Atos wp-cyberrisks
2 likes1,007 views
The document provides an overview of cyber risks and proposes a governance framework to manage those risks. It defines key concepts like cyber, security, threats and governance. It then presents a meta-model and framework with four core concepts: risks, response, reputation and resources that revolve around an organization's cyber ecosystem. The framework is intended to provide high-level guidance for executives on continuously governing cyber risks through a strategic approach.
Atos wp-cyberrisks
- 1. White paper C cyber risks towards a governance framework Your business technologists. Powering progress
- 2. Contents Authors Dr. A. Shahim RE Atos Consulting Netherlands VU University Amsterdam Dr. R. S. Batenburg Institute of Information and Computing Science Utrecht University J. Geusebroek MSc Institute of Information and Computing Science Utrecht University Drs. R.J.A.C. Jansen RO Atos Consulting Netherlands 1. Introduction 3 2. Cyber and accompanying risks 4 3. A governance framework for cyber risks 7 2.1 Security concepts 2.2 Cyber threats 2.3 Cyber governance & strategy 3.1 3.2 3.3 3.4 The meta-model The framework Practical use - Bring Your Own Device (BYOD) Continuous approach 4. Concluding remarks 4 5 6 7 7 8 9 10 References 11 2 Cyber risks towards a governance framework
- 3. 1. Introduction1 All contemporary organizations face an increasing dependency on Information Technology (IT) systems for executing and supporting their business processes. Emerging technologies are creating a rapidly evolving cyber landscape that results in rapidly outdating solutions. Modern technologies provide organizations with unprecedented scalable and financially attractive capabilities, but the lack of knowledge regarding these new and complex innovations poses potential problems. Stakeholders (e.g. employees, suppliers) can access data whenever, wherever and however at their personal convenience. Although this possibility is a likeable benefit for stakeholders, it also creates a borderless and complicated digital environment which is of a great concern to organizations. These emerging developments create new threats such as theft of corporate and/or personal data and malicious attacks, and enable peculiar ways to commit organized crime (IT Governance Institute, 2007). Vulnerabilities in IT systems pave the road for the intruders to gain access to information without authorization. These adversaries are nowadays characterized by covert and persistent attack vectors; they act anonymously, are invisibly present and in worst case are detected when it is too late and the damage is done. The use of only a computer connected to the Internet anywhere in the world and the anonymity provide an easy access platform for malicious activities as a cornerstone for lucrative business models. The usage of sophisticated malware, Denial of Service (DoS) attacks, the always present vulnerabilities of IT assets and careless mistakes within organizations facilitate these activities. Hackers tend to be creative and crafty in exploiting this employing logic and innovation to stay ahead of their victims. Security awareness in organizations is an important prerequisite for understanding potential threats in their Cyber Ecosystem. However, thorough cyber risk assessments do not seem to be part of day-to-day business activities. It is simply characterized as bothersome and difficult and not directly financially beneficial. Mostly it is seen as requiring financial investments, time and resources and is hence an attractive first target for budget cuts in organizations. This line of thinking often leads to complacency and even negligence with all its potentially adverse consequences. Securing IT systems and information processing is a pervasive concern of organizations. The confidentiality, integrity and availability of data depend on important sources that support business activities, often characterized as critical assets. In a growing number of organizations information is the business (IT Governance Institute, 2006). Breaches in cyber security have resulted in misuse of information that could harm organizations by affecting their financial assets, reputation and other interests. It is therefore vitally important to understand current threats and to develop and maintain a comprehensive overview of an organizationโs threat landscape. A focused cyber risk approach as well as an integrated view to adequately identify and mitigate potential cyber related risks are essential elements of the organizationโs defensive capabilities. 1 This white paper is an extraction of a detailed report resulted from a research jointly conducted by Atos Consulting, VU University Amsterdam and Utrecht University. Cyber risks towards a governance framework 3
