Schneier on security illusion
Leave a reply
Wherefore art thou, cybersecurity insurance?
Uncertain coverage
Developing a market for cybersecurity insurance is more difficult than it may seem. With a rise in business losses stemming from malicious activities and adverse events in the cyber world, creating a market for cybersecurity insurance where losses could be mitigated would seem to be a no brainer. However, developing, maturing, and establishing trust in a cybersecurity insurance market is slow in coming.
What it’s supposed to do
Ostensibly, implementation of a mature cybersecurity insurance market can provide protection and mitigation for such events as:
- data breach
- network damage
- cyber extortion
- brand damage
- financial loss
- other
The Department of Homeland Security quotes the Department of Commerce in describing cybersecurity insurance as an “effective, market-driven way of increasing cybersecurity.” The idea is that cybersecurity provides mitigation to damages suffered from a cyber event and also enhances cybersecurity in general by motivating better information risk management and security via premium discounts for good practices.
Implementation and chicken and egg challenges
Despite the seemingly obvious benefits, cybersecurity insurance has yet to undergo wholesale adoption. DHS and the May 2013 Cyber Risk Culture Roundtable Readout Report hosted by the National Protection & Programs Directorate (NPPD) offer some reasons for lack of adoption to date:
- Cost — An added cost that companies must deal with plus the perception of cybersecurity insurance as a luxury item
- Uncertainty — potential customers wonder whether carriers will actually payout on cyber event claims. There is little current precedent for such claims and payouts, hence the chicken and egg problem
- High risk appetites — Particularly in technology fields where there is a lot of entrepreneurship, the tolerance for risk is high
- Market/services maturity — Awareness and incentives structures within the cybersecurity insurance industry are not ubiquitous
- Lack of clarity/precedence/data on likelihood of an adverse cyber event
- Confusion/misunderstanding on exactly what is covered with cybersecurity insurance
At the cybersecurity framework hearing held by the Senate Commerce, Science, and Transportation Committee on July 25, 2013, Patrick Gallagher, Director of U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) also suggested that the cybersecurity insurance market was not yet sufficiently mature to handle large-scale, catastrophic cyber events. Dr. Gallagher stated that there was not yet a robust actuarial and monetized basis for such large-scale coverage.
Further, at the same hearing, CEO of RSA, Art Coviello suggested that developing an actuarial basis for adverse cyber events was particularly difficult because the computing environment is changing so rapidly and because of the vast amount of data being generated that needs some form of analysis in order to determine appropriate coverage.
As much as I want to encourage and contribute to the rapid development of a mature cybersecurity insurance market, I too have concerns about how policies are written, how cyber events are described, and how much work is required to get an actual payout on a claim. To get consumer buy-in in the short term, insurance providers might have to ‘go long’ with claims and payouts to establish trust and confidence amongst consumers.
Would you purchase cybersecurity insurance? What sorts of events would you like protection from? Data breach? Data loss or theft? What changes/implementations would make purchasing cybersecurity insurance more appealing to you?
[image: commons.wikimedia.org/wiki/File%3AForgotten_umbrella.jpg]
Force Protection & SMB Information Risk Management
The term “force protection” entered the American military vernacular in the late 70’s and 80’s in response to several events. One of the key drivers, though not the only driver, was the activities of the Red Army Faction or “Baader Meinhof Group”. This group was responsible for several bombings, assassinations, & kidnappings over three decades. As US bases and US military personnel were frequently the targets of these attacks (as well as attacks from other groups), the need to develop specific plans to protect ‘the rear’ began to be articulated. In effect, ‘the rear’ was no longer the rear.
Military organizations have always been aware of the concept of ‘protecting the rear’ or ‘covering your flank.’ However, the asymmetric, unpredictable aspects of these attacks put the military in the position of having to explicitly define a process for protection of assets that were not traditionally in harm’s way. Further, by naming and mandating the process, it was clear that some percentage of resources originally intended for forward operations would need to be diverted to support force protection. This was a shift in thinking.
I believe a similar thing could be occurring with managing information risk and security in small to medium-sized businesses (SMB’s). Relatively suddenly, these businesses are finding themselves in hostile territory and if they want to stay in business, then they must dedicate some operational resources — whether marketing, production, R&D, revenue, etc — to support these protective and risk-lowering activities.
Early Marine Corps doctrine on force protection
I found a Marine Corps publication, “AntiTerrorism/Force Protection Campaign Plan” from 1998 that presents some operational concepts that could be helpful analogies to the issue of information risk and security for SMB’s.
The publication provides some definition of force protection:
In its purest sense, force protection is an overarching concept. It includes those procedural, training, equipment and leadership principles necessary to ensure … safety and well-being … In essence, force protection is an inherent function of [leadership] and as such should be an integral part of the way we do business on a daily basis.
Similarity in threat analysis
It goes on to describe analysis of the threat as considering a stool with three legs — Does the enemy have
- motivation
- means
- opportunity
We can apply similar analysis to SMB information risk.
