A Taxonomy of Loss

Article Index

Page 3 of 5

Types of Loss

A security breach doesn’t have to mean something stolen; any type of action that reduces the value of a computer system can be seen as a loss.

Considering different types of loss leads to a better understanding of the potential problems which a computer system can present for an organization.

Theft

Hardware can be stolen (laptop computers are a favourite), software pirated, data such as customer information copied (including credit card details), networks and communications systems misused by internal or external people for nefarious ends.

Corruption

Software can be modified to subvert systems policies, data can be intercepted and corrupted during network transmission or forged to appear to come from a different source.

Denial

Attacking any of the sub-systems can compromise access to the computer system.

Liability

You may be held responsible for any misuse of your computer systems. This can range from access to inappropriate web content by staff to an attacker using your systems to attack a third party.

Fixed Defences

In addition to physical defences such as locked or isolated computer rooms, many organizations adopt sound basic security measures to protect their investments.

These basic strategies are not always sufficient.

Basic security processes

User authentication

As a first step, all access to internal computer systems should require authentication by at least an account code and password.

Acceptable use policies

Written guidelines covering the use of internal and external computer systems including web browsing, email use.

Firewall

A properly configured firewall can control the types of traffic allowed between the internal network, public interfaces (such as the organizations own web and email servers) and the internet.

Virus protection

On workstations and servers to prevent known virus programs from damaging files or spreading to other systems.

Backup cycle

A recent, verified backup is essential is any recovery operation.

All of these elements can be characterised as fixed defences and suffer from the inadequacies of fixed defences throughout history. The Great Wall of China, the Maginot Line and the Berlin Wall were each seen as a total security solution; this proved to be overly optimistic.

Problems with fixed defence strategies

Using the historical analogy of a defensive wall we can draw comparisons with computer system defences.

Imperfections in the Defence

Walls cannot defend against all attacks; they can be undermined with tunnels, knocked down, scaled and avoided.

Virus protection software cannot protect against new viruses, firewalls cannot protect against internal attacks or attacks using allowed traffic types.

Inadequate Maintenance

Maintaining a large defensive wall is very expensive; the supply chain requirements are enormous and there is a great temptation to regard the mere presence of the wall as sufficient defence. Attackers have the ability to choose their point and time of attack; defenders have to be ready for anything.

Computer systems evolve, new weaknesses are discovered and new applications are deployed. Maintaining strong security in the face of competing budgetary requirements and a dynamic business environment is difficult at best and perhaps impossible without the commitment of the organization’s senior management.

The Need for Commerce

Even the highest and strongest walls need gates. The requirements of trade and communications means that a wall is never as solid as you might wish.

Computer systems serve the needs of the organization. The power and potential of the connected world requires the free flow of some information between systems. It is difficult to determine legitimate traffic from some intrusion attempts.

Insider Assisted Attacks

A border is a political fiction; in practice the people of each side of the wall often have more in common with each other than with their respective rulers and actively work together to by-pass the interference of the troops supposed to be defending them against each other.

Various studies suggest that 60-80% of computer system security breaches involve someone from within the organization. External attacks are a real threat but ignoring the problems of internal security is a serious mistake.

Search Tags

documentation  software  analysis  owncloud  implementation  email  psychology  office  security  testing  joomla  website  browser  wireless  process  audit  programming  moodle  vba  open source

Features Articles

A Taxonomy of Loss

The widespread commercial use of the internet has led to an increasing focus on systems security. Media driven hype and a lack of independent information can make the true level of threat to an organization difficult to determine. Adopting a structured approach to the analysis of computer system security risks and allows an organization to more effectively balance their operational requirements against the potential for loss, whether that loss involves physical equipment, information or reputation.

This article discusses the components of a computer system, the types of attack to which they are exposed, some typical defence mechanisms and some weaknesses in the standard defences. The information and concepts shown can form a starting point for the development of suitable security and operational strategies to assist organizations to obtain the maximum value from their investments in computer systems.

Network Security

External Network Scanning

One of the core mechanisms for protecting networks is to install a firewall to mediate traffic between systems on the internal network, publicly accessible systems is a DMZ (from the military term demilitarised zone) and the internet.

Documentation

It might be the last thing you want to read, but not having a well documented IT infrastructure (servers and networks) can lead to surprising events like critical systems running on unsupported servers.

Documentation must not only be accurate at the time it was created it should also meet these additional criteria:

  • Available The people who need the information must be able to get at it.
  • Editable Any documentation in the IT industry is quickly out of date, so it is essential that information is able to be correctly updated as soon as a change is required. Ideally the client or end-user should be able to do this, rather than waiting on the 'approved editor'.
  • Current 'Out of date' is just a nice way of saying 'wrong'. The date on which the underlying information was updated should be shown on any reports either printed or viewed online.

Beyond the Blackboard

Considerations when designing or specifying an on‑line learning environment.

For many organisations, the provision of training to staff and customer represents a significant cost. As the processing power and network bandwidth available to desktop PCs increases, the performance and features of on‑line learning systems have improved to the point where the delivery of training via a computer has become a viable option.

While on‑line learning is not an appropriate solution for all training needs, it does provide an effective training delivery mechanism in the right circumstances.

This article discusses some of the issues involved in creating an on‑line learning environment, viewed from the perspective of the different interest groups involved. The information and concepts shown here are not definitive; you should carefully consider your own specific requirements before implementing any computer system.

Online surveys

How do you know what your customers want? Perhaps you should ask them.

Surveying your internal or external customers gives you hard information on which to base decisions about product development, marketing campaigns, resourcing or any other area where you organisation or department interacts with another group (which means in nearly everything you do).

Open Source

You shouldn't be using open source software because it's cheaper (although it is), you should be using it because of its features and flexibility and the fact that it doesn't lock you in to restrictive license agreements.

Latest blog posts

"Give a man a fish and you feed him for a day; teach him to use the Net and he won't bother you for weeks."
unknown

IP:3.15.239.145

FacebookTwitterLinkedinRSS Feed

Hosted at Panthur web hosting.

© Dropbear Consulting Pty Limited
Privacy policy