Intentional Threats

Examples of intentional threats include data theft such as inappropriate use of data (e.g., manipulating inputs); theft of computer time; theft of equipment and/or software; deliberate manipulation in handling, entering, programming, processing, or transferring data; sabotage; malicious damage to computer resources; destruction from malware and similar attacks; and miscellaneous computer abuses and Internet fraud.

Unintentional Threats

Unintentional threats fall into three major categories: human error, environmental hazards, social unrest and computer system failures.

• Human error can occur in the design of the hardware or information system. It can also occur during programming, testing, or data entry. Neglecting to change default passwords in applications or on systems or failing to manage patches creates security holes. Human error also includes untrained or unaware users falling prey to social engineering like phishing scams or ignoring security procedures. Human errors contribute to the majority of internal control and information security problems.
• Environmental hazards include volcanoes, earthquakes, blizzards, floods, power failures or strong fluctuations, fires (the most common hazard), defective heating, ventilation and air-conditioning (HVAC) systems, explosions, radioactive fallout, and water-cooling-system failures. In addition to the primary damage, computer resources can be damaged by the side effects of a hazard, such as smoke and water. Such hazards may disrupt normal computer operations resulting in extended data inaccessibility and exorbitant restoration and recovery costs.
• Computer systems failures can occur as the result of poor manufacturing, defective materials, or poor maintenance. Unintentional malfunctions can also occur for other reasons, ranging from administrator inexperience to inadequate testing.

In the next sections, you will learn more about the various sources of cyberthreats and their potential impact on organizations.

Hacking

Hacking is a very profitable industry. In 2016, 56% of reported data breaches were reported to be the result of hacking, which is 18% higher than those reported for 2015 (Verizon, 2016). Hacking is a big part of underworld cybercrime, and a way for hacktivists to protest. Both the anonymity of the Internet and lack of international treaties provide hackers with a feeling of near invincibility because they face very low risk of capture and punishment.

It is important to note that in the Hacker culture there are three classes of Hackers, shown in Table 5.3.

Cyber Social Engineering and Other Related Web-Based Threats

Experts believe the greatest cybersecurity dangers over the next few years will involve persistent threats, mobile computing, and the use of social media for social engineering. From an IT security perspective, social engineering is a hacker’s clever use of deception or manipulation of people’s tendency to trust, be helpful, or simply follow their curiosity. Powerful IT security systems cannot defend against what appears to be authorized access.

Notorious hacker Kevin Mitnick, who served time in jail for hacking, used social engineering as his primary method to gain access to computer networks. In most cases, the criminal never comes face-to-face with the victim, but communicates via the phone or e-mail.

Humans are easily hacked, making them and their social media posts high-risk attack vectors. For instance, it is often easy to get users to infect their corporate network or mobile devices by tricking them into downloading and installing malicious applications or backdoors.

Denial-of-Service

Cybersecurity experts warn that battling the increasing number of Denial-of-Service (DoS) threats needs to be a top priority. DoS threats come in a number of “flavors,” depending on their target. The three most prominent forms are:

• Distributed Denial-of-Service (DDoS)—crashes a network or website by bombarding it with traffic (i.e., requests for service) and effectively denying services to all those legitimately using it and leaving it vulnerable to other threats.
• Telephony Denial-of-Service (TDoS)—floods a network with phone calls and keeps the calls up for long durations to overwhelm an agent or circuit and prevents legitimate callers such as customers, partners, and suppliers from using network resources.
• Permanent Denial-of-Service (PDoS)—completely prevents the target’s system or device from working. This attack type is unique. Instead of collecting data or providing some ongoing perverse function its objective is to completely prevent its target’s device(s) from functioning. The damage PDoS causes is often so extensive that hardware must be reinstalled or reinstated. PDoS is also known as “phlashing.”

A “chilling” example of the havoc that PDoS can cause was demonstrated when a PDoS attack took the building management system offline in a block of residential apartments in Finland. The system’s Internet connection was blocked causing the system to repeatedly try to reconnect by rebooting itself. During this downtime, the system was unable to supply heat at a time when temperatures were below freezing! Fortunately, the energy company was able to find alternate accommodations for residents until the system was brought back online.

