1 Copyright © 2012, Elsevier Inc. All Rights Reserved Chapter 10 Awareness Cyber Attacks Protecting National Infrastructure, 1st ed. 2 • Situational awareness is the real-time understanding within an organization of its security risk posture • Awareness of security posture requires consideration of the following – Known vulnerabilities – Security infrastructure – Network and computing architecture – Business environment – Global threats – Hardware and software profiles Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s Introduction 3 Fig. 10.1 – Optimal period of system usage for cyber security Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s 4 • Factoring in all elements of situational awareness should create an overview of current security risk • Descriptors such as high, medium, and low are too vague to be helpful • Security risk levels should be linked with actionable items Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s Introduction 5 Fig. 10.2 – Rough dashboard estimate of cyber security posture Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s 6 Fig. 10.3 – Security posture changes based on activity and response Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s 7 Detecting Infrastructure Attacks • No security task is more difficult and complex than the detection of an ongoing attack • Many tools for detecting attack, yet none comprehensive or foolproof • Determination of risk level is a fluid process Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s 8 Fig. 10.4 – Attack confidence changes based on events Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s 9 Managing Vulnerability Information • Situational awareness for national infrastructure protection requires a degree of attention to daily trivia around vulnerability information • Practical heuristics for managing vulnerability information – Structured collection – Worst case assumptions – Nondefinitive conclusions – Connection to all sources Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s 10 Fig. 10.5 – Vulnerability management structure Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e s s 11 Managing Vulnerability Information • Three basic rules for managers – Always assume adversary knows as much or more about your infrastructure – Assume the adversary is always keeping vulnerability- related secrets from you – Never assume you know everything relevant to the security of your infrastructure Copyright © 2012, Elsevier Inc. All rights Reserved C h a p te r 1 0 – A w a re n e ...

1. 1
Copyright © 2012, Elsevier Inc.
All Rights Reserved
Chapter 10
Awareness
Cyber Attacks
Protecting National Infrastructure, 1st ed.
2
• Situational awareness is the real-time understanding
within an organization of its security risk posture
• Awareness of security posture requires consideration
of the following
– Known vulnerabilities
– Security infrastructure
– Network and computing architecture
– Business environment
– Global threats

2. – Hardware and software profiles
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
Introduction
3
Fig. 10.1 – Optimal period of system
usage for cyber security

3. Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
4
• Factoring in all elements of situational awareness
should create an overview of current security risk
• Descriptors such as high, medium, and low are too
vague to be helpful
• Security risk levels should be linked with actionable

4. items
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
Introduction
5
Fig. 10.2 – Rough dashboard estimate
of cyber security posture

5. Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
6
Fig. 10.3 – Security posture changes
based on activity and response
Copyright © 2012, Elsevier Inc.
All rights Reserved

6. C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
7
Detecting Infrastructure Attacks
• No security task is more difficult and complex than
the detection of an ongoing attack
• Many tools for detecting attack, yet none
comprehensive or foolproof
• Determination of risk level is a fluid process
Copyright © 2012, Elsevier Inc.

7. All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
8
Fig. 10.4 – Attack confidence changes
based on events
Copyright © 2012, Elsevier Inc.
All rights Reserved
C

8. h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
9
Managing Vulnerability Information
• Situational awareness for national infrastructure
protection requires a degree of attention to daily
trivia around vulnerability information
• Practical heuristics for managing vulnerability
information
– Structured collection
– Worst case assumptions

9. – Nondefinitive conclusions
– Connection to all sources
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
10
Fig. 10.5 – Vulnerability management
structure

10. Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
11
Managing Vulnerability Information
• Three basic rules for managers
– Always assume adversary knows as much or more about
your infrastructure

11. – Assume the adversary is always keeping vulnerability-
related secrets from you
– Never assume you know everything relevant to the
security of your infrastructure
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s
s
12
Cyber Security Intelligence Reports

