Examining Approaches to Quantifying Cyber Risk for Improved
Total Page：16
File Type：pdf, Size：1020Kb
Examining Approaches to Quantifying Cyber Risk for Improved Cybersecurity Management by Sravya Bhamidipati Submitted to the Department of Electrical Engineering and Computer Science in partial fulfillment of the requirements for the degree of Master of Engineering in Computer Science and Engineering at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY September 2019 c Massachusetts Institute of Technology 2019. All rights reserved. Author.............................................................. Department of Electrical Engineering and Computer Science August 29, 2019 Certified by. Michael Siegel Cybersecurity at MIT Sloan, Co-Director Thesis Supervisor Accepted by . Katrina LaCurts Chair, Master of Engineering Thesis Committee 2 Examining Approaches to Quantifying Cyber Risk for Improved Cybersecurity Management by Sravya Bhamidipati Submitted to the Department of Electrical Engineering and Computer Science on August 29, 2019, in partial fulfillment of the requirements for the degree of Master of Engineering in Computer Science and Engineering Abstract As technology's societal influence continues to grow, cyber risk management is be- coming a serious priority. Individuals are putting their important assets and personal data, such as social security numbers, passwords, medical history, and more into the cloud. As a result, security breaches pose a drastic threat. To properly address this, rigorous risk management needs to be in place, and it is a well-known adage that you can not manage what you can not measure. This thesis first shows that there is room in the industry for better quantitative cyber risk measurement and then provides an assessment of current players that are trying to approach this issue. As one solution to the problem, a Failure Modes and Effects Analysis is performed on well-known cybersecurity breaches to provide common failure modes, causes, and effects within an organization. Cyber risk must be evaluated quantitatively in order to effectively approach it. Thesis Supervisor: Michael Siegel Title: Cybersecurity at MIT Sloan, Co-Director 3 4 Acknowledgments I would like to first and foremost thank my advisor, Michael Siegel, for his vision, encouragement, and invaluable guidance throughout my thesis process. I would also like to thank George Wrenn for his wealth of ideas on potential contribu- tions to the field, and for providing me with direction once I picked a path. I thank the rest of the Cybersecurity at MIT Sloan team for sharing new work with me at weekly meetings, and for giving me advice as I shared my own ideas. I would like to thank Saket Bajoria, Nitin Aggarwal, Jyoti Yadav, and Saket Modi for providing me with relevant resources and sharing their analysis metrics and meth- ods with me. My research has been supported in part by their company, Lucideus Incorporated. Lastly, I would like to thank my friends and family, particularly my parents, Jagan and Lakshmi Bhamidipati, for constantly motivating me during this journey! None of this would be possible without my pillars of support. 5 6 Contents 1 Introduction 13 1.1 Contributions . 15 2 Hole in the Industry 17 2.1 Statistical Evidence of a Problem . 18 2.2 Present-Day Cyber Risk Management . 19 2.2.1 National Institute of Standards and Technology . 19 2.2.2 C2M2 . 20 2.2.3 Risk Matrices . 22 2.3 Human Role in Cyber Risk Exposure . 23 2.3.1 Insider Threat . 23 2.3.2 The Government . 24 2.4 Conclusion . 25 3 Current Players 27 3.1 BitSight . 27 3.2 Security Scorecard . 28 3.3 Value at Risk . 29 3.3.1 Factor Analysis of Information Risk . 30 3.3.2 RiskLens . 30 3.4 Lucideus Security Assessment Framework for Enterprise (SAFE) . 31 3.5 Cyber Doppler . 33 3.6 Conclusion . 35 7 4 Failure Modes and Effects Analysis for Cybersecurity Management 37 4.1 What is FMEA? . 38 4.2 Background . 38 4.3 Applicability to the Cyber World . 39 4.4 FMEA Literature Review . 39 4.5 Prevalence of Breaches caused by People and Policies . 46 4.6 Methodology . 47 4.7 FMEA Example . 49 4.7.1 Yahoo, 2014 . 49 4.7.2 Marriott International, 2014-2018 . 49 4.7.3 Adult Friend Finder, 2016 . 49 4.7.4 Equifax, 2017 . 50 4.7.5 eBay, 2014 . 50 4.7.6 Target Stores, 2013 . 50 4.7.7 JP Morgan Chase, 2014 . 50 4.7.8 Uber, 2016 . 51 4.7.9 US Office of Personnel Management (OPM), 2012-2014 . 51 4.7.10 Sony Playstation Network, 2011 . 51 4.8 Results . 51 4.9 Analysis and Future Work . 52 5 Discussion 55 5.1 Future Work . 55 A Tables 57 B Figures 59 8 List of Figures 2-1 An example of MIL usage for effective management[10] . 21 3-1 Security Scorecard sample report[80] . 28 3-2 Value at Risk Flowchart[78] . 29 3-3 SAFE Model flow of information[33] . 