Insider and Privilege Misuse

Threats from employees, referred to as internal threats, are a major challenge largely due to the many ways an employee can carry out malicious activity. Insiders may be able to bypass physical security (e.g., locked doors) and technical security (e.g., passwords) measures that organizations have put in place to prevent unauthorized access. Why? Because defenses such as firewalls, intrusion detection systems (IDSs), and locked doors mostly protect against external threats. Despite the challenges, insider incidents can be minimized with a layered defense-in-depth strategy consisting of security procedures, acceptable use policies (AUPs), and technology controls.

Data tampering is a common means of attack that is overshadowed by other types of attacks. It refers to an attack during which someone enters false or fraudulent data into a computer, or changes or deletes existing data. Data tampering is extremely serious because it may not be detected. This is the method often used by insiders.

Physical Theft or Loss

The threat of an information asset going missing, whether through negligence or malice can send companies into a panic. The “miniaturization” of computing has led to an increase in physical theft or loss. Laptops, tablets, modems, routers, and USBs are much more easily transportable than mainframes or servers! When a laptop or tablet with unencrypted sensitive documents on it goes missing it’s difficult to determine if a data breach has actually occurred, but precautions must always be taken. Theft of laptops occurs primarily in victims’ own work area or from their vehicles. On the positive side, lost items are much more prevalent than theft. Theft is more likely to be related to the procurement of USB drives and printer paper.

Miscellaneous Errors

The main concern related to this source of cyberthreat is a shortage of capacity, thus preventing information from being available when needed. Other threat actions that fall within this category of miscellaneous errors are shown in Table 5.4.

New Attack Vectors

Vulnerabilities exist in networks, operating systems, applications, databases, mobile devices, and cloud environments. These vulnerabilities are attack vectors or entry points for malware, hackers, hacktivists, and organized crime. Mobile devices and apps, social media, and cloud services introduce even more attack vectors for malware, phishing, and hackers. As a result, new cyberthreats are on the horizon.

Concept Check 5.1

“High-Profile” and “Under-the-Radar” Attacks

Advanced persistent threat (APT) attackers operate “under the radar” so they can continue to steal data, as described in IT at Work 5.1 and profit from it. These APT attackers are profit-motivated cybercriminals who often operate in stealth mode. In contrast, hackers and hacktivists with personal agendas carry out high-profile attacks to gain recognition and notoriety.

Hacktivist groups, such as Anonymous, a loosely associated international network of activist and hacktivist entities and its spin-off hacker group, LulzSec, have committed daring data breaches, data compromises, data leaks, thefts, threats, and privacy invasions. Consider the following three examples:

• Philippine Commission on Elections A few months before a Philippine election, the hacker group Anonymous tapped into the commission’s website and released personal information on 55 million registered voters. The demonstration was in response to the Philippines’ lax security measures around its voting machines; 1.3 million overseas voters’ information, which included passport numbers, were included in the breach.
• Combined Systems, Inc. Proudly displaying its hacktivist flag, Anonymous took credit for knocking Combined Systems, Inc. offline and stealing personal data from its clients. Anonymous went after Combined Systems, which sells tear gas and crowd-control devices to law enforcement and military organizations, to protest war profiteers.
• CIA Twice in one year, Anonymous launched a DoS attack that forced the CIA website offline. The CIA takedown followed a busy week for the hacktivists. Within 10 days, the group also went after Chinese electronics manufacturer Foxconn, American Nazi groups, AV firm Symantec, and the office of Syria’s president.

In contrast, APTs typically steal corporate and government secrets. Most APT attacks are launched through phishing. Typically, this type of attack begins with some reconnaissance on the part of attackers. This can include researching publicly available information about the company and its employees, often from social networking sites. This information is then used to create targeted phishing e-mail messages. A successful attack could give the attacker access to the enterprise’s network.

APTs are designed for long-term espionage. Once installed on a network, APTs transmit copies of documents, such as Microsoft Office files and PDFs, in stealth mode. APTs collect and store files on the company’s network; encrypt them; then send them in bursts to servers often in China or Russia. This type of attack has been observed in other large-scale data breaches that exposed significant numbers of identities.

Both high-profile and under-the-radar attacks can be launched against a number of different targets. We will discuss those next.

