Privacy Threat Model

     When creating a threat model it also becomes important to examine privacy issues.  Microsoft has updated their free threat modeling tool for 2014.  These updates include improving security and privacy weaknesses.  Privacy has become an important issue not only for individuals, but for companies who are protecting their own information as well as customer information. 

      In order to understand privacy threat models it is important to examine Solove's taxonomy of privacy harms.  The harms are not only threats, but also the impact of the threats.  To use Solove's taxonomy in a threat model one should pay close attention to personal data within the threat model.  A few recommendations on where and how to focus on finding the harms is given by Adam Shostack in his book Threat Modeling Designing for Security.  They include: data collection points on web forms; inbound data flows from external entities; where the system has in-person interaction; where data is brought together for decision making purposes; secondary use that may cross trust boundaries including those that customers may expect and in person intrusion.  By closely examining data on the threat model one may see potential privacy threats.  Understanding the key to finding privacy threats will greatly help those creating threat models.

    To gain a new perspective on creating a threat model be sure to visit Microsoft's new Threat Modeling Tool.  One advantage of this is that it no longer requires Microsoft Visio to create new threat models.  Now it can be created using the included stencil set.  For more information visit http://blogs.msdn.com/b/sdl/archive/2014/04/15/introducing-microsoft-threat-modeling-tool-2014.aspx

Shostack, A. (2014). Threat Modeling Designing for Security. BoulevardIndianapolis: Wiley.

Threat/ Vulnerability Assessment

     Companies face many different types of threats on a daily basis which range from human error to criminal threats to natural weather related threats.  To ensure that business is running smoothly, it is necessary to develop a threat or vulnerability assessment.  The purpose of these assessments are that they will help develop plans to put in place to eliminate or mitigate the potential threats.  Threat assessments can be created to focus on one specific area such as software or a facility in its entirety. 
    
     When starting a threat assessment, the first step is to identify the area or areas that need to be protected.  Once identified, those involved must evaluate potential threats.  Several different methods can be utilized; they include brainstorming, reviewing past threats and vulnerabilities, thinking like criminals or hackers and asset or software driven threats.  After these credible threats are identified they should be ranked from highest to lowest threat impact.  This will help identify which threats are more likely to occur and the severity if it were to occur so they can be prevented or mitigated.

     To mitigate threats it is important for companies to have a documented plan in place to educate employees on what steps are to be taken to mitigate the threat.   In addition to being a resource for employees the plan also serves the purpose of being continuously reviewed to ensure the plan still mitigates the threats effectively.  Should it no longer be effective, the plan should be updated.  This process is cyclical as threats may never be 100% eliminated.  The frequency of review can vary from days, weeks, months or even years.  It all depends on the asset and the time frame those involved determined the system to be reviewed. 

     While a threat or vulnerability assessment may seem like a tedious or daunting task, it is necessary.  The only way for companies mitigate potential threats is to identify them beforehand.  Should they fail to do this it could cost the company more than just a financial loss, it could damage the company's reputation.

Risk

     Every company faces risk in some shape or form.  It is up to them to decide which of these risks are acceptable and which need to be mitigated.  In today's world it is uncommon for a business to not have a website or conduct their business online.   Since we have become increasingly reliant on technology to help run our businesses, we have to address the potential threats that they pose. 

     One of the most effective ways to mitigate these risks is through threat modeling.  Threat modeling offers different methods to examine potential threats.  During the next nine weeks I will be discussing various aspects and methods for threat modeling that will help businesses mitigate potential risks. 

Risk Management

It is important for businesses to create risk management plans that are appropriate for their company.  They may look to best practices as a guide to create their risk management plans, but a cookie cutter approach does not always work.  Every business is different even if they are in the same industry.  They each have their own acceptable levels of risk and their assets are not always valued at the same level as another company. 

            The amount of money a business spends on their risk management plan also varies from company to company.  A small or large budget may be required, but how effective and well managed their risk management plan is will play a large role in the overall cost of it.  Companies that compare how much they each spend on risk management may prove to not be as helpful as some have previously believed.  It could help determine a general guideline for how much the company might need to spend, but it is not an absolute amount.  Jack Jones has given a great example on how to determine how much you should spend.  He compares it to buying car insurance.  You can get an estimate how much most people are paying, but you will not use that as your only reference.  You would want to know how much coverage you would need based on risks and assets as well as if are there enough funds to pay for it. 

