Please enable JavaScript.

Coggle requires JavaScript to display documents.

Block 1 Part 3 Risks and an introduction to human factors - Coggle Diagram

- - - - You will encounter a number of so-called ‘ISO standards’ during your studies. The International Organization for Standardization (ISO)1 is an international standards-setting group comprised of member organisations from individual nation states. It aims to lay down common international standards for manufactured goods, agriculture, food and services.
  - - - To Do Bruce Schneier is an internationally renowned security technologist who writes the monthly Crypto-Gram newsletter and maintains the Schneier on Security blog. In both of these, he provides commentary and insights into critical security issues as well as discussing some of the wider issues raised in any discussion of cyber security. Read the short post Perceived Risk vs. Actual Risk on Schneier’s blog (Schneier, 2006); take notes in your learning journal if you feel it is helpful. Don’t forget to bookmark the post! The piece should help you better understand the earlier discussion. You might find some of the links useful, but you do not need to read them if you are short of time.
        
        Example – A simple risk identification for online banking
        An imaginary bank provides an online banking service and identifies the risk of the service being offline. Risk identification requires the bank to identify the uncertainties of being offline. Some of these uncertainties would include server failure, a broken network connection, software failure and hacking. Any of these uncertainties could result in the online bank being unavailable but some are more likely than others – it is necessary to measure the level of uncertainty for each.
        
        Almost every action you perform using a computer creates a cyber security risk, but if you only have limited time, money and staffing to address these risks, how do you prioritise what risk you need to focus on?
        
        Prioritising risks solely on priorities recommended by cyber security experts is likely to greatly reduce the actual risks facing an organisation. However, if these actual risks differ from users’ perceived risks then the organisation’s reputation may be damaged as its security team will be seen to be unresponsive to its users.
        
        Conversely, concentrating on perceived risks can leave an organisation vulnerable if different actual risks are unaddressed through lack of resources.
    - - Risks can be calculated as a factor of two terms: impact and likelihood.
        
        Impact
        
        The consequences, or effects of a cyber security incident.
        
        Impact
        
        The impact is some measure of the degree of harm to assets caused by any breach of any of the CIA principles (NIST, 2008). Two examples are given below.
        
        A medical patient database must maintain the confidentiality, integrity and availability of its records at all times. Any disruption to any of the CIA Triad will have an impact on that asset.
        
        An employee payroll database should be most concerned with maintaining the confidentiality and integrity of its data; no unauthorised people should be able to see the data and the data must be correct. Availability may not be critical – if the payroll run is only once a month, the database operators are likely to rate the impact of a loss of availability less than confidentiality and integrity.
        
        While impact is often described in terms of an asset’s financial value or the consequences of disrupting activities, it also applies to intangible assets such as brand recognition, reputation and user goodwill. A low actual risk may still have a high impact if it is perceived to be a high risk.
        
        LIKELIHOOD
        
        The impact is some measure of the degree of harm to assets caused by any breach of any of the CIA principles (NIST, 2008). Two examples are given below.
        
        A medical patient database must maintain the confidentiality, integrity and availability of its records at all times. Any disruption to any of the CIA Triad will have an impact on that asset.
        
        An employee payroll database should be most concerned with maintaining the confidentiality and integrity of its data; no unauthorised people should be able to see the data and the data must be correct. Availability may not be critical – if the payroll run is only once a month, the database operators are likely to rate the impact of a loss of availability less than confidentiality and integrity.
        
        While impact is often described in terms of an asset’s financial value or the consequences of disrupting activities, it also applies to intangible assets such as brand recognition, reputation and user goodwill. A low actual risk may still have a high impact if it is perceived to be a high risk.
  - - - The diagram shows that assets, threats and vulnerabilities must all be present for a risk to exist. If an individual or organisation:
      - has no assets, there can be no risks since there is nothing of interest to an attacker2
      - has no vulnerabilities, then a threat cannot exploit a vulnerability to compromise an asset
      - is exposed to no threats, then no one will attempt to exploit a vulnerability to compromise an asset.
      - Let’s consider how risks affect assets, threats and vulnerabilities:
        
        Assets: Cyber security is not directly concerned with the value of assets; however, you do not want to do anything that lowers their value! For example, failing to follow good security practices or legal requirements could reduce the value of assets.
        
        Threats: It can be argued that the manner in which an individual or organisation operates can increase or decrease the number of threats they face as well as change the type of threat. Organisations seen to be unethical or breaking the law have been targeted by activists. For instance, in 2020, attackers were able to fake tweets using the account of the Chinese ambassador to the UK as a protest against his government’s actions (Davidson, 2020). Conversely, those seen to act in a compassionate and ethical manner might see fewer threats. However, there are examples of threats specifically targeting organisations set up for the benefit of society, for example, Russian hacking attacks on Switzerland’s Spiez Laboratory, which analyses chemical weapons samples (Gallagher, 2018), or anti-Israeli attacks on the Norwood charity which provides help for Jewish people with learning disabilities (Hargrave, 2021).
        
