Scribd Logo
Upload

Welcome to Scribd!

  • 41 views

    2004 12 03 Larry Clinton Philadelphia Presentation About ISA and Coherent Program of Cyber Security Through Incentives

    Uploaded by

    isalliance
    1) The document outlines Larry Clinton's presentation on cyber security. It discusses the growing problem of cyber threats, why traditional solutions won't work, and proposes a new paradigm using tools and incentives. 2) It proposes a coherent 10 step program to improve cyber security through information sharing, best practices, education, market incentives, and expanding participation. 3) The goal is to establish a total systems approach to cyber security using cooperation rather than regulation.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    2004 12 03 Larry Clinton Philadelphia Presentation About ISA and Coherent Program of Cyber Security Through Incentives

    Uploaded by

    isalliance
    41 views35 pages
    1) The document outlines Larry Clinton's presentation on cyber security. It discusses the growing problem of cyber threats, why traditional solutions won't work, and proposes a new paradigm using tools and incentives. 2) It proposes a coherent 10 step program to improve cyber security through information sharing, best practices, education, market incentives, and expanding participation. 3) The goal is to establish a total systems approach to cyber security using cooperation rather than regulation.

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    1) The document outlines Larry Clinton's presentation on cyber security. It discusses the growing problem of cyber threats, why traditional solutions won't work, and proposes a new paradigm using tools and incentives. 2) It proposes a coherent 10 step program to improve cyber security through information sharing, best practices, education, market incentives, and expanding participation. 3) The goal is to establish a total systems approach to cyber security using cooperation rather than regulation.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    41 views35 pages

    2004 12 03 Larry Clinton Philadelphia Presentation About ISA and Coherent Program of Cyber Security Through Incentives

    Uploaded by

    isalliance
    1) The document outlines Larry Clinton's presentation on cyber security. It discusses the growing problem of cyber threats, why traditional solutions won't work, and proposes a new paradigm using tools and incentives. 2) It proposes a coherent 10 step program to improve cyber security through information sharing, best practices, education, market incentives, and expanding participation. 3) The goal is to establish a total systems approach to cyber security using cooperation rather than regulation.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 35

    Larry Clinton Operations Officer Internet Security Alliance lclinton@eia.

    org 703-907-7028 202-236-0001

    Presentation Outline
    The Growing Problem of Cyber Security Traditional Solutions and Why They Wont Work A New Paradigm (tools and incentives) Bringing it all Together

    The Past

    The Present

    Source: http://cm.bell-labs.com/who/ches/map/gallery/index.html

    The Threats The Risks


    Human Agents Hackers Disgruntled employees White collar criminals Organized crime Terrorists Exposures Information theft, loss & corruption Monetary theft & embezzlement Critical infrastructure failure Hacker adventures, e-graffiti/ defacement Business disruption Representative Incidents Code Red, Nimda, Sircam CD Universe extortion, e-Toys Hactivist campaign, Love Bug, Melissa Viruses

    Methods of Attack Brute force Denial of Service Viruses & worms Back door taps & misappropriation, Information Warfare (IW) techniques

    The Threats The Risks


    Terrorists may view cyberattacks standing alone or with a coordinated physical attack as a way to cause economic harm. Considering that critical infrastructures, upon which the American economy depend, are increasingly electronic and interconnected, attacks in or through cyberspace arguably support the terrorist modus operandi

    The Threats The Risks


    Pipeline Disruption Air Traffic Control Tower & Radar Down Bridge Down Electricity Outage ISPs Out of Service Near Wall Street

    911 Unavailable

    Threat to Water Supply Telephone Service Interrupted Submarine Cable Lost

    Train Derailment in Tunnel Phones Jammed

    Oil Refinery Explosion

    Bomb Threats at Government Buildings

    Growth in Incidents Reported to the CERT/CC


    120000
    110,000

    100000 80000
    55,100

    60000 40000

    21,756

    20000
    6 132 252 406 773 1,334 2,340 2,412 2,573 2,134 3,734 9,859

    0 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002

    The Dilemma: Growth in Number of Vulnerabilities Reported to CERT/CC


    4,500 4,000 3,500 3,000 2,500 2,000 1,500 1,000 500 171 0
    1995

    4,129

    2,437

    1,090 417 345 311 262


    2002

    Attack Sophistication v. Intruder Technical Knowledge


    stealth / advanced scanning techniques

    Tools

    High
    Intruder Knowledge

    packet spoofing sniffers sweepers

    denial of service DDOS attacks www attacks automated probes/scans GUI

    back doors disabling audits burglaries

    network mgmt. diagnostics

    Attack Sophistication

    hijacking sessions exploiting known vulnerabilities password cracking self-replicating code

    Low
    1980

    password guessing

    Attackers 1995 2000

    1985

    1990

    Computer Virus Costs (in billions)


    $

    150
    billion

    120 90 60 30 0

    Range Dam age

    '96 '97 '98 '99 '00 '01 '02 '03


    (Through Oct 7)

    Traditional Solutions & Why They Wont Work


    Technology Solutions (its like Y2K) Government Regulation (just mandate security) Great Wall of China (Secure our boarders)

    Cyber Security is not an IT Problem


    Y2K WAS: Finite Passive Not an attack Cyber Security requires people, processes, procedures and management of the risk.