- 4. 2. Cyber and accompanying risks In the past decade the concept โcyberโ has been used frequently to describe almost anything in relation with networks and computers (Ottis & Lorents, 2010). It is a common prefix for new terms such as cyber warfare, cyber-attacks or cyber terrorism. The concept โcyberโ has an early history and originates from the term โcyberneticsโ by Wiener (1948). Later on it transformed to the term โcyberspaceโ, which is nowadays more widely and common used. In this white paper the concept of cyber is an abbreviation for the term cyberspace. As there is still much debate on the exact description of this term (Information Security Forum, 2011), an overview of different definitions is provided in table 1 to establish a common body of knowledge: Table 1. Various definitions of cyberspace Literature source Definition Ottis & Lorents (2010) โCyberspace is a time-dependent set of interconnected information systems and the human users that interact with these systems.โ Bodeau, Boyle, FabiusGreene, & Graubart (2010) โThe collection of information and communications technology (ICT) infrastructures, applications, and devices on which the organization, enterprise, or mission depends, typically including the Internet, telecommunications networks, computer systems, personal devices, and (when networked with other ICT) embedded sensors, processors, and controllers.โ Department of Homeland Security (2011) โThe interdependent network of information and communications technology infrastructures, including the Internet, telecommunications networks, computer systems and networks, and embedded processors and controllers in facilities and industries.โ Information Security Forum (2011) โCyberspace is the always-on, technologically interconnected world; it consists of people, organizations, information and technology.โ Risks related to cyber evolved quickly over the past decades. Security breaches can be mentioned as common examples that potentially cause unprecedented damage to vital assets of organizations. Figure 1 illustrates a holistic and integrated governance view on the cyber landscape, based upon a model provided by Betz (2011). It includes three pillars each of which reflects a part of this challenging and ever changing environment. The processes pillar (i.e. the first one) defines the logic layer which represents the way of thinking and reasoning of activities. These processes highly rely on IT by which they are also connected to large networks of organizations. The information (i.e. the second pillar) is generated by the processes and is further handled by applications of different nature. This crucial asset in fact acts as the blood running through the veins (processes) of organizations to keep them alive. IT infrastructure (i.e. the third and last pillar) serves as a foundation for these capabilities and amongst other things facilitates the flow of information enabled by applications supporting business processes. Figure 1. Integrated cyber governance view 2.1 Security concepts Different concepts regarding security as schematized in figure 2 are congregating in cyber: information security, cyber security and cyber resilience. The Information Security Forum (ISF) distinguishes between these concepts by using confidentiality, integrity and availability (CIA) of organizational assets. Threats in cyber are directly influencing these three main objectives of information security. With securing cyber one should also address additional threats which are far beyond CIA, the so-called non-CIA. Examples are reputational damage due to a breakdown of IT assets or an unintended impact from data leakage. Cyber resilience stands for preparing for the unknown, unpredictable, uncertain and unexpected. The complexity of cyber enables threats to develop quickly in unpredictable and dangerous ways. Uncertainty cannot be prevented and should indeed be embraced through cyber resilient business operations. Organizations increasingly understand that the rapid evolution of cyber is outpacing risk management practices in organizations. Managing security risks is a comprehensive task at hand and requires agility and flexibility. CYBER GOVERNANCE PROCESSES INFORMATION TECHNOLOGY LOGIC 4 Vulnerabilities in one or in a combination of these interconnected pillars can be targeted by malicious attacks possibly leading to harm or damage. In general, technology is usually the premise in each of the definitions with respect to cyber, however, it is not limited to it. Cyber possesses unique characteristics with pivotal elements such as humans. These features together make it challenging, complex and constantly changing that plainly creates an unpredictable environment. Cyber is the reality of our modern life and is increasingly woven into the everyday life across the globe. It is certainly there to stay. APPLICATION INFRASTRUCTURE Cyber risks towards a governance framework