        Vulnerabilities: It is impossible to remove every vulnerability from any realistic system, so you must seek to reduce the level of vulnerabilities in an organisation. This is achieved by implementing various risk responses through risk management processes.
  - - - Acceptable: Although the risk has been identified, it either has limited impact to no impact on the organisation, or its likelihood is considered so low that any attempt to address the risk cannot be justified on cost or time grounds. No further action is needed.
      - Tolerable: The risk has been contained and is either ‘As Low As Reasonably Possible’ (ALARP)3 or ‘As Low As Reasonably Achievable’ (ALARA). For a risk to be ALARP, an organisation must be able demonstrate that the costs of further reducing a risk are disproportionate to the benefits, while ALARA usually means reducing a risk to a level in order to meet an agreed standard or a contractual obligation.
        
        Tolerable risks can be addressed in three ways:
        
        Mitigating risks
        
        Mitigating risk: An organisation will put measures in place to eliminate or reduce a risk; examples may include:
        
        preventing threats through improved security
        
        using specialised software to identify suspicious activity on a network
        
        better cyber security training for staff
        
        developing strategies to recover from a successful attack (e.g., using off-site backups to recover data in case of a disaster at the main location or using multiple, geographically dispersed servers to provide continuous service during a denial-of-service attack).
        
        Shifting Risks
        
        An organisation may choose to reduce their exposure to risks by subcontracting some of their operations to another organisation. The subcontractor will then assume that risk but might be better equipped to mitigate that risk than the original organisation. Examples of transferring risk include using an external provider for email who offers greater capacity and malware screening, or using a third-party payment service to process credit card transactions. Naturally, shifting risk introduces a new risk that the subcontractor may not actually be capable of fulfilling its obligations.
        
        Transferring Risks
        
        Transferring risk: This is a common risk management strategy where there is a risk of financial damages to an organisation. The most common way of transferring risk is to purchase an insurance policy that will pay out if the risk is realised. Alternatively, risk transfers involve so-called indemnification clauses describing conditions under which an organisation will pay compensation, or indeed block users from seeking compensation entirely.
      - Intolerable: The part of the system at risk needs to be abandoned or replaced since the risk raises an existential threat. If this is not possible (or cannot be completed in a reasonable amount of time), then vulnerabilities need to be eliminated wherever possible.*
  - - - If technology raises so many potential cyber security issues, it may be tempting to view cyber security purely as a technological problem. Weaknesses in hardware or software can be addressed with an appropriate technological solution, for example: out-of-date hardware and software can be replaced by current versions; insecure encryption using short keys can be superseded by encryption using longer keys; and easily guessed passwords can be made impossible to guess by imposing new, complicated password policies (Figure 1.8).
        
        Figure 1.8 Password requirements for Microsoft Windows 10 accounts
        
        Description Figure 1.8 Password requirements for Microsoft Windows 10 accounts.The list tells users that an acceptable password must include characters from at least three of the following categories:upper-case letters from European languages.lower-case letters from European languages.numbers 0 to 9.a pre-defined set of non-alphanumeric characters.alphabetic characters from non-European languages.The note ends by stating that these requirements are imposed whenever a password is changed or created.
        
        Tempting though it is, this approach is insufficient to guarantee security. Whenever people use computers, they introduce issues relating to humans. Most people have probably used computers when tired, angry or distracted; forgotten passwords; lost a device (or even several devices); sent an email message to the wrong person; deleted an important file; clicked ‘Yes’ when they meant ‘No’ … The list of things that adversely affect use of computers is very long.
        
        A comprehensive understanding of cyber security requires a discussion of ‘human factors’. A good definition of this term comes from the UK Health and Safety Executive, a statutory body responsible for workplace safety:
        
        Human factors refer to environmental, organisational and job factors, and human and individual characteristics, which influence behaviour at work in a way which can affect health and safety.
        (Health and Safety Executive, 2018, para. 1)
        
        2 more items...
- - - - Abagnale’s ability to persuade companies and individuals to trust him in order to commit fraud is an example of social engineering. A more formal definition is provided by NIST:. The act of deceiving an individual into revealing sensitive information, obtaining unauthorized access, or committing fraud by associating with the individual to gain confidence and trust.
        (NIST, 2017, p. 54)
        
        Social engineering Terminology
        A range of human factor attack techniques aiming to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes or to obtain access to a computer system.
        
        Study note – Social engineering isn’t just about computers!
        Although the term ‘social engineering’ is often associated with computers, it is probably as old as civilisation. Examples can even be found in the biblical book of Genesis where Satan tricks Eve into eating the forbidden fruit by persuading her that God has kept certain knowledge for Himself. As for many subsequent social engineering victims, this didn’t end well for Eve and Adam …
  - - - 1.Reciprocity: People tend to return favours. They feel an obligation to assist those who have offered assistance or given them a gift, service or support.
        
        2.Scarcity: Time-limited offers such as job vacancies or discount pricing put pressure on people to make immediate decisions without adequately considering the risks.
        
