Editor: Kenneth Knapp, USAF Academy, USA
Foreword by Merrill Warkentin, Mississippi State University, USA
------- ------- -------
SECTION I: RISK & THREAT ASSESSMENT
Chapter I. Dynamic Modeling of the Cyber Security Threat Problem: The Black Market for Vulnerabilities
Jaziar Radianti, University of Agder, Norway
Jose. J. Gonzalez, University of Agder and Gjøvik University College, Norway
This paper discusses the possible growth of black markets (BMs) for software vulnerabilities and factors affecting their spread. The authors conduct a disguised observation of online BM trading sites to identify causal models of the ongoing viability of BMs. Results are expressed as a system dynamic model and suggest that without interventions, the number and size of BMs is likely to increase. A simulation scenario with a policy to halt BM operations results in temporary decrease of the market. Combining the policy with efforts to build distrust among BM participants may cause them to leave the forum and inhibit the imitation process to establish similar forums.
Chapter II. An Attack Graph Based Approach for Threat Identification of an Enterprise Network
Somak Bhattacharya, Indian Institute of Technology, India
Samresh Malhotra, Indian Institute of Technology, India
S. K. Ghosh, Indian Institute of Technology, India
As networks continue to grow in size and complexity, automatic assessment of the security vulnerability becomes increasingly important. The typical means by which an attacker breaks into a network is through a series of exploits, where each exploit in the series satisfies the pre-condition for subsequent exploits and makes a causal relationship among them. Such a series of exploits constitutes an attack path where the set of all possible attack paths form an attack graph. Attack graphs reveal the threat by enumerating all possible sequences of exploits that can compromise a given critical resource. The contribution of this chapter is to identify the most probable attack path based on the attack surface measures of the individual hosts for a given network and subsequently to identify the minimum securing options. As a whole, the chapter deals with the identification of probable attack path and risk mitigation that can significantly help improve the overall security of an enterprise network.
Chapter III. Insider Threat Prevention, Detection and Mitigation
Robert F. Mills, Air Force Institute of Technology, USA
Gilbert L. Peterson, Air Force Institute of Technology, USA
Michael R. Grimaila, Air Force Institute of Technology, USA
This chapter introduces the insider threat and discusses methods for preventing, detecting, and responding to the threat. Trusted insiders present one of the most significant risks to an organization. They possess elevated privileges when compared to external users, have knowledge about technical and non-technical control measures, and potentially can bypass security measures designed to prevent, detect, or react to unauthorized access. The authors define the insider threat and summarize various case studies of insider attacks in order to highlight the severity of the problem. Best practices for preventing, detecting, and mitigating insider attacks are provided.
Chapter IV. An Autocorrelation Methodology for the Assessment of Security Assurance
Richard T. Gordon, Bridging The Gap, Inc., USA
Allison S. Gehrke, University of Colorado, Denver, USA
This chapter describes a methodology for assessing security infrastructure effectiveness utilizing formal mathematical models. The goal of this methodology is to determine the relatedness of effects on security operations from independent security events and from security event categories, identify opportunities for increased efficiency in the security infrastructure yielding time savings in the security operations and identify combinations of security events which compromise the security infrastructure. The authors focus on evaluating and describing a novel security assurance measure that governments and corporations can use to evaluate the strength and readiness of their security infrastructure.
Chapter V. Security Implications for Management from the Onset of Information Terrorism
Ken Webb, Perth, Australia
In this chapter, the author presents the results of a qualitative study and argues that a heightened risk for management has emerged from a new security environment that is increasingly spawning asymmetric forms of Information Warfare. This chapter defines for readers what the threat of Information Terrorism is and the new security environment that it has created. Security implications for management have subsequently evolved, as managers are now required to think about the philosophical considerations emerging from this increasing threat.
SECTION II: ORGANIZATIONAL AND HUMAN SECURITY
Chapter VI. The Adoption of Information Security Management Standards: A Literature Review
Yves Barlette, GSCM-Montpellier Business School, France
Vladislav V. Fomin, Vytautas Magnus University, Lithuania and Rotterdam School of Management, The Netherlands
This chapter discusses major information security management standards, particularly the ISO/IEC 27001 and 27002 standards. A literature review was conducted in order to understand the reasons for the low level of adoption of information security standards by companies, and to identify the drivers and the success factors in implementation of these standards. Based on the findings of the literature review, the authors provide recommendations on how to successfully implement and stimulate diffusion of information security standards.