32 3-4 BCG Cyber Doppler loss and impact calculation methodology[84] . 34 4-1 Assigning risk based on likelihood and impact[93] . 41 4-2 The FAIR model assessment of risk[37] . 43 4-3 Example analysis across various failure modes[2] . 45 4-4 Six Sigma's[81] severity, occurrence, detectability scoring recommen- dations, Part 1 . 48 4-5 Six Sigma's[81] severity, occurrence, detectability scoring recommen- dations, Part 2 . 48 B-1 A bar chart ranking the top 10 cyber breaches by Risk Priority Number 60 B-2 A scatter plot comparing the RPNs to number of stolen records . 61 9 10 List of Tables A.1 A sample FMEA conducted on the top 10 breaches of the past decade. 58 11 12 Chapter 1 Introduction The presence of cyber crime and efforts to thwart it have been around for about fifty years. The first known usage of the word "hacking" came in 1960, although it was seen as a positive way to improve systems at that time. By the 1970s, there was a darker turn when hackers began using their skills to act as operators and extort personal information from unsuspecting clients. Controlling this was difficult, as technology was still new at the time, and there was no legislation in place to stop cyber crime as there was for other crimes. In 1986, Congress finally passed the Federal Computer Fraud and Abuse Act, making it a felony to tamper with computers. While this helped some cases, law enforcement became far too vigilant and nearly ruined some innocent companies based on suspicions of cyber crime activity. To counter this, the Electronic Frontier Foundation, a group dedicated to preventing illegal prosecution of organizations, was formed in 1990[87]. The technological industry has been dealt the challenge of striking the delicate balance between protecting information from malicious hackers and ensuring that searches for these criminals are done lawfully. The management side of such attacks has not evolved as fast as the cyber criminals have. For example, between 2016 and 2017, there was a reported 600% increase in Internet of Things (IoT)1 attacks. Though 1"The internet of things, or IoT, is a system of interrelated computing devices, mechanical and digital machines, objects, animals or people that are provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction"[74] 13 companies are cracking down on vulnerabilities, attackers are now injecting malware earlier in the supply chain to exploit organizations. In fact, a recent Internet Security Threat Report by Symantec claims that 1 out of every 13 web requests have led to malware[13]. As a result of such aggressive and consistent attacks, Cybersecurity Ventures, a leading computer and network security company, predicts that cyber crimes in the five-year period up to 2021 will total total one trillion dollars[53]. The cost per stolen record in the United States has shot up to about $233, with the cost per health care record at a much higher marking of $408[82]. The stakes are high, yet a lot of companies have ignored cyber threat altogether. A recent survey[45] found that seven in ten companies are unprepared for a cyber attack. 45% of companies surveyed reported experiencing at least one cyber attack in the past year, and two-thirds of that group suffered at least two. This is an especially scary statistic given that about two thirds of small to mid-size companies shut down entirely after a cyber attack[8]. To address this large issue, some players have recently come out with quantifiable risk assessment tools and techniques, but they are still new and imperfect. There is a significant need for improved measurement and management of cy- ber risk. The aftermaths of recent major data breaches and cyberattacks affecting organizations like Yahoo[46], Target[66], T-Mobile[20], Sony Pictures[21], and JP Morgan[29] reveal how critical it is for organizations to remain vigilant and act effec- tively in protecting against cyber incidents. Beyond the financial impact, a cyberat- tack may, for example, cause irreparable damage to a firm in the form of corporate liability, a weakened competitive position, and loss of credibility. When the potential impacts of cyber incidents reach this level of damage, corporate leaders including board members get involved[22]. In addition, attacks on critical infrastructure have resulted in physical damage to production environments, as was the case with the cyber attack on a German steel mill[22] in 2014, and energy delivery systems like pipelines and electric distribution systems. Cyber risk measurement and manage- ment are cornerstones for protection of the enterprise. However, both are addressed by multiple standards, frameworks and approaches. It is essential that improvements 14 be made to existing approaches so that cyber leaders can better measure and manage cyber risk as an end-to-end process.