Threats, Threat Agents, and Vulnerabilities COMM037 Computer - - PowerPoint PPT Presentation

Threats, Threat Agents, and Vulnerabilities

COMM037 Computer Security Dr Hans Georg Schaathun

University of Surrey

Autumn 2010 – Week 5

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 1 / 46

Session objectives

Recognise the differences between common threat sources Be able to account for a wide range of threats in a risk analysis Raggad, Chapter 3 ISO 27005:2008

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 2 / 46

Threat Identification

Outline

1

Threat Identification Threat Classification Threat Paths Approach

2

Threat Sources

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 3 / 46

Threat Identification Threat Classification

Outline

1

Threat Identification Threat Classification Threat Paths Approach

2

Threat Sources

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 4 / 46

Threat Identification Threat Classification

Threat Identification

ISO 27005:2008

Input Information on threats from incident reviews, asset

• wners, users, etc.

Output A list of threats with identification of type and source. Action Identify threats and their sources.

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 5 / 46

Threat Identification Threat Classification

Information on threats

Threat description Threat Source Threat Type Effect of Threat to Asset (consequential threats) Impact and Consequences

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 6 / 46

Threat Identification Threat Classification

Classes of Threats

Threats Natural Manmade Accidental Human Error Software Fault Hardware Fault Intentional Outsider Insider

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 7 / 46

Threat Identification Threat Paths

Outline

1

Threat Identification Threat Classification Threat Paths Approach

2

Threat Sources

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 8 / 46

Threat Identification Threat Paths

Threat Paths

Example of Consquential Threats

Root Threat Thunderstorm Secondary Threat Fire Third-Order Threat Power outage Fourth-Order Threat Web server failure At what stage of the path do you put your controls?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 9 / 46

Threat Identification Threat Paths

Threat Paths

Example of Consquential Threats

Root Threat Thunderstorm Secondary Threat Fire Third-Order Threat Power outage Fourth-Order Threat Web server failure At what stage of the path do you put your controls?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 9 / 46

Threat Identification Threat Paths

Threat Paths

Example of Consquential Threats

Root Threat Thunderstorm Secondary Threat Fire Third-Order Threat Power outage Fourth-Order Threat Web server failure At what stage of the path do you put your controls?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 9 / 46

Threat Identification Threat Paths

Threat Paths

Example of Consquential Threats

Root Threat Thunderstorm Secondary Threat Fire Third-Order Threat Power outage Fourth-Order Threat Web server failure At what stage of the path do you put your controls?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 9 / 46

Threat Identification Threat Paths

Threat Paths

Example of Consquential Threats

Root Threat Thunderstorm Secondary Threat Fire Third-Order Threat Power outage Fourth-Order Threat Web server failure At what stage of the path do you put your controls?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 9 / 46

Threat Identification Threat Paths

Responsive Controls

Thunderstorm lightning diverter Fire fire alarm, fire hoses, fire extinguishers Power outage UPS Web server failure off-site backup server, 24/7 maintenance crew

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 10 / 46

Threat Identification Threat Paths

Preventive Controls

Prevent web server failure Understanding of cause is essential Controlling the cause threat

prevents the higher-order threat

Either UPS (responsive) or upgraded power supply (preventive)

controling the power outage threat will prevent web server failure (some of the time)

Understanding threat paths is useful when planning preventive controls.

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 11 / 46

Threat Identification Threat Paths

Preventive Controls

Prevent web server failure Understanding of cause is essential Controlling the cause threat

prevents the higher-order threat

Either UPS (responsive) or upgraded power supply (preventive)

controling the power outage threat will prevent web server failure (some of the time)

Understanding threat paths is useful when planning preventive controls.

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 11 / 46

Threat Identification Threat Paths

Preventive Controls

Prevent web server failure Understanding of cause is essential Controlling the cause threat

prevents the higher-order threat

Either UPS (responsive) or upgraded power supply (preventive)

controling the power outage threat will prevent web server failure (some of the time)

Understanding threat paths is useful when planning preventive controls.

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 11 / 46

Threat Identification Threat Paths

Preventive Controls

Prevent web server failure Understanding of cause is essential Controlling the cause threat

prevents the higher-order threat

Either UPS (responsive) or upgraded power supply (preventive)

controling the power outage threat will prevent web server failure (some of the time)

Understanding threat paths is useful when planning preventive controls.