            Leadership can often be left out of this equation.  If management does not believe that there is much risk despite what they have been told, the company will surely be in poor condition in regards to the risks they are taking.  Risk management should influence company policies, priorities, initiatives and actions.  If a business only has the tolerance for low risk, their decisions should reflect that.  Keeping this in mind is key to successful risk management.  It is also important to make changes to the risk management plan when necessary.  If the company cannot mitigate a risk that they previously could, they need to evaluate how it will affect the company overall and change their policies accordingly.  Keeping employees informed of risks and how their decisions can affect the company’s overall risk is also important. 

            Every business faces their own unique types of risk.  To manage their risk appropriately they must examine how much risk they face, what level of risk they can tolerate, how much they can spend to mitigate their risks and how their policies reflect their risk.  Using best practices as a guideline will help keep them on track to effectively managing their risk.  Ultimately it is up to the company to develop their own risk  management plan that is tailored to meet their needs.

References:

Jones, J. (2011). To Be FAIR About It A perspective on risk and risk management. Retrieved Oct 22, 2013, from Risk Management Insight: riskmanagementinsight.com/wp-content/uploads/2011/03/to-be-fair-about-it-v1.pdf

Last 9 Weeks

            Over the past nine weeks my previous blog posts have been over varying topics, but primarily they were about how companies need to better educate their employees about network security and how the company needs to improve network security.  Several of the blogs discussed how employers needed to educate their employees, as well as themselves, on the risks of bringing your own device to work and educating employees on how to create secure passwords and not writing them down for others to find.  Edward Snowden stealing information from the NSA proves that no matter how secure companies believe they are there is always room for improvement.  Another blog discussed the need for more collaboration between companies to share information about the types of security threats that each company faced and what they have done to prevent future threats like these.

            I chose the above-mentioned topics because I believe these are areas that most businesses and employees need education and training on.  I used a variety of sources through the past nine weeks.  I believe that this type of blog can be useful to an information security professional.  The best way to stay up to date on current trends and information is to read information in magazines, on web sites and subscribe to newsletters

How important is network security?

     The majority of companies are aware that they need to keep their networks secure.  However, there are still some out there that believe it is just an added expense. This is because they are not aware of how important network security is.  An easy way to understand how secure your company's network security should be is to consider how important is your company's information.  What would happen if your customers' information (addresses, credit card numbers, etc.) were stolen?  Would they stop being your customer?  Would they sue you?  How much would it cost to repair the security breach?  It is necessary to consider possible lost revenue from having to stop business while the security breach is fixed and also what would the actual cost be to increase network security.   Other expenses would include regulatory fines as well as possible law suits. 

     When it becomes apparent how expensive network security is when it was not adequate, companies begin to realize just how important it truly is.  To get a better idea of just how expensive it is, the average cost of a data breach is $5.5 million.  Can your business afford this for every data breach?  Not to mention an average of $3 million in lost revenue due to the breach and $1.5 million for post data breach expenses.  Is it still an unnecessary business expense?  No, and remember just because it has not effected your company does not mean that it never will.

For more information:
http://www.sys-con.com/node/2749391?goback=.gde_38412_member_262017002

Threat Intelligence Sharing

   Threat intelligence sharing is getting greater attention.  Businesses are encouraged to share the new security threats they are encountering with their peers.  This collaboration will better ensure the security of all companies that could be threatened by a similar attack.  Working together to find a solution to ending and preventing these attacks can create a more beneficial information security platform for all involved.

    The challenge of threat intelligence sharing is how to securely and effectively communicate this information with others.  Those involved must also determine how timely should this information be shared with others and will allow it to still remain effective.  The current information that has been shared is only what security threats are out there, but no solutions on how to stop these types of threats.  Smaller corporations are the ones typically struggling to find solutions to these threats and would have a greater benefit from being assisted in finding the appropriate solution. 

     What is stopping this full platform of threat intelligence sharing?  Is the competitive nature of business a part of this?  Whatever the underlying cause is that inhibits sharing information that helps all involved contributes to the failure of national intelligence sharing.  More thoughts on this topic are being discussed at the annual Black Hat conference that is occurring July 27 through August 1st.  All interested will have to continue to monitor the input generated from the conference this year to see if a coordinated effort can be configured.