    A Risk Management Approach is Needed


    Installing a network security device is not a substitute for a constant focus and keeping our defenses up to date There is no special technology that can make an enterprise completely secure.
    National Plan to Secure Cyberspace, 2/14/03

    You Cant Mandate Cyber Security


    Policy must address the Internet as a new technology No one owns the Internet It is constantly evolving International operation makes regulation difficult Mandates will truncate innovation and the economy Beware the Roadmap for mischief

    Putnam Legislation
    Risk Assessment Risk Mitigation Incident Response Program Tested Continuity plan Updated Patch management program Putnam has said it wont work.

    Build a Great Wall around your Organization


    The Internet has no walls, no boarders -- No one actually owns it. You are only as secure as the organizations you interconnect with -- And thats pretty much everyone. The Internet is Interdependent, and Security, therefore, is Interdependent

    Attacks are Inevitable


    According to the US Intelligence community, American networks will be increasingly targeted by malicious actors both for the data and the power they possess. National Strategy to Secure Cyberspace, 2/14/02

    A New paradigm:Tools and Incentives


    TOOLS INCENTIVES NOT MANDATES Information Sharing Best Practice Development Standards/Certification/Qualification Training Policy Development A Total Systems Approach

    Benefits of Information Sharing Organizations May lesson the likelihood of attack


    Organizations that share information about computer break ins are less attractive targets for malicious attackers. NYT 2003

    Participants in information sharing have the ability to better prepare for attacks and respond to them.

    Old and New Info Sharing


    2002 ISAlliance informed its membership about SNMP event 6 months ahead of time---No ISAlliance members affected 2003 ISAlliance informed Membership about Slammer Vulnerability 9 months ahead of time--NO ISA members effected 2004---Events move too fast Now we focus on forecasting not analysis

    Adopt and Implement Best Practices


    Cited in U.S. National Draft Strategy to Protect Cyber Space Endorsed by TechNet for CEO Security Initiative Small Bus. Best Pract. Endorsed:DHS;ABA; NAM;EIA; NCSA etc.

    Common Sense Guide Top Ten Practice Topics


    Practice #1: General Management Practice #2: Policy Practice #3: Risk Management Practice #4: Security Architecture & Design Practice #5: User Issues Practice #6: System & Network Management Practice #7: Authentication & Authorization Practice #8: Monitor & Audit Practice #9: Physical Security Practice #10: Continuity Planning & Disaster Recovery

    Cooperative work on assessment/certification


    TechNet CEO SelfAssessment Program Bring cyber security to the C-level based on ISA Best Practices Create a baseline of security even CEOs can understand American Security Consortium 3-Party Assessment program Risk Preparedness Index for assessment and certification Develop quantitative independent ROI for cyber security

    ISAlliance/CERT Training
    Concepts and Trends In Information Security Information Security for Technical Staff OCTAVE Method Training Workshop Overview of Managing Computer Security Incident Response Teams Fundamentals of Incident Handling Advanced Incident Handling for Technical Staff Information Survivability an Executive Perspective

    ISAlliance Incentive Model


    Model Programs for market Incentives ---AIG ----Nortel ---Visa ----Verizon SemaTech Program Tax Incentives Liability Carrots Procurement Model Research and Development

    Congress Appoints CISWG


    INCENTIVES & LIABILITY GROUP FOUND INCENTIVES FOR PUB & PRIVATE SECTOR --Insurance Incentives --Liability Incentives --Tax Incentives --Expedited Permitting --FEMA credits --Awards Programs

    Chief Technology Officers Knowledge of their Cyber Insurance


    34% Incorrectly thought they were covered 36% Did not have Insurance 23% Did not know if they had insurance 7% Knew that they were insured by a specific policy

    ISAlliance Cyber-Insurance Program


    Coverage for members Free assessment through AIG Market incentive for increased security practices 10% discount off best prices from AIG Additional 5% discount for implementing ISAlliance Best Practices (July 2002)

    ISAlliance Qualification Program


    No Standardized Certification Program exists or will exist soon ISAlliance, in cooperation with Big 4 and insurance industry, create quantitative measurement for qualification for ISA discounts as proxy for certification ISA works with CMU CyLab on Certification

    A Coherent 10 step Program of Cyber Security


    1. Members and CERT create best practices 2. Members and CERT share information 3. Cooperate with industry and government to develop new models and products consistent with best practices

    A Coherent Program of Cyber Security


    4. Provide Education and Training programs based on coherent theory and measured compliance 5. Coordinate across sectors 6. Coordinate across boarders

    A coherent program
    7. Develop the business case (ROI) for improved cyber security 8. Develop market incentives and tools for consistent maintenance of cyber security 9. Integrate sound theory and practice and evaluation into public policy 10. Constantly expand the perimeter of cyber security by adding new members

    Sponsors

    Larry Clinton Operations Officer Internet Security Alliance [email protected] 703-907-7028 202-236-0001

    You might also like