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 11 / 46

Threat Identification Threat Paths

Preventive Controls

Prevent web server failure Understanding of cause is essential Controlling the cause threat

prevents the higher-order threat

Either UPS (responsive) or upgraded power supply (preventive)

controling the power outage threat will prevent web server failure (some of the time)

Understanding threat paths is useful when planning preventive controls.

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 11 / 46

Threat Identification Threat Paths

Threat Paths and Impacts

Examples

Port Scanning Attacks (root threat)

fascilitates break-in attacks (secondary threat)

Credit Card Numbers compromised (confidentiality) root threat

fascilitates Impersonation Attacks (Integrity) secondary threat

Virus (Integrity) root threat

fascilitiates other attacks (any type) secondary threat

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 12 / 46

Threat Identification Threat Paths

Threat Paths and Impacts

Examples

Port Scanning Attacks (root threat)

fascilitates break-in attacks (secondary threat)

Credit Card Numbers compromised (confidentiality) root threat

fascilitates Impersonation Attacks (Integrity) secondary threat

Virus (Integrity) root threat

fascilitiates other attacks (any type) secondary threat

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 12 / 46

Threat Identification Threat Paths

Threat Paths and Impacts

Examples

Port Scanning Attacks (root threat)

fascilitates break-in attacks (secondary threat)

Credit Card Numbers compromised (confidentiality) root threat

fascilitates Impersonation Attacks (Integrity) secondary threat

Virus (Integrity) root threat

fascilitiates other attacks (any type) secondary threat

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 12 / 46

Threat Identification Approach

Outline

1

Threat Identification Threat Classification Threat Paths Approach

2

Threat Sources

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 13 / 46

Threat Identification Approach

Brain Storm from all Directions

Use different approaches and thought processes to cover as many threats as possible. Who are your enemies?

what do they want to do? what can they do? (penetration testing)

What has happened in the past?

to yourself to others

What is your great fears?

how could it come about?

What could happen?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 14 / 46

Threat Identification Approach

Brain Storm from all Directions

Use different approaches and thought processes to cover as many threats as possible. Who are your enemies?

what do they want to do? what can they do? (penetration testing)

What has happened in the past?

to yourself to others

What is your great fears?

how could it come about?

What could happen?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 14 / 46

Threat Identification Approach

Brain Storm from all Directions

Use different approaches and thought processes to cover as many threats as possible. Who are your enemies?

what do they want to do? what can they do? (penetration testing)

What has happened in the past?

to yourself to others

What is your great fears?

how could it come about?

What could happen?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 14 / 46

Threat Identification Approach

Brain Storm from all Directions

Use different approaches and thought processes to cover as many threats as possible. Who are your enemies?

what do they want to do? what can they do? (penetration testing)

What has happened in the past?

to yourself to others

What is your great fears?

how could it come about?

What could happen?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 14 / 46

Threat Identification Approach

Brain Storm from all Directions

Use different approaches and thought processes to cover as many threats as possible. Who are your enemies?

what do they want to do? what can they do? (penetration testing)

What has happened in the past?

to yourself to others

What is your great fears?

how could it come about?

What could happen?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 14 / 46

Threat Identification Approach

Brain Storm from all Directions

Use different approaches and thought processes to cover as many threats as possible. Who are your enemies?

what do they want to do? what can they do? (penetration testing)

What has happened in the past?

to yourself to others

What is your great fears?

how could it come about?

What could happen?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 14 / 46

Threat Identification Approach

Qualitative and Quantitative Approaches

Quantitiative approaches (e.g. FAIR)

measure and quantify issues prioritise mathematically

Detail required to measure Qualititative approaches (e.g. ISO 27005)

identify all problems no accurate assessment of severity

If you start the quantitative approaches to early

many threats will slip through

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 15 / 46

Threat Identification Approach

Qualitative and Quantitative Approaches

Quantitiative approaches (e.g. FAIR)

measure and quantify issues prioritise mathematically

Detail required to measure Qualititative approaches (e.g. ISO 27005)

identify all problems no accurate assessment of severity

If you start the quantitative approaches to early

many threats will slip through

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 15 / 46

Threat Identification Approach

Qualitative and Quantitative Approaches

Quantitiative approaches (e.g. FAIR)

measure and quantify issues prioritise mathematically

Detail required to measure Qualititative approaches (e.g. ISO 27005)

identify all problems no accurate assessment of severity

If you start the quantitative approaches to early

many threats will slip through

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 15 / 46

Threat Identification Approach

Qualitative and Quantitative Approaches

Quantitiative approaches (e.g. FAIR)

measure and quantify issues prioritise mathematically

Detail required to measure Qualititative approaches (e.g. ISO 27005)

identify all problems no accurate assessment of severity

If you start the quantitative approaches to early

many threats will slip through

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 15 / 46

Threat Sources

Outline

1

Threat Identification

2

Threat Sources WikiLeaks from Afghanistan The Stuxnet Worm The Seven Cybercriminal Families

