Institute for Global Management Studies And Temple CIBER Global Security Concerns October 2 & 3, 2003 The Philadelphia Federal Reserve IDENTIFYING THREATS IN A GLOBAL MARKETPLACE Ira S. Somerson, BCFE, CPP Loss Management Consultants, Inc.
“The regulatory, ethical, and legal framework that provide protections to us and individuals and to our business activities at home do not apply abroad.” Overseas Security Advisory Council LMC™
THREATS BY REGION 2003 to Date Western Europe Latin America Far East/Pacific Is.
28% 22% 14%
Mid East/No Africa
11%
Eastern Europe South/Central Asia
9% 9%
Sub Saharan Africa
7%
Overseas Security Advisory Council - 2003
LMC™
THREATS BY INDUSTRY: 2003 to Date Fast Food Religious Soft Drink Oil Retail Financial Hotel Airline Other Overseas Security Advisory Council - 2003
35% 17% 10% 9% 9% 8% 4% 4% 4% LMC™
THREATS TO BE CONSIDERED IN AN INTERNATIONAL ENVIRONMENT TERRORISM PERSONAL SECURITY PERSONNEL SECURITY PHYSICAL SECURITY OF FACILITY INFORMATION AND DATA SECURITY COMMUNICATIONS SECURITY INFRASTRUCTURE SECURITY
Overseas Security Advisory Council - 2003
LMC™
THREATS TO BE CONSIDERED IN AN INTERNATIONAL ENVIRONMENT DISGRUNTLED
INSIDERS CIVIL UNREST AND/OR CULTURAL CONFLICTS CRIMINAL THREATS ECONOMIC COMPETITION ACTS OF INTELLIGENCE SERVICES ACTS OF WAR Overseas Security Advisory Council - 2003
LMC™
LESSONS FROM RECENT CYBER ATTACK CASE STUDIES CYBER ATTACKS IMMEDIATELY ACCOMPANY PHYSICAL ATTACKS CYBER ATTACKS ARE INCREASING IN VOLUME, SOPHISTICATION, AND COORDINATION CYBER ATTACKERS ARE ATTRACTED TO HIGH VALUE TARGETS
I
INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01
LMC™
POTENTIAL SOURCES OF CYBER ATTACKES TERRORIST GROUPS TERRORIST SYMPATHIZERS AND ANTIU.S. HACKERS TARGETED NATION-STATES THRILL SEEKERS
INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01
LMC™
CYBER ATTACKERS HAVE RECENTLY: DEFACED ELECTRONIC INFORMATION SITES IN THE UNITED STATES AND ALLIED COUNTRIES AND SPREAD DISINFORMATION AND PROPAGANDA.
INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™
CYBER ATTACKERS HAVE RECENTLY: DENIED SERVICE TO LEGITIMATE COMPUTER USERS IN THE U.S. AND ABROAD BY USE OF: WORMS VIRUSES OTHER COMPUTER WEAKNESSES INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™
CYBER ATTACKERS HAVE RECENTLY: COMMITTED UNAUTHORIZED INTRUSIONS INTO SYSTEMS AND NETWORKS BELONGING TO THE UNITED STATES AND ALLIED COUNTRIES, RESULTING IN CRITICAL INFRASTRUCCTURE OUTAGES AND CORRUPTION OF VITAL DATA. INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01
LMC™
ONLINE RESOURCES