        Authority: People obey authority figures such as managers, teachers or social leaders. In some situations, this authority can make their juniors perform dangerous, illegal or objectionable actions.
        
        Commitment and consistency: People don’t like to go back on their word. They will often continue a risky action they have committed to, even if they have some doubts about the wisdom of their actions.4.
        
        Liking: People are easily persuaded to perform actions if they like the people asking them to perform those tasks. People tend to like others who behave in a similar manner, share similar viewpoints and who compliment them.
        
        Consensus: People tend to copy actions they see others performing, especially if they see others benefiting from those actions.
        
        1 more item...
    - - There is an almost unimaginable variety of social engineering attacks, but they can be classified broadly into a number of attack vectors (Watson, Mason and Ackroyd, 2014a), some of which are described in this section:
        
        phishing, spear-phishing, whaling, vishing and smishing.pretexting.impersonation.baiting.quid-pro-quo.water-holing.tailgating (also known as piggybacking).
      - 3.2.1 Phishing, spear-phishing, whaling, vishing and smishing
        
        You are almost certainly familiar with the term phishing (untargeted attempts to solicit personal information from a victim). You may have also encountered the terms spear-phishing (a targeted form of phishing) and whaling (spear-phishing aimed at senior executives in an organisation). Vishing (voice phishing) is a related attack vector where the attacker solicits information from the victim in a phone call, while smishing conducts the attacks using messaging services such as SMS 5.
        
        Such attacks appear to originate from reputable organisations or individuals and may include warnings of lost parcels or supposedly compromised bank accounts, security alerts, requests for payment or more positive messages such as a friend wanting to make contact, an investment opportunity or an unsolicited job offer. Figure 1.9 shows a phishing email claiming to come from a courier company and demanding payment of fees before an item can be delivered. Clicking links in the message will take the user to a form requesting bank or credit card details.
        
        Figure 1.9 A screenshot from an email program showing a phishing email supposedly sent by the DHL courier company.
        
        Description A screenshot from an email program showing a phishing email supposedly sent by the DHL courier company.
        The email tells the recipient that their package is being held until a $1.99 charge is paid. A link is provided to where this can be done, and the recipient is encouraged to make the payment within the next 14 days.
        
        5 We promise, we didn’t make up the terrible name smishing !Back to main text
        
        3.2.2 Pretexting
        
        The Oxford English Dictionary defines pretext as ‘To use or put forward (a reason) as a pretext or excuse; to pretend, feign’ (OED Online, 2007).
        
        Pretexting is a social engineering attack in which the attacker creates a scenario in order to persuade a victim to give up valuable information, such as their password or a bank account number. For example, a fictional bank customer might receive a phone call like this:
        
        Hello, this is TrustedBank. As part of our ongoing security processes, we’ve identified some attempts by criminals to access your bank account. We’re really sorry this has happened, and we will fix any problems shortly. First of all, we need to complete a few simple security questions – so if you can tell us your name as written on your bank card
        
        This form of pretexting is especially widespread in the UK. Many thousands of people have been phoned by criminals and persuaded to give up sensitive personal information that has resulted in their bank accounts being drained. Similarly, fraudsters pretending to represent telecom companies have phoned and emailed customers under the pretext of identifying networking problems or malware on customer computers (White, 2017; Ofcom, 2020).
        
        3.2.3 Impersonation
        
        As its name suggests, impersonation is a form of social engineering where the attacker pretends to be another person in order to gain access. Common roles for impersonators are managers, members of IT support staff, auditors, new members of staff or important customers. Impersonators may use props including credentials, employee badges, uniforms, letters of introduction and customer numbers (all of which can be forged) to increase their level of trustworthiness.
        
        Impersonation is effective because each of us regularly interact with unfamiliar people – even if they claim to work for the same organisation as us. It is entirely natural to believe a person when they say who they are and why they need assistance.
        
        Impersonation can be used to gain physical access to a building, to perform reconnaissance on a prospective target, to steal documents and data, or to plant malicious software on a computer network. Alternatively, impersonation using the phone or email can be used to gain remote access to systems.
        
        1 more item...
        
        3.2.4 Baiting
        
        Baiting is a form of attack in which victims are enticed into compromising their security in exchange for a reward. Baiting attacks can be performed entirely online, such as sending messages to victims offering them supposed links to free music or pirated movies hosted on malicious websites, but most commonly they use physical media including optical disks and USB flash memory drives.
        
        A physical baiting attack might send drives to named individuals or leave them lying around in public areas such as office receptions and car parks. The attack relies on its victims being greedy (‘Oooh look, a free flash memory drive!’) or curious (‘A disk marked “Confidential” – I wonder what’s on it?’) or wishing to act as a good citizen (‘The owner of this drive must be worried about it. Perhaps their name and address are in one of the files.’). For whatever reason, the victim then inserts the drive into their computer and inadvertently installs malware. We will examine a physical baiting attack involving USB flash memory drives in an activity later in this week.
        
        1 more item...
        
        3.2.5 Quid-pro-quo