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 16 / 46

Threat Sources

What is a threat source?

Recap

Threat source or threat agent An entity with an intention and capability to cause impact

Sentient adversaries — potential attackers Honest users — making mistakes Nature and random events

There is a reason behind incidents

Enemies with an objective of their own Nature and its random events

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 17 / 46

Threat Sources

Why do we identify threat sources?

Why do we need to identify the threat sources? When is the threat realised?

how often

Understand the nature of the threat

resourceful attackers or amateurs?

How will a preliminary attack be exploited?

blackmail? slander? further attacks?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 18 / 46

Threat Sources

Why do we identify threat sources?

Why do we need to identify the threat sources? When is the threat realised?

how often

Understand the nature of the threat

resourceful attackers or amateurs?

How will a preliminary attack be exploited?

blackmail? slander? further attacks?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 18 / 46

Threat Sources

Why do we identify threat sources?

Why do we need to identify the threat sources? When is the threat realised?

how often

Understand the nature of the threat

resourceful attackers or amateurs?

How will a preliminary attack be exploited?

blackmail? slander? further attacks?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 18 / 46

Threat Sources

Why do we identify threat sources?

Why do we need to identify the threat sources? When is the threat realised?

how often

Understand the nature of the threat

resourceful attackers or amateurs?

How will a preliminary attack be exploited?

blackmail? slander? further attacks?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 18 / 46

Threat Sources WikiLeaks from Afghanistan

Outline

1

Threat Identification

2

Threat Sources WikiLeaks from Afghanistan The Stuxnet Worm The Seven Cybercriminal Families

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 19 / 46

Threat Sources WikiLeaks from Afghanistan

WikiLeaks

http://www.wikileaks.org/ 77 000 military, classified documents on the war in Afghanistan

late July 2010 lifted from the US military

leaks from Iraq October 2010

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 20 / 46

Threat Sources WikiLeaks from Afghanistan

Assets

Confidential information

former informants

potential targets of retribution

future operations

allowing counter-operations

previous operations

leading to impact on goodwill and reputation

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 21 / 46

Threat Sources WikiLeaks from Afghanistan

Assets

Confidential information

former informants

potential targets of retribution

future operations

allowing counter-operations

previous operations

leading to impact on goodwill and reputation

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 21 / 46

Threat Sources WikiLeaks from Afghanistan

Assets

Confidential information

former informants

potential targets of retribution

future operations

allowing counter-operations

previous operations

leading to impact on goodwill and reputation

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 21 / 46

Threat Sources WikiLeaks from Afghanistan

Assets

Confidential information

former informants

potential targets of retribution

future operations

allowing counter-operations

previous operations

leading to impact on goodwill and reputation

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 21 / 46

Threat Sources WikiLeaks from Afghanistan

Assets

Confidential information

former informants

potential targets of retribution

future operations

allowing counter-operations

previous operations

leading to impact on goodwill and reputation

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 21 / 46

Threat Sources WikiLeaks from Afghanistan

Assets

Confidential information

former informants

potential targets of retribution

future operations

allowing counter-operations

previous operations

leading to impact on goodwill and reputation

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 21 / 46

Threat Sources WikiLeaks from Afghanistan

Assets

Confidential information

former informants

potential targets of retribution

future operations

allowing counter-operations

previous operations

leading to impact on goodwill and reputation

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 21 / 46

Threat Sources WikiLeaks from Afghanistan

Assets

Confidential information

former informants

potential targets of retribution

future operations

allowing counter-operations

previous operations

leading to impact on goodwill and reputation

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 21 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Relevant Threat Sources

Taliban and other insurgent organisation

military use of the information

Freedom of Information Movements

champions of the public right to information

Anti-War Movements

aiming to swing the public opinion about the war

Other military and political enemies of the state

damage the state’s military capability

Who is the actual threat source?