Critical Infrastructure Attacks

Hackers, hacktivists, crime syndicates, militant groups, industrial spies, fraudsters, and hostile governments continue to attack networks for profit, fame, revenge, or an ideology; to wage warfare and terrorism, fight against a terrorist campaign, or disable their target. For example, the Department of Homeland Security (DHS) Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) warned that attacks against critical infrastructure are growing. In 2015, more than 427 vulnerability incidents were reported, far surpassing the 245 total attacks reported in 2014. The most affected industry was the energy sector.

Figure 5.3 shows the 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.

Attacks on critical infrastructure sectors can significantly disrupt the functioning of government and business—and trigger cascading effects far beyond the targeted sector and physical location of the incident. These cyberattacks could compromise a country’s critical infrastructure and its ability to provide essential services to its citizens.

For example, the first cyberattack against a nation’s power grid occurred in December, 2015, when a cyberattacker successfully seized control of the Prykarpattyaoblenergo Control Center (PCC) in the Western Ukraine leaving 230,000 citizens without power for up to six hours. The attackers carefully planned their assault over many months. They studied the networks and siphon operator credentials and finally launched their devastating synchronized assault in the middle of winter. The PCC operated a supervisory control and data acquisition (SCADA) system, which is a common form of industrial control system, that distributed electricity. The critical devices at 16 substations became unresponsive to any remote command by its operators after attackers overwrote its firmware. This type of control system is surprisingly more secure than some used in the United States since they have robust firewalls that separate them from control center business networks. Governments around the world have plans in place to deal with the consequences of natural disasters, yet none have disaster relief plans for a downed power grid. Clearly, this must change. Local and state governments must work together with their national counterparts to produce and quickly implement plans to address future attacks.

In response to the consistently growing number of cyberattacks over the past decade, the Inter-American Committee Against Terrorism (CICTE) issued a formal declaration to protect critical infrastructure from emerging threats and a Presidential executive order was signed in May 2017 to strengthen the cybersecurity of Federal networks and critical infrastructure.

Theft of Intellectual Property

Intellectual property (IP) can represent more than 80% of a company’s value and as such is a critical part of all 21st-century organizations. Losing customer data to hackers can be costly and embarrassing but losing IP, commonly known as trade secrets, could threaten a company’s existence. It’s a business leaders’ nightmare—that gut-wrenching realization that a corporate network has been breached and valuable intellectual assets have been stolen by unknown cybercriminals (Gelinne et al., 2016).

Theft of IP has always been a threat from corporate moles, disgruntled employees, and other insiders. While some IP may still be obtainable exclusively through physical means, digitization has made theft easier. Advancements in technology, increased mobility, rapid globalization, and the anonymous nature of the Internet create growing challenges in protecting IP. Hackers’ preferred modus operandi is to break into employees’ mobile devices and leapfrog into employers’ networks—stealing trade secrets without a trace.

Cybersecurity experts and government officials are increasingly concerned about breaches from other countries into corporate and government networks either through mobile devices or other means. For example, a government agency could have blueprints for a secret new weapon system stolen by foreign agents, or an employee of a popular game developer might steal their latest game before it is released to the public.

In May of 2016, President Barack Obama signed the Defend Trade Secrets Act (DTSA), to allow “the owners of trade secrets to bring a civil action in federal court for trade secret misappropriation” (Gibson Dunn, 2016). Until the signing of the DTSA, corporations had to rely on state law regarding trade secrets. Now, every American corporation is equally protected under federal law. Moreover, it extends the power of the federal government in regulation of trade secrets through interstate and foreign commerce while maintaining existing trade secret laws.

A famous example of theft of IP is the APT attack named Operation Aurora perpetrated against Google, described in IT at Work 5.1.

Identity Theft

One of the worst and most prevalent cyberthreats is identity theft. Thefts where individuals’ Social Security and credit card numbers are stolen and used by thieves are not new. Criminals have always obtained information about other people—by stealing wallets or dumpster diving. But widespread electronic sharing and databases have made the crime worse. Because financial institutions, data-processing firms, and retail businesses are reluctant to reveal incidents in which their customers’ personal financial information may have been stolen, lost, or compromised, laws continue to be passed that force those notifications.

Bring Your Own Device

Another, more recent, vulnerability is bring your own device (BYOD). Roughly 74% of U.S. organizations are either already using or planning to use BYOD. It’s an appealing concept because BYOD enables companies to cut costs by not having to purchase and maintain employees’ mobile devices. Unfortunately, many companies have rushed into it without considering issues relating to security. Mobile devices rarely have strong authentication, access controls, and encryption even though they connect to mission-critical data and cloud services. For example, only 20% of androids have a security app installed.