www.cert.org (The Carnegie Mellon Computer Emergency Response Team) www.fedcirc.gov (The Federal Computer Incident Response Center) www.incidents.org (community and business collaboration of victimization) www.ists.dartmouth.edu (The Institute for Security Technology Studies at Dartmouth) www.nipe.gov (The National Infrastructure Protection Center) www.sans.org (The System Administration, Networking and Security) LMC™
RISK, THREAT & VULNERABILITY CONSIDERATIONS THREAT
= INTENT + CAPABILITY CAPABILITY = TOOLS + KNOWLEDGE RISK = THREAT + COUNTERMEASURES HOW OFTEN WILL THE RISK OCCUR? Overseas Security Advisory Council - 2003
LMC™
SECURITY RISK COSTS LEGAL & DAMAGE CONTROL EXPECTED REVENUE LOSS SHAREHOLDER VALUE REPUTATION (GOOD WILL) LOSS OF PRODUCTIVITY MARKET SHARE & TIMING RELATIONSHIPS WITH CONTRACTORS LMC™
FINANCIAL IMPACT OF SECURITY LOSSES IMPACT TO OTHER PRODUCT DESIGN EMPLOYEE MORALE COST TO SERCURE (AFTER THE FACT) RESEARCH & DEVELOPMENT SPECIAL EQUIPMENT CAPITALIZED STAFF RECRUITING & TRAINING OVERHEAD COSTS DEBT SERVICE LMC™
NET PRESENT VALUE COST OF PROGRAM PREDICTABILITY OF LOSS
COMPUTATION OF INFORMATION LOSS NET PRESENT LOSS OR NET PRESENT GAIN
LMC™
EXAMPLE COST OF ONE INFORMATION LOSS
$1,000,000.00
COST DIVIDED BY POTENTIAL FOR LOSS TO OCCUR OVER A TEN-YEAR PERIOD. IF ONLY ONCE, DIVIDE BY 10=COST/YR
100,000.00
LESS COST OF PROGRAM/YR
75,000.00
NET PRESENT VALUE -------------------- $
25,000.00 LMC™
SECURITY OBJECTIVES
DETER DETECT DELAY RESPOND RECOVER LMC™
THE MISSION OF NTERNATIONAL SECURITY MANAGEMENT S E C U R I T Y
A T T I T U D E
C H A N C E
R I S K LMC™
THE MISSION OF NTERNATIONAL SECURITY MANAGEMENT
SECURTY OF:
PEOPLE INFORMATION PROPERTY REPUTATION
S E C U R I T Y
CHANCE ATTITUDE
LMC™
R I S K
RISK ASSESSMENT THE ART AND SCIENCE OF MEASURING THE FORESEEABILITY OF EVENTS AFFECTING THE SAFETY AND SECURITY OF ASSETS LMC™
EXAMPLES OF WHAT A RISK ASSESSMENT SHOULD CONSIDER INTELLIGENCE GATHERING OPERATIONAL ASPECTS OF THE ASSET/FACILITY NATURE OF NEIGHBORING FACILITIES (OR TENANTS) ACCESS ROADS TO FACILITY
LMC™
EXAMPLES OF WHAT A RISK ASSESSMENT SHOULD CONSIDER ORGANIZATION’S INCIDENT HISTORY AND ABILITY TO ANALYZE THE DATA FACILITY MANAGEMENT EFFICIENCY EFFICIENCY OF EXISTING SECURITY STRATEGY
LMC™
HOW DO WE DETER, DETECT, DENY, RESPOND TO AND/OR RECOVER FROM ATTACKS? TECHNOLOGY
MANAGEMENT PROCEDURAL MANAGEMENT SECURITY AWARENESS INTELLIGENCE GATHERING AND ANALYSIS LAW ENFORCEMENT MANAGEMENT LMC™
STANDARD SECURITY INDUSTRY PRACTICES SECURITY PROJECTS PUBLISH SECURITY GUIDELINES PREPARE SUPPORT MATERIALS EMPLOYEE & CONTRACTOR(NEW & EXISTING) ORIENTATION SECURITY AWARENESS TRAINING
LMC™
THE MISSING LINK PAY ATTENTION TO GOVERNMENT ALERT LEVELS. CARE ENOUGH TO REPORT SOMETHING THAT DOESN’T LOOK RIGHT TO YOU! BE AWARE BUT NOT PARANOID
LMC™
WHAT YOU CAN DO? BECOME PART OF THE SOLUTION VS. BEING PART OF THE PROBLEM LMC™