12. • Daily cyber security intelligence reports are standard
in government agencies
• They would be useful in enterprise settings
• A cyber security intelligence report would include
– Current security posture
– Top and new security risks
– Automated metrics
– Human interpretation
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n

13. e
s
s
13
Cyber Security Intelligence Reports
• Tasks for creating a cyber security intelligence report
– Intelligence gathering
– Interpretation and publication
– Dissemination and archiving
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re

14. n
e
s
s
14
Fig. 10.6 – Cyber security intelligence
report creation and dissemination
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w
a
re
n
e
s

15. s
15
Risk Management Process
• Security risks must be tracked and prioritized
• Generally agreed upon approach to measuring risk
associated with specific components begins with two
estimations
– Liklihood
– Consequences
• Actual numeric value of risk less important than
overall relative risk
• A useful construct compares security risk against cost
of recommended action
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–

16. A
w
a
re
n
e
s
s
16
Fig. 10.7 – Risk versus cost decision
path structure
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A
w

17. a
re
n
e
s
s
17
Risk Management Process
• Increasing risks likely incur increased costs
• Summary of management considerations
– Maintaining a prioritized list of security risks
– Justifying all decisions
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–
A

18. w
a
re
n
e
s
s
18
Security Operations Centers
• The security operations center (SOC) is the most
visible realization of real-time security situational
awareness
• Most SOC designs begin with centralized model – a
facility tied closely to operation
• A global dispersal of SOC resources is an around-the-
clock real-time analysis of security threats
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te

19. r 1
0
–
A
w
a
re
n
e
s
s
19
Fig. 10.8 – Security operations center
(SOC) high-level design
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1
0
–

20. A
w
a
re
n
e
s
s
20
• A national-level view of security posture will require
consideration of the following
– Commercial versus government information
– Information classification
– Agency politics
– SOC responsibility
Copyright © 2012, Elsevier Inc.
All rights Reserved
C
h
a
p
te
r 1

21. 0
–
A
w
a
re
n
e
s
s
National Awareness Program
Sheet1EmployeeStarting SalaryOn Road PctState UnivCIS
DegreeStayed 3
YearsTenure13890057%YesYesNo1124230068%YesYesNo5339
80075%NoYesNo2143570029%NoYesYes54040071%NoYesNo
1963640062%NoYesNo1873730041%YesNoYes83660037%NoY
esNo1793460065%NoYesNo20104230053%YesYesNo16113780
073%NoYesYes123970060%NoYesNo12133610056%YesYesYe
s143610042%YesYesYes153380035%NoYesYes163890036%No
YesYes173550050%NoYesNo15183760058%NoYesYes1938100
78%YesYesYes203830016%NoNoYes213460029%NoYesYes22
3630026%NoYesYes233720059%YesYesNo14243770055%Yes
YesYes253660045%NoYesNo13264100081%YesYesNo9274080
0111%YesYesNo7283670056%YesYesYes293770056%NoYesN
o22303770042%NoYesNo11313930069%YesYesNo1632375005
0%NoYesNo18334000069%YesYesNo9344150064%YesNoNo5
353960072%NoYesNo18363690042%NoYesYes373950062%No
YesNo5383780020%NoYesNo23393860057%NoYesNo8404060
070%YesYesYes414160063%YesYesYes424080044%NoNoYes
433620068%NoYesNo31443960059%NoYesNo10453610056%Y

22. esYesYes463610042%NoYesYes473950053%YesYesNo174839
10038%NoYesYes494030053%YesYesYes503880078%YesYes
Yes513940034%YesYesNo27523840023%NoYesYes533520033
%NoYesYes543610024%NoNoYes553710044%NoYesYes56372
0064%YesYesNo23573680046%YesNoYes583650027%NoNoYe
s593590029%NoNoYes603790076%YesYesNo14613790058%N
oYesNo26623790028%NoYesNo14633670037%NoYesYes6437
40049%NoYesNo19653820062%YesYesYes663660051%YesYe
sNo7
Sheet2
Sheet3