The BYOD trend is driven by employees using their own devices for business purposes because they are more powerful than those the company has provided. Another factor is mobility. In the past, and before the BYOD push, employees worked at their desks on a landline and on a computer plugged into the wall with a network cable. This change in exposure requires greater investment to defend against BYOD risks. As more and more people work from home and on the go, the office-bound traditional 9-to-5 workday has become a thing of the past.

Users bringing their personal mobile devices and their own mobile applications to work and connecting them to the corporate network is part of the larger consumerization of information technology (COIT) trend. Bring your own device (BYOD) and bring your own apps (BYOA) are practices that move enterprise data and IT assets to employees’ mobile devices and the cloud, creating a new set of tough IT security challenges. Figure 5.5 summarizes how apps, mobile devices, and cloud services put organizations at a greater risk of cyberattack. Widely used applications that are outside of the organization’s firewall are Twitter, Google Analytics, Dropbox, WebEx, and Salesforce.com.

Enterprises take risks with BYOD practices that they never would consider taking with conventional computing devices. One possible reason is that new devices, apps, and systems have been rolled out so quickly. As a result, smartphones are not being managed as secure devices, with fewer than 20% of users installing antimalware and 50% using some type of data encryption. In fact, employees expected instant approval of (or at least no disapproval of) and support for their new tablet computers within hours of the product’s release.

Social Media Attacks

Companies’ poor social media security practices put their brands, customers, executives, and entire organizations at serious risk. According to Cisco, Facebook scams are the most common form of malware distributed in 2015. The FBI reported that social media-related events had quadrupled over the past five years and PricewaterhouseCoopers (2015) found that more than one in eight enterprises has suffered at least one security breach due to a social media-related cyberattack.

Social networks and cloud computing increase vulnerabilities by providing a single point of failure and attack for organized criminal networks. Critical, sensitive, and private information is at risk, and like previous IT trends, such as wireless networks, the goal is connectivity, often with little concern for security. As social networks increase their offerings, the gap between services and information security also increases. For example, virus and malware attacks on a well-established service such as e-mail have decreased as e-mail security has improved over the years. Unfortunately, malware is still finding ways to successfully disrupt new services and devices, such e-readers, netbooks, Google’s Chrome OS, Facebook, YouTube, Twitter, LinkedIn, and other cloud-based social media networks. For example, in Twitter and Facebook, where users build relationships with other users, cybercriminals are hacking in using stolen logins. These types of attacks that take advantage of user trust are very difficult to detect. Facebook recently reported that up to 2% of its 31 million accounts are false, Twitter estimates 5%, and LinkedIn openly admitted, that they don’t have a reliable system for identifying and counting duplicate or fraudulent accounts.

To combat these cyberthreats, Web filtering, user education, and strict policies are key to preventing widespread outbreaks.

Concept Check 5.2

IT Defenses

Since malware and botnets use many attack methods and strategies, multiple tools are needed to detect them and/or neutralize their effects. Three essential defenses are the following:

1. Antivirus Software Antimalware tools are designed to detect malicious codes and prevent users from downloading them. They can also scan systems for the presence of worms, trojans, and other types of threats. This technology does not provide complete protection because it cannot defend against zero-day exploits. Antimalware may not be able to detect a previously unknown exploit.
2. Intrusion Detection Systems (IDSs) As the name implies, an IDS scans for unusual or suspicious traffic. An IDS can identify the start of a DoS attack by the traffic pattern, alerting the network administrator to take defensive action, such as switching to another IP address and diverting critical servers from the path of the attack.
3. Intrusion Prevention Systems (IPSs) An IPS is designed to take immediate action—such as blocking specific IP addresses—whenever a traffic-flow anomaly is detected. An application-specific integrated circuit (ASIC)-based IPS has the power and analysis capabilities to detect and block DDoS attacks, functioning somewhat like an automated circuit breaker.

Business policies, procedures, training, and disaster recovery plans as well as hardware and software are critical to cybersecurity. Table 5.6 lists the characteristics of an effective cybersecurity program.

