Privacy and Security a Pedagogic Cybersecurity Framework a Proposal for Teaching the Organizational, Legal, and International Aspects of Cybersecurity
Total Page:16
File Type:pdf, Size:1020Kb
viewpoints DOI:10.1145/3267354 Peter Swire V˲ Carl Landwehr, Column Editor Privacy and Security A Pedagogic Cybersecurity Framework A proposal for teaching the organizational, legal, and international aspects of cybersecurity. “ EAL” CYBERSECURITY TODAY devotes enormous effort to non-code vulnerabilities and responses. The Cybersecu- rity Workforce Frameworka Rof the National Initiative for Cyberse- curity Education lists 33 specialty ar- eas for cybersecurity jobs. Ten of the specialty areas primarily involve cod- ing, but more than half primarily in- volve non-code work (15 areas, in my estimate) or are mixed (eight areas, per my assessment). This column proposes a Pedagogic Cybersecurity Framework (PCF) for categorizing and teaching the jumble of non-code yet vital cybersecurity topics. From my experience teach- ing cybersecurity to computer sci- ence and other majors at Georgia Tech, the PCF clarifies how the var- ied pieces in a multidisciplinary cy- bersecurity course fit together. The framework organizes the subjects that have not been included in tra- ditional cybersecurity courses, but instead address cybersecurity man- agement, policy, law, and interna- tional affairs. The PCF adds layers beyond the the “user layer.”b The framework pro- framework would benefit cybersecuri- traditional seven layers in the Open posed here adds three layers—layer ty students, instructors, researchers, Systems Interconnection model 8 is organizations, layer 9 is govern- and practitioners. Layers 8–10 clas- (“OSI model” or “OSI stack”). Previ- ments, and layer 10 is international. sify vulnerabilities and mitigations ous writers have acknowledged the This column explains how the new that are frequently studied by non- possibility of a layer or layers beyond computer scientists, but are also seven, most commonly calling layer 8 b Varying previous definitions of higher critical for a holistic understand- layers of the OSI Model are available at ing of the cybersecurity ecosystem by IMAGE BY UNCONVENTIONAL BY IMAGE a https://bit.ly/2McPRB3 https://en.wikipedia.org/wiki/Layer_8. computing professionals. OCTOBER 2018 | VOL. 61 | NO. 10 | COMMUNICATIONS OF THE ACM 23 viewpoints Table 1. Vulnerabilities at each layer of the expanded OSI stack. The Abstraction Layers of the OSI Model As discussed in the column, for layers 8–10, “A” refers to vulnerabilities The PCF builds on the Open Systems and risk mitigation arising within the organization or nation; “B” refers Interconnection model (OSI) stack fa- to vulnerability and risk mitigation in relation with other actors at that miliar to most computer scientists. It level; and “C” refers to other limits created by actors at that level. treats the stack primarily as a concep- Layer Vulnerability tual framework for organizing how we 1. Physical Cut the wire; stress equipment; wiretap understand computing systems, par- ticularly in the security domain. The 2. Data link Add noise or delay (threatens availability) OSI model describes abstraction layers 3. Network DNS and BGP attacks; false certificates that enable the student or practitioner 4. Transport Man in the middle to focus on where a problem may ex- ist, such as the physical, network, or 5. Session Session splicing (Firesheep); MS SMB application layer. While retaining the 6. Presentation Attacks on encryption; ASN-1 parser attack abstraction layers from the OSI model, 7. Application Malware; manual exploitation of vulnerabilities; SQL injection; buffer overflow the PCF does not emphasize the role 8. Organization A: Insider attacks; poor training or policies of the OSI model as a standardizing B: Sub-contractors with weak cybersecurity; lack of information sharing model. Instead, it broadens students’ C: Weak technical or organizational standards understanding by focusing attention 9. Government A: Laws prohibiting effective cybersecurity (for example, limits on encryption); on the critical domains that introduce weak laws for IoT or other security well-documented and well-understood B: Badly drafted cybercrime laws (for example, prohibiting security research) C: Excessive government surveillance risks from management, government, and international affairs. I provide 10. International A: Nation-state cyberattacks B: Lack of workable international agreements to limit cyberattacks supplemental materials online that C: Supranational legal rules that weaken cybersecurity further discuss the relationship of the (for example, some International Telecommunications Union proposals) PCF to the OSI model and expand other points made in this column.c As a conceptual framework for un- derstanding computer systems, the Table 2. The pedagogic cybersecurity