Chapter VII. Data Smog, Techno Creep and the Hobbling of the Cognitive Dimension
Peter R. Marksteiner, U. S. Air Force, USA
The overabundance of information, relentless stream of interruptions, and potent distractive quality of the Internet can draw knowledge workers away from productive cognitive engagement. Information overload is an increasingly familiar phenomenon, but evolving United States military doctrine provides a new analytical approach and a unifying taxonomy organizational leaders and academicians may find useful. Using military doctrine and thinking to underscore the potential seriousness of this evolving threat should inspire organizational leaders to recognize the criticality of its impact and motivate them to help clear the data smog, reduce information overload, and communicate for effect.
Chapter VIII. Balancing the Public Policy Drivers in the Tension between Privacy and Security
John W. Bagby, The Pennsylvania State University, USA
The public expects that technologies used in electronic commerce and government will enhance security while preserving privacy. This chapter posits that personally identifiable information is a form of property that flows along an “information supply chain” from collection, through archival and analysis and ultimately to its use in decision-making. The conceptual framework for balancing privacy and security developed here provides a foundation to develop and implement public policies that safeguard individual rights, the economy, critical infrastructures and national security. The illusive resolution of the practical antithesis between privacy and security is explored by developing some tradeoff relationships using exemplars from various fields that identify this quandary while recognizing how privacy and security sometimes harmonize.
Chapter IX. Human Factors in Security: The Role of Information Security Professionals within Organizations
Indira R. Guzman, TUI University, USA
Kathryn Stam, SUNY Institute of Technology, USA
Shaveta Hans, TUI University, USA
Carole Angolano, TUI University, USA
This chapter contributes to a better understanding of role conflict, skill expectations, and the value of information technology (IT) security professionals in organizations. Previous literature has focused primarily on the role of information professionals in general but has not evaluated the specific role expectations and skills required by IT security professionals in today’s organizations. The authors take into consideration the internal and external factors that affect the security infrastructure of an organization and therefore influence the role expectations and skills required by those who are in charge of security. The authors describe the factors discussed in the literature and support them with quotes gathered from interviews conducted with information security professionals in small organizations in central New York. They present a set of common themes that expand the understanding of this role and provide practical recommendations that would facilitate the management of these professionals within organizations.
Chapter X. Diagnosing Misfits, Inducing Requirements, and Delineating Transformations within Computer Network Operations Organizations
LTJG Nikolaos Bekatoros, US Naval Postgraduate School, USA
Major Jack L. Koons III, US Naval Postgraduate School, USA
Dr. Mark E. Nissen, US Naval Postgraduate School, USA
In this chapter, the authors use Contingency Theory research to inform leaders and policy makers regarding how to bring their Computer Networked Operations (CNO) organizations and approaches into better fit, and hence to improve performance. The authors identify a candidate set of organizational structures that offer potential to fit the U. S. Department of Defense better as it strives, and struggles, to address the technological advances and risks associated with CNO. Using the Organization Consultant expert system to model and diagnose key problems, the authors propose a superior organizational structure for CNO that can also be applied to organizations in the international environment. Results elucidate important insights into CNO organization and management, suitable for immediate policy and operational implementation, and expand the growing empirical basis to guide continued research
Chapter XI. An Approach to Managing Identity Fraud
Rodger Jamieson, The University of New South Wales, Australia
Stephen Smith, The University of New South Wales, Australia
Greg Stephens, The University of New South Wales, Australia
Donald Winchester, The University of New South Wales, Australia
This chapter outlines components of a strategy for government and a conceptual identity fraud management framework for organizations. Identity crime, related cybercrimes and information systems security breaches are insidious motivators for governments and organizations to protect and secure their systems, databases and other assets against intrusion and loss. Model components used to develop the identity fraud framework were selected from the cost of identity fraud, identity risk management, identity fraud profiling, and fraud risk management literature.
SECTION III: EMERGENCY RESPONSE PLANNING
Chapter XII. A Repeatable Collaboration Process for Incident Response Planning
Alanah Davis, University of Nebraska at Omaha, USA
Gert-Jan de Vreede, University of Nebraska at Omaha, USA
Leah R. Pietron, University of Nebraska at Omaha, USA
This chapter presents a repeatable collaboration process as an approach for developing a comprehensive Incident Response Plan for an organization or team. This chapter discusses the background of incident response planning as well as Collaboration Engineering, which is an approach to design repeatable collaborative work practices. A collaboration process for incident response planning is presented that was designed using Collaboration Engineering principles, followed by a discussion of the application process in three cases. The presented process is applicable across organizations in various sectors and domains, and consist of codified ‘best facilitation practices’ that can be easily transferred to and adopted by security managers.