To help keep managers updated on the latest cyberthreats and prioritize defenses, KPMG publishes its Data Loss Barometer. The annual report describes the latest trends and statistics for data losses worldwide. Key findings and predictions are listed in Table 5.7.

The higher the value of the asset to the company and to cybercriminals, the greater the risk is to the company and the higher the level of security needs to be. The smart strategy is to invest more to protect the company’s most valuable assets rather than trying to protect all assets equally, as discussed in IT at Work 5.2. The IT security field—like sports and law—has its own terminology, which is summarized for quick reference in Figure 5.7 and Table 5.8.

Business Continuity Planning

Risk management is not complete without a business continuity plan that has been tested to verify that it works. Business continuity refers to maintaining business functions or restoring them quickly when there is a major disruption. The plan covers business processes, assets, human resources, business partners, and more. Fires, earthquakes, floods, power outages, malicious attacks, and other types of disasters hit data centers. Yet, business continuity planning capabilities can be a tough sell because they do not contribute to the bottom line—that is, until it is too late. Compare them to an insurance policy: If and only if a disaster occurs, the money has been well spent. And spending on business continuity preparedness is an ongoing process because there is always more that could be done to prepare better.

The purpose of a business continuity plan is to keep the business running after a disaster occurs. Each function in the business should have a feasible backup plan. For example, if the customer service center or call center was destroyed by a storm or lost all power, would anyone know how the reps would continue to answer customer calls? The backup plan could define how to provide necessary network access to enable business to continue.

Government Regulations

Cyberattacks are now the number one type of danger facing many countries around the globe. As a result, international, federal, and state laws and industry regulations mandate that enterprises invest in cybersecurity defenses, audits, and internal controls to help secure confidential data, prevent attacks, and defend against fraud and unauthorized transactions such as money laundering (Morris 2016).

IT defenses must satisfy ever-stricter government and international regulations. All mandate the protection of PII. To protect consumers, some countries require strict compliance with these regulations. For example, in the United States the director of the Bureau of Consumer Protection at the Federal Trade Commission (FTC) warned that the agency would bring enforcement action against small businesses lacking adequate policies and procedures to protect consumer data. Some examples of major national security regulations are listed in Figure 5.8. Some of these regulations also apply to occupational fraud that is described in the next section.

Select the caption to view an interactive version of this figure online.

To ensure compliance with these regulations in United Sates, the SEC and FTC impose huge fines for data breaches to deter companies from underinvesting in data protection.

Concept Check 5.3

Occupational Fraud Prevention and Detection

High-profile cases of occupational fraud committed by senior executive have led to an increase in government regulations. Unfortunately, this increased legislation has not put an end to fraud.

The single most effective fraud prevention tactic is making employees aware that fraud will be detected by IT-monitoring systems and punished, with the fraudster possibly turned over to the police or FBI. The fear of being caught and prosecuted is a strong deterrent. IT must play a visible and major role in detecting fraud. A strong corporate governance program and internal audits and controls are essential to the prevention and detection of occupational fraud.

Several examples of occupational fraud, their characteristics and the extent to which they impact corporate financial statements are illustrated in Figure 5.9.

Select the caption to view an interactive version of this figure online.

General Controls

It is also important to have a set of general controls in place. The major categories of general controls are physical controls, access controls, data security controls, communication network controls, and administrative controls.

Internal Controls

The internal control environment is the work atmosphere that a company sets for its employees. Internal control (IC) is a process designed to achieve:

• Reliability of financial reporting, to protect investors
• Operational efficiency
• Compliance with laws, regulations, and policies
• Safeguarding of assets

Cyber Defense Strategies

The objective of IT security management practices is to defend all of the components of an information system, specifically data, software applications, hardware, and networks, so they remain in compliance. Before they make any decisions concerning defenses, the people responsible for security must understand the requirements and operations of the business, which form the basis for a customized defense strategy.

The defense strategy and controls that should be used depend on what needs to be protected and a cost–benefit analysis. That is, companies should neither underinvest nor overinvest. The major objectives of defense strategies are listed in Table 5.10.

A defense strategy is also going to require several controls, as shown in Figure 5.10. General controls are established to protect the system regardless of the specific application. For example, protecting hardware and controlling access to the data center are independent of the specific application. Application controls are safeguards that are intended to protect specific applications. In the next two sections, we discuss the major types of these two groups of information system controls.

