INFO 644: PUBLIC POLICY ASSIGNMENT

PRESIDENTIAL INITIATIVES

Group #2:Tamara Clark

Gustave R DeCoursey

Deepa Devadas

Megan Dougherty

Chrystal Edwards

Top five issues for the current administration

Cyber-Terrorism Insider Threats Risk Mitigation Information Security/Corporate

Governance Working in the Cloud

CYBER-TERRORISM

Cyber Terrorism

Threat will increase as terrorists become more high tech and computer savvy.

“A cyber attack could have the same impact as a well-placed bomb” – Robert Mueller, III, Director of FBI

Terrorists look for and take advantage of vulnerabilities – network infrastructure security vulnerabilities

Cyber Terrorism

What is Cyber Terrorism?“Cyber Terrorism is a criminal act perpetrated by

the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services, where the intended purpose is to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social or ideological agenda” - Keith Lourdeau, Deputy Asst Director of FBI’s Cyber Division

Cyber Terrorism

Two Types of Cyber Terrorism Attacks Effects based - Disruptive enough to

generate the same fear within individuals as traditional types of terrorism

Intent based - Create severe economic harm or intimidate the government and individuals into supporting the terrorists’ political objectives

Cyber Terrorism

What terrorists have

done: Email bombs Publication of

threatening material and content

Denial-of-service Defaced websites

What is possible? Massive blackouts Destruction of

Financial systems

Transportation systems

Defense infrastructure

National Security infrastructure

Cyber Terrorism

Evidence of acquiring computer skills to use for

cyber attacks: Al-Qaeda fighters left behind documents

that contained information about Al-Qaeda operatives and their level of computer systems proficiency during an attack by the U.S

Iman Sundra, the convicted Bali nightclub bomber, has written a book to influence Muslim youth to learn computer hacking skills in order to obtain credit card information and funds from U.S. companies.

Cyber Terrorism

Iranian Cyber Army defaced Congress’ website after President Obama’s State of the Union speech

Google’s network infrastructure in China hacked for Gmail accounts of Chinese human rights activists

U.S. Department of Defense computer network attacked and malware installed on the network

Cyber Terrorism

SWOT

Strengths – Human capital resources to upgrade network infrastructure security

Weaknesses – Vulnerability of network infrastructure and security holes

Opportunities – Awareness and knowledge to collaborate and build strong security policies

Threats – Terrorists taking advantage of network vulnerabilities

Cyber Terrorism

Secretary of State, Hillary Clinton, is pushing for internet freedom for all.

Governments should not prevent people from connecting to the internet, web sites and each other.

Current administration will work with academia, the private sector, and foreign governments to provide new tools to the people so they may exercise their freedom of speech and expression towards their governments

Internet freedom will open the door to possible cyber terrorism attacks

Insider Threats

Insider Threats

Businesses are most at risk from former and current employees

Motivated by work situations, opportunities or other personal factors

Resultant action is computer abuse, fraud and theft, falsification, planting of malicious code, or sale of personal information

Insider Threats

Real World Example: Donald Burleson, a computer programmer Designed a virus after being scolded for

sotring personal letters on his company computer

Virus was designed to erase portions of the mainframe

After being fired, Burleson was able to employ an unauthorized backdoor password to execute the virus

Insider Threats

Simpler Real World Example: Two credit union employees had access to

alter credit reports based on updated information received

Intentionally misused this authorization to alter credit reports in exchange for money

Insider Threats

U.S. Secret Service National Threat Assessment Center and the CERT Coordination Center of Carnegie Mellon University’s Software Engineering Institute completed an Insider Threat Study and found: Most insider events were triggered by a

negative event in the workplace Most were motivated by financial gain Perpetrators did not share a common profile

Insider Threats

Insider Threat Study (continued): Most perpetrators planned their actions in

advance Only seventeen percent involved

individuals with administrator access Eighty-seven percent of the attacks used

very simple user commands that didn't require any advanced knowledge

Most attacks were committed while at the workplace and during normal work hours

Insider Threats

Business tend to concentrate on preventing outside intrusion and neglect insider threats

62% of large businesses have dealt with a security incident by a current or former employee.

Deloitte 2007 Global Security Survey found that 91% were concerned about employees and 79% cited the human factor as the root cause of Information Security failures.

Same survey showed 22% of respondents had provided no employee security training over the past year and less than a 33% said their staff was skilled enough to respond to security needs

Insider Threats

Companies need more requirements for: Clear and concise policies Training Background checks Discipline actions

Risk Mitigation

Risk Mitigation

The most commonly considered risk management strategy

This involves fixing the flaw or providing some type of compensatory control to reduce the likelihood or impact associated with the flaw.