Chapter XIII. Pandemic Influenza, Worker Absenteeism and Impacts on Critical Infrastructures: Freight Transportation as an Illustration
Dean A. Jones, Sandia National Laboratories, USA
Linda K. Nozick, Cornell University, USA
Mark A. Turnquist, Cornell University, USA
William J. Sawaya, Texas A&M University, USA
A pandemic influenza outbreak could cause serious disruption to operations of several critical infrastructures as a result of worker absenteeism. This paper focuses on freight transportation services, particularly rail and port operations, as an illustration of analyzing performance of critical infrastructures under reduced labor availability. Using current data on performance of specific rail and port facilities, the authors reach some conclusions about the likelihood of severe operational disruption under varying assumptions about the absentee rate. Other infrastructures that are more dependent on information technology and less labor-intensive than transportation might respond to large-scale worker absenteeism in different ways, but the general character of this analysis can be adapted for application in other infrastructures such as the cyber infrastructure.
Chapter XIV. Information Sharing: A Study of Information Attributes and their Relative Significance During Catastrophic Events
Preeti Singh, University at Buffalo, the State University of New York, USA
Pranav Singh, University at Buffalo, the State University of New York, USA
Insu Park, University at Buffalo, the State University of New York, USA
JinKyu Lee, Oklahoma State University, USA
H. Raghav Rao, University at Buffalo, the State University of New York, USA
We live in a digital era where the global community relies on Information Systems to conduct all kinds of operations, including averting or responding to unanticipated risks and disasters. This chapter focuses on Information Sharing within a disaster context. To study the relative significance of various information dimensions in different disaster situations, content analyses are conducted. The results are used to develop a prioritization framework for different disaster response activities, thus to increase the mitigation efficiency. The authors also explore roles played by existing organizations and technologies across the globe that are actively involved in Information Sharing to mitigate the impact of disasters and extreme events.
Chapter XV. An Overview of the Community Cyber Security Maturity Model
Greg B. White, University of Texas at San Antonio, USA
Mark L. Huson, University of Texas at San Antonio, USA
The protection of cyberspace is essential to ensure that the critical infrastructures a nation relies on are not corrupted or disrupted. Government efforts generally focus on securing cyberspace at the national level. In the United States, states and communities have not seen the same concentrated effort and are now the weak link in the security chain. Until recently, there has been no program for states and communities to follow in order to establish a viable security program. The authors develop the Community Cyber Security Maturity Model to provide a framework for communities to prepare, prevent, detect, respond, and recover from potential cyber attacks. This model has a broad applicability and can be adapted to nations and organizations as well.
Chapter XVI. Server Hardening Model Development: A Methodology-Based Approach to Increased System Security
Doug White, Roger Williams University, USA
Alan Rea, Western Michigan University, USA
The authors present essential server security components and develop a set of logical steps to build hardened servers. The authors outline techniques to examine servers in both the Linux/UNIX and the Windows Environment for security flaws from both the internal and external perspectives. The chapter builds a complete model covering tactics, and techniques that system administrators can use to harden a server against compromise and attack. The authors build a model to assist those who want to implement and maintain secure, hardened servers not only for today's intense demands but also for the foreseeable future as more servers come online to support new Internet-enabled services.
Chapter XVII. Trusted Computing: Evolution and Direction
Jeff Teo, Montreat College, USA
To effectively combat cyber threats, our network defenses must be equipped to thwart dangerous attacks. However, our software-dominated defenses are woefully inadequate. The Trusted Computing Group has embarked on a mission to use an open standards-based interoperability framework utilizing both hardware and software implementations to defend against computer attacks. Specifically, this group uses trusted hardware called the trusted platform module (TPM) in conjunction with TPM-enhanced software to provide better protection against such attacks. This chapter will detail a brief history of trusted computing, the goals of the Trusted Computing Group and the workings of trusted platforms.
Chapter XVIII. Introduction, Classification and Implementation of Honeypots
Miguel Jose Hernandez y Lopez, Universidad de Buenos Aires, Argentina
Carlos Francisco Lerma Resendez, Universidad Autónoma de Tamaulipas, Mexico
This chapter discusses the basic aspects of Honeypots, how they are implemented in modern computer networks, as well as their practical uses and implementation in educational environments. This chapter covers the most important points regarding the characteristics of Honeypots and Honeynets. The implementation of Honeypots provides an answer to a common question posted by the field of information security and forensics: How to dissect the elements that make up an attack against a computer system. The chapter summarizes the different features and capabilities of Honeypots once they are set up in a production environment.
