Ira Somerson Dec 0704

Institute for Global Management Studies And Temple CIBER Global Security Concerns October 2 & 3, 2003 The Philadelphia Federal Reserve IDENTIFYING THREATS IN A GLOBAL MARKETPLACE Ira S. Somerson, BCFE, CPP Loss Management Consultants, Inc.

“The regulatory, ethical, and legal framework that provide protections to us and individuals and to our business activities at home do not apply abroad.”

Overseas Security Advisory Council LMC™

THREATS BY REGION 2003 to Date Western Europe Latin America Far East/Pacific Is.

28% 22% 14%

Mid East/No Africa

11%

Eastern Europe South/Central Asia

9% 9%

Sub Saharan Africa

7%

Overseas Security Advisory Council - 2003

LMC™

THREATS BY INDUSTRY: 2003 to Date Fast Food Religious Soft Drink Oil Retail Financial Hotel Airline Other Overseas Security Advisory Council - 2003

35% 17% 10% 9% 9% 8% 4% 4% 4% LMC™

THREATS TO BE CONSIDERED IN AN INTERNATIONAL ENVIRONMENT TERRORISM  PERSONAL SECURITY  PERSONNEL SECURITY  PHYSICAL SECURITY OF FACILITY  INFORMATION AND DATA SECURITY  COMMUNICATIONS SECURITY  INFRASTRUCTURE SECURITY 

Overseas Security Advisory Council - 2003

LMC™

THREATS TO BE CONSIDERED IN AN INTERNATIONAL ENVIRONMENT  DISGRUNTLED

INSIDERS  CIVIL UNREST AND/OR CULTURAL CONFLICTS  CRIMINAL THREATS  ECONOMIC COMPETITION  ACTS OF INTELLIGENCE SERVICES  ACTS OF WAR Overseas Security Advisory Council - 2003

LMC™

LESSONS FROM RECENT CYBER ATTACK CASE STUDIES CYBER ATTACKS IMMEDIATELY ACCOMPANY PHYSICAL ATTACKS  CYBER ATTACKS ARE INCREASING IN VOLUME, SOPHISTICATION, AND COORDINATION  CYBER ATTACKERS ARE ATTRACTED TO HIGH VALUE TARGETS 

I

INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01

LMC™

POTENTIAL SOURCES OF CYBER ATTACKES TERRORIST GROUPS  TERRORIST SYMPATHIZERS AND ANTIU.S. HACKERS  TARGETED NATION-STATES  THRILL SEEKERS 

INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01

LMC™

CYBER ATTACKERS HAVE RECENTLY: DEFACED ELECTRONIC INFORMATION SITES IN THE UNITED STATES AND ALLIED COUNTRIES AND SPREAD DISINFORMATION AND PROPAGANDA.

INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™

CYBER ATTACKERS HAVE RECENTLY: DENIED SERVICE TO LEGITIMATE COMPUTER USERS IN THE U.S. AND ABROAD BY USE OF:  WORMS  VIRUSES  OTHER COMPUTER WEAKNESSES INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™

CYBER ATTACKERS HAVE RECENTLY: COMMITTED UNAUTHORIZED INTRUSIONS INTO SYSTEMS AND NETWORKS BELONGING TO THE UNITED STATES AND ALLIED COUNTRIES, RESULTING IN CRITICAL INFRASTRUCCTURE OUTAGES AND CORRUPTION OF VITAL DATA. INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01

LMC™

ONLINE RESOURCES      

www.cert.org (The Carnegie Mellon Computer Emergency Response Team) www.fedcirc.gov (The Federal Computer Incident Response Center) www.incidents.org (community and business collaboration of victimization) www.ists.dartmouth.edu (The Institute for Security Technology Studies at Dartmouth) www.nipe.gov (The National Infrastructure Protection Center) www.sans.org (The System Administration, Networking and Security) LMC™