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 22 / 46

Threat Sources WikiLeaks from Afghanistan

Vulnerabilities

Staff with an agenda Extensive records in compact format

walk out with an encyclopedia on a keyring

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 23 / 46

Threat Sources WikiLeaks from Afghanistan

Vulnerabilities

Staff with an agenda Extensive records in compact format

walk out with an encyclopedia on a keyring

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 23 / 46

Threat Sources WikiLeaks from Afghanistan

Vulnerabilities

Staff with an agenda Extensive records in compact format

walk out with an encyclopedia on a keyring

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 23 / 46

Threat Sources The Stuxnet Worm

Outline

1

Threat Identification

2

Threat Sources WikiLeaks from Afghanistan The Stuxnet Worm The Seven Cybercriminal Families

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 24 / 46

Threat Sources The Stuxnet Worm

The Stuxnet Worm

Targets industrial control systems

specific types of computers from Siemens

Malware, able to override the controls

Chemical plants Power plants Power grids

Exploits four previously unknown vulnerabilities

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 25 / 46

Threat Sources The Stuxnet Worm

What is a worm?

Malware — Malicious Software Standalone programs

do not modify other programs (as viruses do)

Usually spreads over the network

network congestion is a common impact

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 26 / 46

Threat Sources The Stuxnet Worm

The attack on Iran

60% of infections in Iran The Nuclear Plant in Bushehr

compromised Iran will not reveal the extent of damage seems to have delayed the opening of the plant

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 27 / 46

Threat Sources The Stuxnet Worm

Who is the attack source?

This would require a lot of resources on the level of a nation state. Gadi Evron, Israeli cybersecurity strategist The known enemies — preventing nuclear development

USA and Israel

China — as a testrun of new cyberwarfare technology Are there private organisations with the capability? We do not know what the source is

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 28 / 46

Threat Sources The Stuxnet Worm

Who is the attack source?

This would require a lot of resources on the level of a nation state. Gadi Evron, Israeli cybersecurity strategist The known enemies — preventing nuclear development

USA and Israel

China — as a testrun of new cyberwarfare technology Are there private organisations with the capability? We do not know what the source is

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 28 / 46

Threat Sources The Stuxnet Worm

Who is the attack source?

This would require a lot of resources on the level of a nation state. Gadi Evron, Israeli cybersecurity strategist The known enemies — preventing nuclear development

USA and Israel

China — as a testrun of new cyberwarfare technology Are there private organisations with the capability? We do not know what the source is

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 28 / 46

Threat Sources The Stuxnet Worm

Who is the attack source?

This would require a lot of resources on the level of a nation state. Gadi Evron, Israeli cybersecurity strategist The known enemies — preventing nuclear development

USA and Israel

China — as a testrun of new cyberwarfare technology Are there private organisations with the capability? We do not know what the source is

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 28 / 46

Threat Sources The Stuxnet Worm

Who is the attack source?

This would require a lot of resources on the level of a nation state. Gadi Evron, Israeli cybersecurity strategist The known enemies — preventing nuclear development

USA and Israel

China — as a testrun of new cyberwarfare technology Are there private organisations with the capability? We do not know what the source is

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 28 / 46

Threat Sources The Seven Cybercriminal Families

Outline

1

Threat Identification

2

Threat Sources WikiLeaks from Afghanistan The Stuxnet Worm The Seven Cybercriminal Families

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 29 / 46

Threat Sources The Seven Cybercriminal Families

A viewpoint from Law Enforcement

• Dr. David Benichou at WIFS’09 in London

French juge investigatoire Special advisor to the Minstry of Justice PhD in Computer Sciences

Model based on field experience

more than 1000 cases Qualitative rather than quantitative

Real-life, rather than academic view

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 30 / 46

Threat Sources The Seven Cybercriminal Families

The seven families of cybercrime

Seven classes of threat sources (graphics c David Bénichou)

Empirical distribution of attack profiles

50 100 kiddies hackers avengers LP cyberterro bandits spies population dangerousness Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 31 / 46