Auditing Information Systems

Some companies rely on surprise audits. But being proactive about searching for problems is more effective and can stop frauds early on, before the losses mount. An audit is an important part of any control system. Auditing can be viewed as an additional layer of controls or safeguards. It is considered as a deterrent to criminal actions, especially for insiders. Auditors attempt to answer questions such as these:

• Are there sufficient controls in the system? Which areas are not covered by controls?
• Which controls are not necessary?
• Are the controls implemented properly?
• Are the controls effective? That is, do they check the output of the system?
• Is there a clear separation of duties of employees?
• Are there procedures to ensure compliance with the controls?
• Are there procedures to ensure reporting and corrective actions in case of violations of controls?

Auditing a website is a good preventive measure to manage the legal risk. Legal risk is important in any IT system, but in Web systems it is even more important due to the content of the site, which may offend people or be in violation of copyright laws or other regulations (e.g., privacy protection). Auditing e-commerce is also more complex since, in addition to the website, one needs to audit order taking, order fulfillment, and all support systems.

Concept Check 5.4

Risk Management and IT Governance Frameworks

Two widely accepted frameworks that guide risk management and IT governance are Enterprise Risk Management (ERM) and Control Objectives for Information and Related Technology (COBIT) 5.

COBIT 5

COBIT 5, is the internationally accepted IT governance and control framework created by the International Systems Audit and Control Association (ISACA) to align IT with business objectives, delivering value, and manage associated risks. It provides a framework for management, users, and IS audit, control, and security practitioners that allows them to bridge the gap between control requirements, technical issues, and business risks.

COBIT 5 is the leading framework for the governance and security of IT. COBIT 5, the most current version of the COBIT 5 framework is based on five principles, shown in Figure 5.11. COBIT 5 contains highly relevant guidance for IT practitioners and business leaders regarding governing and protecting data and information. COBIT 5 encourages each organization to customize COBIT to fit its priorities and circumstances and can be downloaded from isaca.org.

Three of the five COBIT 5 principles are most applicable to security:

1. A system needs to be in place that considers and effectively addresses enterprise information security requirements. At a minimum, this would include metrics for the number of clearly defined key security roles and the number of security-related incidents reported.
2. An established security plan has been accepted and communicated throughout the organization. This would include level of stakeholder satisfaction with the security plan, the number of security solutions that are different from those in the plan and the number of security solutions deviating from the enterprise security architecture that can lead to security gaps and potentially lengthen the time to resolve security or compliance issues.
3. Information security solutions are implemented throughout the organization. These should include the number of services and solutions that align with the security plan and security incidents caused by noncompliance with the security plan.

By following these three principles, using a specified set of IT-enabling processes, and taking additional steps to move from an application centric focus to a data centric focus, organizations that use COBIT 5 can improve the governance and protection of their data and information.

While COBIT 5 provides sound and comprehensive improvement recommendations to start the security governance journey, organizations clearly need to move beyond reactive compliance and security to proactively mandating the need for data privacy and security enterprise-wide. In this way data are always protected.

ERM and COBIT 5 can be used separately or jointly. As with most improvement methodologies, the key to success is to start using them one step at a time.

Industry Standards

Industry groups impose their own standards to protect their customers and their members’ brand images and revenues. One example is the Payment Card Industry Data Security Standard (PCI DSS) created by Visa, MasterCard, American Express, and Discover. PCI is required for all members, merchants, or service providers that store, process, or transmit cardholder data. PCI DSS requires merchants and card payment providers to make certain their Web applications are secure. If done correctly, this could reduce the number of Web-related security breaches.

The purpose of the PCI DSS is to improve customers’ trust in e-commerce, especially when it comes to online payments, and to increase the Web security of online merchants. To motivate following these standards, the penalties for noncompliance are severe. The card brands can fine the retailer, and increase transaction fees for each credit or debit card transaction. A finding of noncompliance can be the basis for lawsuits.

IT Security Defense-In-Depth Model

The Defense-in-Depth Model encourages a multilayered approach to information security. The basic principle is that when one defense layer fails, another layer provides protection. For example, if a wireless network’s security was compromised, then having encrypted data would still protect the data, provided that the thieves could not decrypt it.

