34. Cloud Computing – Definition <br />Internet-based computing, which allows for shared resources, such as software and information to be provided to computers and other devices on-demand. Typical cloud computing providers deliver common business applications online which are accessed from another web service or software.<br />
    35. 35. Cloud Computing – Service models<br />Software as a Service, through which applications are provided in the cloud; <br />Platform as a Service, through which a cloud provider permits users to create or run applications using languages and tools supported by the provider while the provider delivers the underlying infrastructure such as servers, operating systems, or storage; and <br /> Infrastructure as a Service, through which a customer can deploy a computing infrastructure similar to a virtualized environment. <br />
    36. 36. Clouds<br />Reduced costs<br />Resource sharing is more efficient<br />Management moves to cloud provider<br />Consumption based cost<br />Faster time to roll out new services<br />Dynamic resource availability for crunch periods<br />Compliance/regulatory laws mandate on-site ownership of data<br />Security and privacy Latency & bandwith guarantees<br />Absence of robust SLA’s<br />Availability & reliabilty<br />Pros <br />Cons<br />
    37. 37. Federal Cloud<br />Due to its growing popularity of cloud computing, the federal government is moving more quickly than the private sector in both their interest and potential adoption of what has been referred to as the federal cloud<br />The Obama administration has made cloud computing a high priority, calling for a "fundamental re-examination of investments in the technology infrastructure.“<br />the overall objective is to create a more agile federal enterprise, where services can be provisioned and reused on demand to meet business needs<br />
    38. 38. Security issues with the cloud<br />Privileged user access<br />Sensitive data processed outside the enterprise brings a level of risk<br />Regulatory compliance<br />Customers are ultimately held responsible for the security and integrity of their own data, even when it is held by a service provider<br />Data location<br />When using a cloud, you may not have an idea of where your data is stored.<br />Data segregation<br />Data in the cloud in in a shared environment, with data from other customers<br />
    39. 39. Security issues with the cloud<br />Recovery<br />Even if you don’t know where your data is, a cloud provider should tell you what will happen to your data and service in case of a disaster<br />Investigative Support<br />Investigating inappropriate or illegal activity may be impossible in cloud computing<br />Long-term Viability<br />Ideally, your cloud computing provider will never go broke or get acquired by a larger company. If this happens you must be sure your data will be available, even after such an event. <br />
    40. 40. Cloud – summary <br />Client-plus-cloud computing offers enhanced choice, flexibility, operational efficiency, and cost savings for governments, businesses, and individual consumers.<br />To take full advantage of these benefits, reliable assurances regarding the privacy and security of online data must be provided.<br />In addition, a number of regulatory, jurisdictional, and public policy issues remain to be solved in order for online computing to thrive.<br />

    ×