● Taking control of a large number of computers and using them to bombard a server in what is called a distributed denial of service (DDoS, pronounced “dee-doss”) attack. ● Exploiting a buffer overflow and making the system crash. Elevation of privilege Elevation of privilege is getting access to more resources or functionality than a user is normally allowed by giving them more privileges than intended by the developer or system administrator. ● In our vault example, a bank employee steals the bank president’s ID card so that they can have access to all the bank records. ● Vertical escalation: gaining root or administrator access. ● Horizontal escalation: accessing information associated with a different user. Security Risk The threats to large information systems are great. Such threats arise based on the extent to which such a system processes sensitive data, has a large attack surface, and has a high level of implementation complexity. Given the difficulty of securing such a system, it is essential to take a strategic approach focusing our protection efforts on the parts of the system with highest risk. Since time and resources available for security work are always limited, the work inevitably runs up against practice constraints — this is why all software is said to have vulnerabilities. Ideally, security effort continues working in priority order until further effort enters the realm of diminishing returns. Risk management is an established practice that arose in the financial sector (insurance, investment, and gaming) to identify sources of risk and attempts to quantify them for the purpose of predicting potential 7
losses and implementing cost effective mitigations. Put simply, risk management strategy accepts that risk is unavoidable and attempts to “put it in a box” in the sense of putting a cap on the worst case, spreading the loss over time, investing in preventative efforts, and monitoring actual losses so that management can accurately understand their actual risk stance. Financial risk management allows quantitative assessments of risk by converting impacts into dollars, however this is more challenging in the information security space for several reasons. ● Financial assets are based on money, which is easily measured in precise amounts. ● Money is fungible (one dollar is as valuable as another) but information is not. ● Money lost can be be paid back but information once lost can be irretrievable. ● Insured risks have been accurately measured by actuaries and are well understood, but software security risks are newer and change rapidly. ● Financial institutions are carefully regulated, but software is mostly unregulated and companies often conceal details of security incidents so little public data is available. ● The financial impact of security incidents is difficult to measure, and there are additional risks such as losses to reputation or customer confidence that are difficult to quantify.
You've reached the end of your free preview.
Want to read all 11 pages?
- Fall '19
- Computer Security, Rich Customer