The success of any type of IT project depends on the commitment and involvement of executive management, also referred to as the tone at the top. The same is true of IT security. This information security tone makes users aware that insecure practices and mistakes will not be tolerated. Therefore, an IT security model begins with senior management commitment and support, as shown in Figure 5.12. The model views information security as a combination of people, policies, procedures, and technology.

To use the Defense-in-Depth Model an organization must carry out four major steps:

1. Step 1: Gain senior management commitment and support Senior managers’ influence is needed to implement and maintain security, ethical standards, privacy practices, and internal control. IT security is best when it is top-driven. Senior managers decide how stringent infosec policies and practices should be in order to comply with laws and regulations. Financial institutions are subject to strict security and anti-money laundering (AML) rules because they face numerous national and international regulations and have high-value data. Advertising agencies and less regulated firms tend to have more lenient rules. Other factors influencing infosec policies are a corporation’s culture and how valuable their data are to criminals.

   For instance, management may decide to forbid employees from using company e-mail accounts for nonwork purposes, accessing social media during work hours, or visiting gambling sites. These decisions will then become rules stated in company policy, integrated into procedures, and implemented with technology defenses. Sites that are forbidden, for instance, can be blocked by firewalls.

2. Step 2: Develop acceptable use policies and IT security training Organizations need to put in place strong policies and processes that make responsibilities and accountabilities clear to all employees. An acceptable use policy (AUP) explains what management has decided are acceptable and unacceptable activities, and the consequences of noncompliance. Rules about tweets, texting, social media, e-mail, applications, and hardware should be treated as extensions of other corporate policies—such as physical safety, equal opportunity, harassment, and discrimination. No policy can address every future situation, so rules need to be evaluated, updated, or modified. For example, if a company suffers a malware infection traced to an employee using an unprotected smartphone connected to the company network, policies to restrict or prohibit those connections might be advisable.
3. Step 3: Create and Enforce IT security procedures and enforcement Secure procedures define how policies will be enforced, how incidents will be prevented, and how an incident will be responded. Here are the basic secure procedures to put in place:
   1. Define enforcement procedures Rules that are defined in the AUP must be enforced and enforcement procedures must be applied consistently. Procedures for monitoring employee Internet and network usage are defined at this stage.
   2. Designate and empower an internal incident response team (IRT) The IRT typically includes the CISO, legal counsel, senior managers, experienced communicators, and key operations staff. Minimizing the team size and bureaucracy can expedite decision making and response. Because there may be significant liability issues, legal counsel needs to be involved in incident response planning and communication.
   3. Define notification procedures When a data breach occurs the local police department, local office of the FBI, Securities and Exchange Commission (SEC), the U.S. Secret Service, or other relevant agency need to be notified immediately. Federal and state laws or industry regulations may define how and when affected people need to be notified.
   4. Define a breach response communications plan Effective incident response communication plans include personnel and processes with lists, channels, and social media needed to execute all communications that might be needed.
   5. Monitor information and social media sources Monitor Twitter, social media, and news coverage as a standard procedure to understand how people are responding to the incident and criticizing the company. Damage control procedures may be needed.

      When an incident occurs, the organization is ready to respond intelligently—having the correct information to be honest, open, and accountable, and to communicate with consumers and other important audiences as quickly as possible.

4. Step 4: Implement Security Tools: Hardware and software The last step in the model is implementation of software and hardware needed to support and enforce the AUP and secure practices. The selection of hardware and software defenses is based on risk, security budget, AUP, and secure procedures. Every device that connects to an organization’s network; every online activity and mobile app of employees; and each file sent or received are access points. Technology defense mechanisms need to be:
   • able to provide strong authentication and access control of industrial grade
   • appropriate for the types of networks and operating systems
   • installed and configured correctly
   • tested rigorously
   • maintained regularly

How much does a cyberattack really cost an organization? Regulatory fines, public relations costs, breach notification and protection costs, and other consequences of large-scale data breaches are easy to see and quantify. However, the effects of a cyberattack can linger for years, resulting in a wide range of intangible costs tied to a damaged reputation, disruption of operations, loss of IP or other strategic assets. The latter are much more difficult to measure since they are not easily quantifiable.

No matter which frameworks, standards, and controls are used to assess, monitor, and control cyber risk, a balanced approach to measuring direct costs and intangible impacts associated with cyberattacks must be used to paint an accurate picture of the damage sustained and to guide the creation of increased security measures going forward.

Concept Check 5.5