Threat Sources The Seven Cybercriminal Families

The seven families of cybercrime

Adolescent amateurs

script kiddies hackers

Amateurs with a goal

avengers legal persons

Resourceful professionals

Organised crime Terrorists Spies

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 32 / 46

Threat Sources The Seven Cybercriminal Families

The big majority

Script Kiddies Clueless amateurs Use scripts created by others Trying hacks for fun No understanding of the techniques used Hackers Technically adept Obscure motivations

challenge, learning, experience

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 33 / 46

Threat Sources The Seven Cybercriminal Families

Masked Avengers

Grown up individuals

with a score to settle

Obvious motivation

relatively easy to unmask

e.g. a disgruntled employee with a desire to punish the company e.g. Mr/Mrs average dragging an ex-lover down in the mud

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 34 / 46

Threat Sources The Seven Cybercriminal Families

Masked Avengers

Grown up individuals

with a score to settle

Obvious motivation

relatively easy to unmask

e.g. a disgruntled employee with a desire to punish the company e.g. Mr/Mrs average dragging an ex-lover down in the mud

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 34 / 46

Threat Sources The Seven Cybercriminal Families

Masked Avengers

Grown up individuals

with a score to settle

Obvious motivation

relatively easy to unmask

e.g. a disgruntled employee with a desire to punish the company e.g. Mr/Mrs average dragging an ex-lover down in the mud

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 34 / 46

Threat Sources The Seven Cybercriminal Families

Masked Avengers

Grown up individuals

with a score to settle

Obvious motivation

relatively easy to unmask

e.g. a disgruntled employee with a desire to punish the company e.g. Mr/Mrs average dragging an ex-lover down in the mud

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 34 / 46

Threat Sources The Seven Cybercriminal Families

Masked Avengers

Grown up individuals

with a score to settle

Obvious motivation

relatively easy to unmask

e.g. a disgruntled employee with a desire to punish the company e.g. Mr/Mrs average dragging an ex-lover down in the mud

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 34 / 46

Threat Sources The Seven Cybercriminal Families

Masked Avengers

Grown up individuals

with a score to settle

Obvious motivation

relatively easy to unmask

e.g. a disgruntled employee with a desire to punish the company e.g. Mr/Mrs average dragging an ex-lover down in the mud

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 34 / 46

Threat Sources The Seven Cybercriminal Families

Legal Persons

Financial motives

unfair competition trade secrets

Highly skilled Easy to identify — the motive is a give-away

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 35 / 46

Threat Sources The Seven Cybercriminal Families

The big and resourceful

Spies, organised crime, and terrorists

Different motivations

political (spies) financial (organised crime) ideological (terrorists)