RISK, THREAT & VULNERABILITY CONSIDERATIONS  THREAT

= INTENT + CAPABILITY  CAPABILITY = TOOLS + KNOWLEDGE  RISK = THREAT + COUNTERMEASURES  HOW OFTEN WILL THE RISK OCCUR? Overseas Security Advisory Council - 2003

LMC™

SECURITY RISK COSTS LEGAL & DAMAGE CONTROL EXPECTED REVENUE LOSS SHAREHOLDER VALUE REPUTATION (GOOD WILL) LOSS OF PRODUCTIVITY MARKET SHARE & TIMING RELATIONSHIPS WITH CONTRACTORS LMC™

FINANCIAL IMPACT OF SECURITY LOSSES IMPACT TO OTHER PRODUCT DESIGN EMPLOYEE MORALE COST TO SERCURE (AFTER THE FACT) RESEARCH & DEVELOPMENT SPECIAL EQUIPMENT CAPITALIZED STAFF RECRUITING & TRAINING OVERHEAD COSTS DEBT SERVICE LMC™

NET PRESENT VALUE COST OF PROGRAM PREDICTABILITY OF LOSS

COMPUTATION OF INFORMATION LOSS NET PRESENT LOSS OR NET PRESENT GAIN

LMC™

EXAMPLE COST OF ONE INFORMATION LOSS

$1,000,000.00

COST DIVIDED BY POTENTIAL FOR LOSS TO OCCUR OVER A TEN-YEAR PERIOD. IF ONLY ONCE, DIVIDE BY 10=COST/YR

100,000.00

LESS COST OF PROGRAM/YR

75,000.00

NET PRESENT VALUE -------------------- $

25,000.00 LMC™

SECURITY OBJECTIVES     

DETER DETECT DELAY RESPOND RECOVER LMC™

THE MISSION OF NTERNATIONAL SECURITY MANAGEMENT S E C U R I T Y

A T T I T U D E

C H A N C E

R I S K LMC™

THE MISSION OF NTERNATIONAL SECURITY MANAGEMENT

SECURTY OF:    

PEOPLE INFORMATION PROPERTY REPUTATION

S E C U R I T Y

CHANCE ATTITUDE

LMC™

R I S K

RISK ASSESSMENT THE ART AND SCIENCE OF MEASURING THE FORESEEABILITY OF EVENTS AFFECTING THE SAFETY AND SECURITY OF ASSETS LMC™

EXAMPLES OF WHAT A RISK ASSESSMENT SHOULD CONSIDER INTELLIGENCE GATHERING  OPERATIONAL ASPECTS OF THE ASSET/FACILITY  NATURE OF NEIGHBORING FACILITIES (OR TENANTS)  ACCESS ROADS TO FACILITY 

LMC™

EXAMPLES OF WHAT A RISK ASSESSMENT SHOULD CONSIDER ORGANIZATION’S INCIDENT HISTORY AND ABILITY TO ANALYZE THE DATA  FACILITY MANAGEMENT EFFICIENCY  EFFICIENCY OF EXISTING SECURITY STRATEGY 

LMC™

HOW DO WE DETER, DETECT, DENY, RESPOND TO AND/OR RECOVER FROM ATTACKS?  TECHNOLOGY

MANAGEMENT  PROCEDURAL MANAGEMENT  SECURITY AWARENESS  INTELLIGENCE GATHERING AND ANALYSIS  LAW ENFORCEMENT MANAGEMENT LMC™

STANDARD SECURITY INDUSTRY PRACTICES SECURITY PROJECTS PUBLISH SECURITY GUIDELINES  PREPARE SUPPORT MATERIALS  EMPLOYEE & CONTRACTOR(NEW & EXISTING) ORIENTATION  SECURITY AWARENESS TRAINING 

LMC™

THE MISSING LINK PAY ATTENTION TO GOVERNMENT ALERT LEVELS.  CARE ENOUGH TO REPORT SOMETHING THAT DOESN’T LOOK RIGHT TO YOU!  BE AWARE BUT NOT PARANOID 

LMC™

WHAT YOU CAN DO? BECOME PART OF THE SOLUTION VS. BEING PART OF THE PROBLEM LMC™