Responding to Cyber Threats in the New Reality a Shift in Paradigm Is Vital 2 Introduction
Total Page：16
File Type：pdf, Size：1020Kb
Responding to cyber threats in the new reality A shift in paradigm is vital 2 Introduction The word ‘breach’ has been used more in an information The traditional approach of focusing on feature, function technology context in the last 2 years more than it and time to market products, systems and software had ever been in the previous 20 year before that. It increasingly incorporates security controls as a core is estimated that 1 billion records were compromised design principle. The need to look at the data, correlate in 2014 (Gelmato, 2015) and at the cost of per it and automate responses through the use of machine compromise estimated to be between 52 to 87 US learning and a radical redesign of the foundation dollars (Verizon, 2015), the impact of these bridges of our systems is key. Managing cyber risks and to the global economy is alarmingly large. Further, a opportunities starts with recognising and understanding Verizon report highlighted that “organised crime became the importance of digital assets. While financial risk is the most frequently seen threat actor for Web App important, cyber risk poses a real threat to performance Attacks”, raising the concern that cybercriminal attacks and survival because most major organisations are now are becoming more organised and systemic. technology-driven, and therefore vulnerable. In a hyperconnected world, the ability to adequately In this changing landscape, a shift must take place to protect data and information has been touted as an adequately combat the challenge. The old approach important component of risk management for a very has failed many organizations and cost the world long time by renowned security advocates like Bruce billions of dollars. While we expect that advancements Schneier. However, with the instances continuing to rise, in technology will continue to disrupt the way we it seems that matters have taken a turn for the worse approach cyber risk, the objectives and principles since Schneier first voiced his concerns some thirty identified in this paper attempt to provide the basis of years ago. The challenge has been exacerbated by the the mitigation model that is still evolving – and must realization of Moores’ law, the size of the opportunities continue to do so. that exist, and the Goliath’s state of our security infrastructure. These mitigations are explored in the proposed Deloitte Cyber Security 3.0 model. The ability to combat cyber risk effectively is especially important for a country like Singapore, as it is one of the most networked and electronically connected societies in the world. Singapore’s success singles it out to experience an increased level of threats as it progress towards its ambitions of being a SMART Nation. This thrust necessitates an even greater focus on the protection of digital assets. Organisations, both private and public, have a responsibility to ensure that they protect the value of their digital assets - including data, information, applications, and networks that exist within and beyond their premises, including the information that extends out through suppliers, vendors and other partners, and resides in employees’ mobile devices 3 The new reality Cyber of global concerns Cyber in Singapore Recently, the President of the United States, Mr. Barack As Singapore celebrates 50 years of independence in Obama, signaled online security are a priority for his 2015, it positions itself as a SMART city and a SMART administration in 2015, labelling it an “urgent and nation within the context of its standing as a global growing danger” for Americans (Martin, 2015). He went citizen. further to cite the Sony hacking incident which revealed details of 50,000 employees as evidence of the link In 2014, Mr. Lee Hsien Loong, the Prime Minister of between personal data protection and the need for new Singapore, pointed to cyber security as an important cyber security laws (2015). At the same time Mr. Tony aspect of Singapore’s SMART Nation ambition. He Abbott, the Prime Minister of Australia, was quoted said “We are putting more and more functions and as having conceded the Australian review of the 2009 data into our computers, handphones, network and strategy is “long overdue” and necessary for the nation systems. Often they know more about us than we to stay “a step ahead of our antagonists.” remember about ourselves. It is vital that we have secure systems that we can trust, not just preventing There are many studies on the future and world mega- credit card numbers from being stolen, but protecting trends to 2020. These mega-trends include SMART ourselves from malicious attacks where there is hacking technologies which interact more seamlessly with human or Distributed Denial of Service attacks, you know lives, SMART Cities and infrastructure, energy changes, what that is. Whether is it malware that infects our e-Mobility, new business models, and fundamental computers which steals sensitive information or possibly demographic changes brought about by societal threatens critical infrastructure if it gets