Information Security Science

Measuring the Vulnerability to Data Compromises

Carl Young

• Publisher: Syngress
• Year: 2016
• Print ISBN: 9780128096437
• eBook ISBN: 9780128096468
• Topic: Business
• Subtopic: Information Management
• Index: Business

Information Security Science: Measuring the Vulnerability to Data Compromises provides the scientific background and analytic techniques to understand and measure the risk associated with information security threats. This is not a traditional IT security book since it includes methods of information compromise that are not typically addressed in textbooks or journals. In particular, it explores the physical nature of information security risk, and in so doing exposes subtle, yet revealing, connections between information security, physical security, information technology, and information theory. This book is also a practical risk management guide, as it explains the fundamental scientific principles that are directly relevant to information security, specifies a structured methodology to evaluate a host of threats and attack vectors, identifies unique metrics that point to root causes of technology risk, and enables estimates of the effectiveness of risk mitigation. This book is the definitive reference for scientists and engineers with no background in security, and is ideal for security analysts and practitioners who lack scientific training. Importantly, it provides security professionals with the tools to prioritize information security controls and thereby develop cost-effective risk management strategies. - Specifies the analytic and scientific methods necessary to estimate the vulnerability to information loss for a spectrum of threats and attack vectors - Represents a unique treatment of the nexus between physical and information security that includes risk analyses of IT device emanations, visible information, audible information, physical information assets, and virtualized IT environments - Identifies metrics that point to the root cause of information technology risk and thereby assist security professionals in developing risk management strategies - Analyzes numerous threat scenarios and specifies countermeasures based on derived quantitative metrics - Provides chapter introductions and end-of-chapter summaries to enhance the reader's experience and facilitate an appreciation for key concepts

Part I

Threats, risk and risk assessments

Chapter 1: Information Security Threats and Risk

Chapter 2: Modeling Information Security Risk

Chapter 1

Information Security Threats and Risk

Abstract

This chapter discusses the distinction between threats and risk. In particular, the risk factor is introduced. Risk factors for various threats and attack vectors are highlighted throughout the text since they are essential to formulating an effective security risk management strategy. Probability distributions are introduced in a detailed discussion of the likelihood component of risk.

Keywords

threat

risk

risk assessment

risk factors

likelihood

vulnerability

impact

probability distributions

Introduction

Information Security Risk

This book is about estimating the vulnerability to unauthorized access to information by individuals with malicious intent. Attack scenarios range from simple visual observations of white boards or computer monitors and conversation overhears to sophisticated compromises of radiating electromagnetic signals. Many of these scenarios can be modeled using well-established physical principles that provide insights into the magnitude of the vulnerability to information security threats.

Such estimates may appear straightforward, but there are many scenarios of concern and the spectrum of vulnerabilities is broad. This is evident from the following examples:

• electromagnetic signals leaking from a computer located in a country known to sponsor information security attacks against foreign companies;

• a wireless network in the vicinity of a drive-by hacker with one of the network access points promiscuously radiating signal energy to the street;

• sensitive conversations that can be overheard by occupants of another floor in a multitenant office building;

• white boards, keyboards, and computer monitor screens in the direct line-of-sight of distant buildings;

• employees informally conversing on a company balcony while surrounded by properties of unknown control/ownership;

• information technology (IT) networks and systems that communicate via the Internet.

Traditional texts on information security and indeed most organizations often focus on the last bullet. In fact, entire departments are routinely dedicated to network security. It is no secret that the exploitation of IT vulnerabilities has increased in recent years, and the criticality of IT infrastructure demands a disproportionate share of attention. As a consequence, other attack vectors have been ignored despite the fact that they may be simpler to execute and could have equally significant impact.

The historical evidence suggests that IT risk deserve special attention. But despite that attention, traditional security risk management strategies have arguably been less than effective. Notably, these strategies include numerous and varied security controls. In fact, there is often an abundance of IT security data derived from these controls. But it is not clear such data are yielding insights into risk on a strategic level.

Indeed, IT risk managers are sometimes overwhelmed with data that are intended to identify the risk of information loss. But such data are traditionally used in support of tactical remediation efforts. Problems often recur because such remedies are inherently narrow in scope. Sometimes this abundance of data actually blinds organizations to the most significant risk factors for information compromise, which include business practices, security governance, physical security of information assets, and user behavior in addition to poor or inappropriate IT implementation.

One phenomenon that contributes to the ineffectiveness of current security strategies is the difficulty in quantifying IT risk. Why is this so difficult? The reasons are threefold:

• IT security incidents typically result from the confluence of related issues. The contributions of each issue can vary and it can be difficult to assess their relative magnitudes.

• Robust statistics on actual IT incidents are either nonexistent or not particularly helpful in assessing risk.

• Controlled experiments to determine the effectiveness of risk mitigation in IT environments are difficult to conduct.

The result is an absence of useful models pertaining to IT risk. So it is not easy to rigorously confirm the effectiveness of a particular security strategy.

The problem is exacerbated by the fact that IT protocols and systems have antagonistic objectives: ensuring data security and facilitating communication. To be sure, facilitating communication invites risk. In fact, the very existence of a network is a risk factor for information compromise. Despite continued efforts to ensure data security, these technologies spawn new vulnerabilities each day. The popularity of the Internet in conjunction with well-advertised attacks on systems drives the nearly singular focus on technology as both the culprit and the cure for information security ills.

Information security risk scenarios can admittedly be complex with interrelated elements. In many cases this complexity precludes the formulation of reliable risk models. Finally, the diversity of attackers and their respective motives makes precise statements on the likelihood of a future incident difficult if not impossible.

Information Security in a Routine Business Scenario

The following example illustrates the variety of information security issues that are relevant to even routine business scenarios. Consider an everyday meeting between individuals in a conference room. This event is likely repeated thousands of times each day around the world. Meeting attendees use the gifts provided by Mother Nature to generate, detect, and process acoustic energy in the form of speech.

What is the level of assurance that the acoustic energy will be confined to that conference room and not be overheard by individuals in other parts of the building? For example, acoustic energy propagating within the conference room might couple to building structural elements and be heard by individuals in an adjoining room or even another floor.

Moreover, if the conf...

Table of contents

• Cover
• Title page
• Table of Contents
• Copyright
• Dedication
• Biography
• Foreword
• Preface
• Acknowledgments
• Part I: Threats, risk and risk assessments
• Part II: Scientific fundamentals
• Part III: The compromise of signals
• Part IV: Information technology risk
• Part V: The physical security of information assets
• Epilogue
• Appendix A: The Divergence and Curl Operators
• Appendix B: Common Units of Electricity and Magnetism
• Appendix C: Capacitive and Inductive Coupling in Circuits
• Appendix D: Intermediate Frequency (IF) Filtering of Signals
• Appendix E: An Indicative Table of Contents for an Information Security Policy
• Index