- Does ‘the enemy’ (criminals or nation-state actors) have motivation to attack or compromise an SMB’s information assets? Yes, certainly. A successful attack provides, 1) potential revenue, 2) an attack point for attacks on other, possibly larger, more lucrative businesses
- Do they have the means? Yes. They have readily available computers, pre-built networks for attacks, often anonymity, and sometimes protection from their parent state (country)
- Do they have the opportunity? Yes. There are many poorly protected and non-resilient SMB computer networks available for attack.
| Marine Corps operational doctrine on force protection (from 1998) | Potential analogies in SMB information risk management |
| “Force protection is an operational aspect of every mission …” | For example, resources are shifted away from marketing, R&D, production, etc to support SMB’s information infrastructure |
| Work to “eliminate the belief [by the enemy] that opportunity [for attack] exists” | Employ basic measures such as anti-virus, firewalls, managed/standardized computers, and awareness education to create an unappealing risk/value proposition for potential attackers |
| “The value of alarms and drills…[Leaders] at every level should develop recognizable alarms for potential emergencies and critical incidents.” | Rehearse disaster recovery and business continuity plans. Practice activities such as data recovery tests. |
The US military found itself in a position of having to develop and evolve a practice to address a fairly sudden new threat that was also evolving, as well as unconventional, and unpredictable. Similarly, to remain relevant and to maximize their respective opportunities for success, I believe that SMB’s need to, in some manner, introduce information risk and security management into their daily activities as well.
Do you think there is currently motivation, means, and opportunity to attack your business?
You want fries with that?
— Cybercriminals are starting to provide kits, aka “kitz”, of prepackaged, ready-to-go, vetted, and integrated personal data in convenient prepackaged documents.
— This creates a value-add to stolen data by correlating, combining, cleaning, providing quality control services of personal information, and implementing this in a single authoritative document, aka “fullz”
— This allows criminals to deliver a “turnkey identity fraud service” per eWeek.
— “fullz” on a person might include verified health information, social security numbers, financial account information to include bank login credentials, and driver’s license data.
— Currently, a full dossier on a person sells for approximately $500. This price will surely decrease as competition increases and operations become more automated and efficient.
SMB Point of Sale Vulnerabilities
(via merchantwarehouse.com)
Creating attacks by daisy-chaining trusted cloud services such as Dropbox
Cloud services and social media services are often touted as a way for Small to Medium-sized Businesses (SMB’s) to manage their IT needs, information risk, and information security needs. While there is real potential for SMB’s in this space, it is not without risk. As an example, CyberSquared has documented increasing use of attackers using trusted cloud services such as Dropbox & WordPress to manage aspects of an attack.
Sophisticated, Chained Multi-component Attacks
A recent attack had these sophisticated components:
- A Word document with embedded malicious content that would attempt to activate upon opening.
- The content of the Word document was relevant to the recipients of the attack. In this case it appears to be a policy document for the Association of Southeast Asian Nations (ASEAN). That is, it’s a document that targeted recipients would likely be interested in opening.
- There was also evidence that the Word document was a product/artifact of an earlier attack. That is, data/documents/information collected/stolen from earlier attacks are used as components and tools for future attacks.
- The document was put in a Dropbox account created quickly and at no charge by the attacker.
- The attacker then emailed the Dropbox account info to the targeted recipients.
(via cybersquared.com)
- Now for some extra sneakiness — note that the file says that it’s a zipped (compressed file) with the .zip extension. Upon opening, researchers saw that it used a fake Adobe pdf icon to cover up the fact that it was actually a Word document (that had the malicious code).
- Once a user received this Dropbox link and opened the compressed-faux-pdf-actual-malicious-Word-doc file, the next phase would start. From here the malicious code would then contact a WordPress site to get Command & Control information so that it could get specific instructions to further its attack.
- Note IP address and port information embedded in an otherwise seemingly innocuous post.
(via cybersquared.com)
Advantages of a Trusted Public Service to Attackers
- Attackers can hide behind a trusted brand name such as Dropbox, WordPress, or Twitter
- Ease of attacker anonymity stems from ease of account set up
- Attackers able to use cloud service infrastructure to target victims, eg using Dropbox email component to reach out
- Malicious content easily bypasses old school detection mechanisms
This is some pretty sneaky stuff embedded into some trusted services that often market directly to SMB’s. I’m not saying don’t use them — they do offer huge convenience and direct cost savings. However, it is critical to recognize that they don’t offer a slam-dunk solution for security. Indeed, no solution offers this. Like everything else, reflection on risk needs to occur to ensure an SMB has the best chance for good decisions.
University of Washington adds new certificate for IT Audit
University of Washington Professional & Continuing Education adds IT Audit Certificate program.
Demand for IT Audit skills and services are rapidly growing because of:
- increasing regulatory requirements
- increasing interconnectivity between businesses & the need to establish transparency & evidence of compliance between parties (eg, Amazon’s partner program)
- rising demand for information risk management, regardless of business size, and audit’s growing role as a baseline in risk programs
UW’s IT Audit Certificate program provides training, recognition of accomplishment, and a professional network for IT/Information Management professionals as well as finance and administration professionals seeking to expand their skill sets in IT audit.
More here.
Great site on understanding/communicating uncertainty & risk
California Data Breach Report 2012
#’s from http://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/2012data_breach_rpt.pdf. (Created with infogr.am)
Industrial Control System Attackers & Attackees
ICS attacks by business sector
(image ICS-CERT)
— ICS-CERT responds to over 200 Industrial Control System (ICS) incidents between October 2012 and May 2013.
— Highest percentage in energy sector — 53%
— Critical Manufacturing sector follows — 17%
ICS attacks by source country
(image TrendMicro)
— TrendMicro research emulates Industrial Control System with honeypots
— Only takes 18 hours for first honey pot to be attacked
— Over 28 days, 39 attacks from 14 countries
— Of 39 attacks, 12 were unique and considered ‘targeted’
— Attackers demonstrated experience & expertise with ModBus industrial control protocol