“Risk mitigation involves the process of prioritizing, evaluating and implementing appropriate controls. “

Risk Mitigation - Purpose

Helps in communicating how specific risks will be dealt with and the action steps that are required to carry them out.

Provides a clear sense of the actions that the project team members are expected to take

Provides management with an understanding of what actions are being taken on their behalf to ameliorate project risk.

Risk Mitigation Issues/Threats

Care should be taken while assessing and prioritizing risks, since it could result in time being wasted in dealing with risks that are not likely to occur. When there is too much time spent in assessing and managing unlikely risks, this diverts resources that could have been used more profitably.

If the risk management process is prioritized too highly, then this could keep an organization from ever completing a project or even getting started.

Another very important consideration in risk mitigation is to avoid any conflicts of interest.

Why should Risk Mitigation be considered important?

If ignored: Result in the failure to develop a strong

organizational culture Inefficient communication of information

between levels of management Insufficient risk assessment Ineffective auditing and monitoring

programs

Risk Mitigation – Opportunities

Provide opportunities for the project members to discuss improvements, including explicit discussion of risk mitigation strategies and approaches, as well as what the probable impact of different risk mitigation measures might be

These communications among organizational members offer opportunities to challenge assumptions, identify errors and voice issues. There are also opportunities for dispersed organizational members to grow and learn together.

Provides opportunities for clarification, for sense making, for organizational growth, and opportunities for people to discuss improvements to the organization and the impacts of different risk mitigation strategies

Information Security/ Corporate governance

Corporate Irresponsibility

WorldCom & Enron No ownership of liabilities Difficult to prosecute Legislative Action

HIPAA Sarbanes-Oxley Act Graham-Leach-Bliley Act

Governance

Top down methodology for ownership of corporate processes

Information governance is a subset of corporate governance Deals with all aspects of information

Electronic Written Printed Creation, transport and destruction

Security Governance

Security roles and responsibilities Provide strategic direction Ensures objectives are met Manages risk

Security policies Address roles of individual Address standards of implementation

Continual evaluation of security program

Management’s Involvement

Understand Risks when governance is nonexistent Reputation damage Loss of revenue Litigious effects

Implementation works better with top involvement

Deliverables

Security plan design Plan Implementation Monitor plan for desired outcomes Ongoing education

Awareness of goals and initiatives Maintain security education to highest

levels

Cloud computing

Cloud Computing – Definition Internet-based computing, which allows

for shared resources, such as software and information to be provided to computers and other devices on-demand. Typical cloud computing providers deliver common business applications online which are accessed from another web service or software.

Cloud Computing – Service models

Software as a Service, through which applications are provided in the cloud;

Platform as a Service, through which a cloud provider permits users to create or run applications using languages and tools supported by the provider while the provider delivers the underlying infrastructure such as servers, operating systems, or storage; and

Infrastructure as a Service, through which a customer can deploy a computing infrastructure similar to a virtualized environment.

Clouds

Reduced costs Resource sharing is more

efficient Management moves to

cloud provider Consumption based cost Faster time to roll out new

services Dynamic resource

availability for crunch periods

Compliance/regulatory laws mandate on-site ownership of data

Security and privacy Latency & bandwith guarantees

Absence of robust SLA’s

Availability & reliabilty

Pros Cons

Federal Cloud

Due to its growing popularity of cloud computing, the federal government is moving more quickly than the private sector in both their interest and potential adoption of what has been referred to as the federal cloud

The Obama administration has made cloud computing a high priority, calling for a "fundamental re-examination of investments in the technology infrastructure.“ the overall objective is to create a more agile federal

enterprise, where services can be provisioned and reused on demand to meet business needs

Security issues with the cloud Privileged user access

Sensitive data processed outside the enterprise brings a level of risk

Regulatory compliance Customers are ultimately held responsible for the

security and integrity of their own data, even when it is held by a service provider

Data location When using a cloud, you may not have an idea of where

your data is stored. Data segregation

Data in the cloud in in a shared environment, with data from other customers

Security issues with the cloud Recovery

Even if you don’t know where your data is, a cloud provider should tell you what will happen to your data and service in case of a disaster

Investigative Support Investigating inappropriate or illegal activity may be

impossible in cloud computing Long-term Viability

Ideally, your cloud computing provider will never go broke or get acquired by a larger company. If this happens you must be sure your data will be available, even after such an event.

Cloud – summary

Client-plus-cloud computing offers enhanced choice, flexibility, operational efficiency, and cost savings for governments, businesses, and individual consumers.

To take full advantage of these benefits, reliable assurances regarding the privacy and security of online data must be provided.

In addition, a number of regulatory, jurisdictional, and public policy issues remain to be solved in order for online computing to thrive.