Sit in a common area and observe. This may be in your office, a co.docx

Sit in a common area and observe. This may be in your office, a
coffee shop, or on a park bench. Begin to look at the world
around you. Take notes of common problems people have. Is
there a way to make these problems disappear with an
innovative product or process?
Research the company that currently owns the process or
product.
Observe people that use the product or process.
Scrutinize the product or process.
Observe the product or process in use.
Research the creator of the product or process.
Research the changes that the product or process has gone
through.
Determine why the product needs to change.
Describe a product and its attraction in the marketplace.
Demonstrates why it is a positive move for the company and the
expected effect.
1
Copyright © 2012, Elsevier Inc.
All Rights Reserved
Chapter 7
Discretion
Cyber Attacks
Protecting National Infrastructure, 1st ed.

2
• Proprietary information will be exposed if discovered
by hackers
• National infrastructure protection initiatives most
prevent leaks
– Best approach: Avoid vulnerabilities in the first place
– More practically: Include a customized program focused
mainly on the most critical information
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n

Introduction
3
• A trusted computing base (TCB) is the totality of
hardware, software, processes, and individuals
considered essential to system security
• A national infrastructure security protection program
will include
– Mandatory controls
– Discretionary policy
• A smaller, less complext TCB is easier to protect
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re

tio
n
Trusted Computing Base
4
Fig. 7.1 – Size comparison issues in a
trusted computing base
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n

5
• Managing discretion is critical; questions about the
following should be asked when information is being
considered for disclosure
– Assistance
– Fixes
– Limits
– Legality
– Damage
– Need
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re

tio
n
Trusted Computing Base
6
• Security through obscurity is often maligned and
misunderstood by security experts
– Long-term hiding of vulnerabilities
– Long-term suppression of information
• Security through obscurity is not recommended for
long-term protection, but it is an excellent
complementary control
– E.g., there’s no need to publish a system’s architecture
– E.g., revealing a flaw before it’s fixed can lead to rushed
work and an unnecessary complication of the situation
All rights Reserved
C
h
a
p
te
r 7
–

D
is
c
re
tio
n
Security Through Obscurity
7
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio

n
Fig. 7.2 – Knowledge lifecycle for
security through obscurity
8
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n
Fig. 7.3 – Vulnerability disclosure
lifecycle

9
• Information sharing may be inadvertent, secretive, or
willful
• Government most aggressive promoting information
sharing
• Government requests information from industry for
the following reasons
– Government assistance to industry
– Government situational awareness
– Politics
• Government and industry have conflicting
motivations
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c

re
tio
n
Information Sharing
10
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n
Fig. 7.4 – Inverse value of information
sharing for government and industry

11
• Adversaries regularly scout ahead and plan before an
attack
• Reconnaissance planning levels
– Level #1: Broad, wide-reaching collection from a variety of
sources
– Level #2: Targeted collection, often involving automation
– Level #3: Directly accessing the target
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio

n
Information Reconnaissance
12
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n
Fig. 7.5 – Three stages of
reconnaissance for cyber security
13

• At each stage of reconnaissance, security engineers
can introduce information obscurity
• The specific types of information that should be
obscured are
– Attributes
– Protections
– Vulnerabilities
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n
Information Reconnaissance

14
• Layering methods of obscurity and discretion adds
depth to defensive security program
• Even with layered obscurity, asset information can
find a way out
– Public speaking
– Approved external site
– Search for leakage
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n

• Governments have been successful at protecting
information by compartmentalizing information and
individuals
– Information is classified
– Groups of individuals are granted clearance
• Compartmentalization defines boundaries, which
helps guides decisions
• Private companies can benefit from this model
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n
Organizational Compartments

All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n
Fig. 7.8 – Example commercial mapping
of clearances and classifications
19
• To implement a national discretion program will
require
– TCB definition
– Reduced emphasis on information sharing
– Coexistence with hacking community

– Obscurity layered model
– Commercial information protection models
All rights Reserved
C
h
a
p
te
r 7
–
D
is
c
re
tio
n
National Discretion Program
1. Watch the Ted Talk: Four ways to fix a broken legal system
2. Watch the Ted Talk: Laws that choke creativity
3. Review Creative Commons Website
4. Initial Post (600 words)
What role does the law play in your business life? Can you
recall a story where the law intersected with your life. Share
your story. Do you think that creative commons will open up

creative avenues for you and your business? Do you agree with
Lawrence Lessig's ideas? Why or Why not?
The World's Most Innovative Companies
· The Business Dictionary defines innovation as "The process of
translating an idea or invention into a good or service that
creates value or for which customers will pay." In other words,
a company can create, or invent all day long, but without
satisfying a customer need, what is the point? In a start-up,
entrepreneurs can come up with a list of ideas, but without
converting the idea into an opportunity, the entrepreneur
remains a hobbyist. From corporate to start-up, innovation is
required in products as well as business models.
· Read Part 1 of the Drive Book.
· For this discussion, pick one company from Fast Company's
article, "The World's 50 Most Innovative Companies."
(http://www.fastcompany.com/section/most-innovative-
companies-2015). Please select one different than what your
classmates choose. Describe the company's business model.
What makes it an innovative business model? Do you believe it
is a sustainable business model? Why or why not? Name one of
the company's competitors. How does their business model
differ from the company that you selected?
· Please review the Rubric for Online Discussions before
starting.

Sit in a common area and observe. This may be in your office, a co.docx

Recommended

Recommended

More Related Content

Similar to Sit in a common area and observe. This may be in your office, a co.docx

Similar to Sit in a common area and observe. This may be in your office, a co.docx (20)

More from jennifer822

More from jennifer822 (20)

Recently uploaded

Recently uploaded (20)

Sit in a common area and observe. This may be in your office, a co.docx