framework. seven traditional layers apply intuitive- ly to cybersecurity risks, as discussed A: Risk Mitigation by Glenn Surman in his 2002 article Layer of the Within an Expanded OSI Organization or B: Relations with C: Other Limits Protocol “Understanding Security Using the OSI Stack Nation Other Actors from This Level Data Unit Model.”2 Surman concluded: “The most 8: Organization 8A: Internal 8B: Vulnerability 8C: Standards and Contracts critical thing you should take from this policies or plans management in limits originating paper is that for every layer there are at- of action to reduce contracts with from the private tacks being created, or attacks awaiting risk within an other entities, sector (for organization (for like vendors (for example, PCI DSS activation as a result of poor defence.” example, incident example, cyber- standard, led by Bob Blakley from Citicorp assisted with response plans). insurance). the PCI Cyber these illustrations of vulnerabilities Security Standards that exist at each of the seven layers, Council). and I have added vulnerabilities exist- 9: Government 9A: Laws that 9B: Laws that 9C: Government Laws ing at layers 8, 9, and 10. govern what an govern how limits on its individual or organizations own actions (for As a way to introduce layers 8 through organization can and individuals example, Fourth 10, each horizontal layer highlights im- or must do (for interact (for Amendment, portant types of cybersecurity vulner- example, HIPAA example, limits on illegal abilities. At layer 8, organizations face Security Rule). Computer Fraud searches). and Abuse Act). a wide range of cyber-risks, and take many actions to mitigate such risks. At 10: International 10A: Unilateral 10B: Formal 10C: Limits on Diplomacy actions by one and informal nations that layer 9, governments enact and enforce government relationship come from laws—good laws can reduce cyberse- directed at one management with other nations curity risks, while bad laws can make or more other other nations (for example, the nations (for (for example, United Nations and them worse. At layer 10, the interna- example, U.S. the Budapest international law). tional realm, no one nation can impose Cyber Command Convention’s its laws, but treaties or discussions with launching a provisions about Russia and China, for instance, may im- cyberattack on a cybercrime and hostile nation). Mutual Legal prove cybersecurity. As shown in Table Assistance). c Supplementary materials on the framework are available at https://bit.ly/2MJCrZq 24 COMMUNICATIONS OF THE ACM | OCTOBER 2018 | VOL. 61 | NO. 10 viewpoints 1, the vulnerabilities in these new layers applies to governments writing and are further organized by institutional enforcing laws about cybersecurity. form—whether the vulnerability arises I have often Layer 10 applies where there is no within the organization (or nation), encountered government to issue laws. Study of between organizations (or nations), or layer 10 thus includes both state from other institutions at that layer. practitioners and non-state actors that have In addition to categorizing vulner- (and researchers) transborder effects. abilities, the PCF builds on another In the matrix, each of the three col- aspect of the OSI model, the “protocol who believe “real” umns refines the sorts of institutions data unit,” such as bits for the physi- cybersecurity making the decisions. For each layer, cal layer, packets for the network layer, column A contains issues arising and data for the application and other involves writing code. within the institution—the organiza- top layers. These protocol data units tion or nation. Each “issue” identifies “describe the rules that control hori- cyber vulnerabilities or mitigating zontal communications,” within a sin- activities. Column B contains issues gle layer of the OSI stack.d defined by relations with other actors At layer 8, for organizations, I sug- The 3x3 Institutional Matrix at that level. Column C contains issues gest the controlling rules come from Universities have traditionally studied where other limits arise from actors at contracts. The much-cited law and eco- the three non-code layers in different the same layer of the stack. nomics scholars Jensen and Meckling departments. In general, business This three-column approach be- have defined corporations as a “nexus schools focus on managing compa- comes clearer as applied to layer 8, the of contracts.”1 Contracts are the gover- nies and other organizations. Law organizational layer. Column A in- nance structure for relations between schools are the experts in law. Inter- cludes cybersecurity activities within corporations, such as data-use agree- national relations programs study a single organization. A company (or ments between an organization and international affairs. These different other organization that