All are resourceful, with solid backing

few have resources on this scale the resources make serious impact possible

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 36 / 46

Threat Sources The Seven Cybercriminal Families

The rare and serious agents

Terrorists Spies Organised Crime Backed with considerable resources

money, manpower, information, backup

Different objectives

Ideology — Terrorists Politics — Spies Money — Organised Crime

Similar dedication

professionalism and clear objectives

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 37 / 46

Threat Sources The Seven Cybercriminal Families

The rare and serious agents

Terrorists Spies Organised Crime Backed with considerable resources

money, manpower, information, backup

Different objectives

Ideology — Terrorists Politics — Spies Money — Organised Crime

Similar dedication

professionalism and clear objectives

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 37 / 46

Threat Sources The Seven Cybercriminal Families

The rare and serious agents

Terrorists Spies Organised Crime Backed with considerable resources

money, manpower, information, backup

Different objectives

Ideology — Terrorists Politics — Spies Money — Organised Crime

Similar dedication

professionalism and clear objectives

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 37 / 46

Threat Sources The Seven Cybercriminal Families

The rare and serious agents

Terrorists Spies Organised Crime Backed with considerable resources

money, manpower, information, backup

Different objectives

Ideology — Terrorists Politics — Spies Money — Organised Crime

Similar dedication

professionalism and clear objectives

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 37 / 46

Threat Sources The Seven Cybercriminal Families

The rare and serious agents

Terrorists Spies Organised Crime Backed with considerable resources

money, manpower, information, backup

Different objectives

Ideology — Terrorists Politics — Spies Money — Organised Crime

Similar dedication

professionalism and clear objectives

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 37 / 46

Threat Sources The Seven Cybercriminal Families

The rare and serious agents

Terrorists Spies Organised Crime Backed with considerable resources

money, manpower, information, backup

Different objectives

Ideology — Terrorists Politics — Spies Money — Organised Crime

Similar dedication

professionalism and clear objectives

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 37 / 46

Threat Sources The Seven Cybercriminal Families

The rare and serious agents

Terrorists Spies Organised Crime Backed with considerable resources

money, manpower, information, backup

Different objectives

Ideology — Terrorists Politics — Spies Money — Organised Crime

Similar dedication

professionalism and clear objectives

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 37 / 46

Threat Sources The Seven Cybercriminal Families

The rare and serious agents

Terrorists Spies Organised Crime Backed with considerable resources

money, manpower, information, backup

Different objectives

Ideology — Terrorists Politics — Spies Money — Organised Crime

Similar dedication

professionalism and clear objectives

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 37 / 46

Threat Sources The Seven Cybercriminal Families

Risk Analysis

How does each family affect your risk analysis? Script Kiddies Hackers Avengers Legal Persons Terrorists Spies Organised Crime

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 38 / 46

Vulnerability Identification

Outline

1

Threat Identification

2

Threat Sources

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 39 / 46

Vulnerability Identification

Vulnerability Identification

ISO 27005:2008

Input lists of known threats assets existing controls Output a list of vulnerabilities in relation to assets, threats, and controls a list of vulnerabilities not related to any identified threat Action Identify vulnerabilities that could be exploited by the threats

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 40 / 46

Vulnerability Identification

Areas of vulnerabilities

ISO 27005:2008

Organisation Processes and procedures Management routines Personnel Physical environment Information system configuration Hardware, software or communications equipment Dependence on external parties

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 41 / 46

Vulnerability Identification

Vulnerabilities and Known Threats

For each threat identified Which assets are under threat? What vulnerabilities can it exploit

How?

What could be the attack What controls do we have? Resort the list, listing each vulnerability with all its associated threats

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 42 / 46

Vulnerability Identification

Vulnerabilities and Known Threats

For each threat identified Which assets are under threat? What vulnerabilities can it exploit

How?

What could be the attack What controls do we have? Resort the list, listing each vulnerability with all its associated threats

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 42 / 46

Vulnerability Identification

Vulnerabilities and Known Threats

For each threat identified Which assets are under threat? What vulnerabilities can it exploit

How?

What could be the attack What controls do we have? Resort the list, listing each vulnerability with all its associated threats

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 42 / 46

Vulnerability Identification

Vulnerabilities and Known Threats

For each threat identified Which assets are under threat? What vulnerabilities can it exploit

How?

What could be the attack What controls do we have? Resort the list, listing each vulnerability with all its associated threats

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 42 / 46

Vulnerability Identification

Vulnerabilities and Known Threats

For each threat identified Which assets are under threat? What vulnerabilities can it exploit

How?

What could be the attack What controls do we have? Resort the list, listing each vulnerability with all its associated threats

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 42 / 46

Vulnerability Identification

Vulnerabilities and Known Threats

For each threat identified Which assets are under threat? What vulnerabilities can it exploit

How?

What could be the attack What controls do we have? Resort the list, listing each vulnerability with all its associated threats

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 42 / 46

Vulnerability Identification

Vulnerabilities without Threat

Is there a problem? No risk – at the moment Threat is needed to exploit it Yet, should be recognised and monitored

it may change over time we may have forgotten a threat

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 43 / 46

Vulnerability Identification

Vulnerabilities without Threat

Is there a problem? No risk – at the moment Threat is needed to exploit it Yet, should be recognised and monitored

it may change over time we may have forgotten a threat

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 43 / 46

Closure

Outline

1

Threat Identification

2

Threat Sources

3

Vulnerability Identification

4

Closure

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 44 / 46

Closure

Exercise 5

Review NIST SP800-53 http://csrc.nist.gov/publications/nistpubs/ 800-53-Rev2/sp800-53-rev2-final.pdf Prepare a list, with short explanations, of the main types of controls. Additionally (not to be handed in)

1

Be ready to discuss the different types of information security controls in class.

2

read the following week’s exercise “Protecting the Forest”

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 45 / 46

Closure

Summary

Effective risk analysis requires structured review of

threats vulnerabilities

For threats we need to understand

source cause effect

No immediate risk from

threats without vulnerabilites vulnerabilities without threat

ISO 27005 provides the framework

Dr Hans Georg Schaathun Threats, Threat Agents, and Vulnerabilities Autumn 2010 – Week 5 46 / 46