into the hospital changes and advances in health and wellness and the IT systems, patients can die, if it gets into our power increasing ageing population. system, our power grid can be brought down, if it gets into our airport system, we can have a very serious While technology has been a key enabler to better and problem.” Such concerns are voiced elsewhere by world more productive living, it does bring its fair share of leaders and this is becoming a pandemic which needs to challenges as increasingly sophisticated cyber threats be addressed seriously. become a key concern in this connected world. A recent report released by Fire-Eye suggested that hackers, most In the face of some of the hacking and cyber incidents likely from China, have been spying on government in the recent past, the Singapore government and business targets in the region for over a decade launched the Cyber Security Agency (CSA) to better (Hamzah, 2015). Such threats which are less known in coordinate national efforts against cyber-threats and the past have made way in headlines in recent years to bring about a “whole of government” approach and months, a stark reminder of the cyber threats in towards cybersecurity strategy, outreach and industry this global connected community. Zaid Hamzah, a developments (Hamzah, 2015). The agency chief cyber-security legal strategist, quoted Gartner predicting reports directly to the Prime Minister’s office to mark that more than 25% of global firms will adopt big data its importance. In addition, the strategically launched analytics for at least one security and fraud detection Interpol Global Complex for Innovation (IGCI) in case, up from 8% currently. The issue is best summarised Singapore to fight international cyber-crime marked by the quote that “Every CIO and CISO wakes up each a major milestone by both Singapore and the global day knowing that if they don’t get security right and community to combat cyber-threats. These examples breaches are suffered, their program can be perceived to show the government’s ongoing responses to boost be ineffective, and their citizens may suffer direct harm.” efforts in tackling the new and emerging crimes in Asia (Decker, 2012) Pacific and around the world. 4 Cyber trends and the future model Megatrends of cyber security Despite efforts from organizations these attacks show no Since 2010 the world has seen a significant increase sign of slowing down. The level of sophistication and the in cyber-attacks across the globe, as the level of capabilities of the perpetrators continue to grow: data sophistication of cybercriminals has progressed in has shown that the combined power of an insider threat tandem with that of Moore’s law and the threats that allied to organized crime is most dangerous. they pose to targeting organizations is no longer random in nature. To effectively tackle these issues requires an Figure 1 is a graphical illustration of Threat Actors and understanding of the actors, their level of sophistication Attacker Determination. The participants use a variety and their determination: of techniques to achieve their end objectives as shown in Figure 2 which summarises the techniques and the vulnerabilities that the threat actors focus on. The root cause from studying the corporate challenges is the attitude that we adopt in addressing the issue. Each of the challenges is usually addressed individually instead of abstracting them to uncover that there is a fundamental flaw. The silo approach to “fix it” has also caused a deterioration in the way incidents are being managed thus, to use the common idiom, meaning that often we miss the forest for the trees. Figure 1. Threat Actors State-sponsored Cyber Warfare Disgruntled ex-IT Administrator Organised Crime Lone Hacker/ Competitor Hacker Hobbyist Collectives Malware Business Disgruntled Cyber Partner Customer Terrorism Attacker Sophistication Attacker Accidental Disgruntled Insider ‘Script kiddy’ Discovery ex-Employee ‘Hacktivism’ Attacker Determination 5 Figure 2. Summary of techniques and vulnerabilities focused by threat actions Who are the actors? Nation-state actors Ideological groups Organised crime Individuals Malware Hosting Payment Domain Command & Money How do they function? authors entities processors generators control mules Social Website Botnets Ransomware Password What techniques do engineering & doxxing compromise theft they use? Evasion Phishing Exploits DDoS tactics How do they get in to your environment? Suppliers & Employees Mobile Smart Customers Email partners devices devices IT COMPLEXITY SECURITY OPERATIONS PROCESS /GOVERNANCE • Endpoint diversity • Signature-based controls • Shadow IT How do they exploit • Rogue devices • Data encryption • Change/asset management corporate challenges? • Shadow users • Device-focused monitoring • Secure SDLC • Business innovation/ change • Insufficient skills/staffing • Business risk alignment • Third party entities • Risk-asset mapping What potential impact Fraud or Reputation Threat to Operational Data loss IP theft can they cause? revenue loss damage life or safety disruption We must understand that hackers are only one element of the cyber enterprise.