- 5. ICTABLE, UNCER RED TA NP IN, ,U UN N EX OW N OWN NON-CIA KN Table 2 - Cyber threat overview Threat INFORMATION SECURITY CYBER SECURITY CYBER RESILIENCE 2.2 Cyber Threats Threats in cyber can be found practically everywhere and are somehow always present. Threats can originate internally, for instance from personnel due to accidents or poor practice, or externally from unwanted adversaries. In general, a threat is a category of objects, persons, or other entities that presents a danger to an asset. A cyber threat is a potential event that may cause undesired outcomes resulting in harm to organizational assets. It should be noted that there is a difference between purposeful and undirected threats. A purposeful threat is a preconceived goal such as extracting valuable information by a hacker from an organization. An undirected threat is, for example, a (natural) disaster such as fire threatening to affect physical components of IT infrastructures. This distinction of threats can unconsciously be extended by vulnerabilities of an organization itself. Due to improperly managed practices, careless mistakes or by human failure or accidents, cyber threats are more likely to materialize. Table 2 provides a global overview of possible threats to organizations that are categorized based on figure 1. Cyber risks towards a governance framework Technology For instance mistakes or accidents made by employees regarding their duties. Usage of outdated software, bugs or code problems. Espionage Unauthorized data collection and/or access compromising Intellectual Property. Blackmailing an organization to gather information. Natural disasters Natural threats which directly threaten the physical components of the IT infrastructure (e.g. floods, fire, earthquakes or lightning). Force majeure Information Human failure Extortion of information OWN CIA KN Description Negligent errors Processes ED CT PE UN K Figure 2. Positioning concepts based upon ISF (2011) Dependency on third parties such as Internet Service Providers (ISPโs) which can possibly affect the availability of concerned technology. There are obviously many types of threats. When focusing on purposeful threats, the World Economic Forum (2012) categorized four different types of cyber-attacks. The first category is reconnaissance, gaining information from victims to plan a further attack. The second category is disruption for breakdown of business, system or service. Third category is extraction for extracting data from the victim. The fourth and last category is manipulation or mutation of data or systems. CACI (2011) defines a cyber-attack as: โGenerally an act that uses computer code to disrupt computer processing or steal data, often by exploiting software or hardware vulnerability or a weakness in security practices. Results include disrupting the reliability of equipment, the integrity of data, and the confidentiality of communicationsโ. 5
- 6. The covert nature of threats brings possible underestimation of the risks faced. The prediction and understanding of cyberspace in the future is difficult due to the rate of new innovations and changes. New risks and vulnerabilities emerge suddenly. Responses and defenses look slow and inadequate due to the pace of events. Cyberspace is a complex environment; global in nature, largely commercially owned and consisting of many different components, suppliers and sub-contractors. Supporting the primary tasks of organizations and governments by creating a safe and secure cyberspace is a clear and well defined integrated strategy. IT nowadays is an indispensable part of many organizations and has hence been integrated with Enterprise Risk Management (ERM) or larger security strategies within and beyond organizations (Bodeau et al., 2010). As cyber security is more than information security, achieving an enterprise-wide cyber risk strategy consists of different concepts. They should be taken into consideration while defining the strategy, which is logically specific for most organizations. They face different threats and have their own culture upon which the strategy should be constructed and executed. 6 CT STRATEGIC L RO NT CO The growing use, adoption and dependency on (new and continuously evolving) IT assets contribute to a dynamic and complex environment, introducing a variety of challenges. Some examples of these issues and concerns are listed below (The Cabinet Office, 2011): Figure 3. Corporate governance view (Von Solms & Von Solms, 2006) DI RE 2.3 Cyber Governance & Strategy TACTICAL DIRECTIVES POLICIES/ COMPANY STANDARDS OPERATIONAL PROCEDURES EXECUTION The Department of Homeland Security (2011) for example used a multi-staged methodology to develop a cyber security strategy. Below, the main phases of this methodology are mentioned: 1. Assessment โ of the current and future strategic environment through analysis of key trends associated with cyber and cyber security; 2. Examination โ of current policy, strategy, programs and resources across cyber security activities; 3. Identification โ of key assumptions (including associated policy implications); 4. Consideration โ of alternative strategic concepts (achieve desired end states efficiently and effectively). Dealing with cyber risks seems self-explanatory as they affect all levels of an organization. Mitigating activities should thus be governed continuously, consistently and correctly. Governance is in general a set of responsibilities and practices exercised by top executives providing strategic direction. This crucial task should be done in such a way that the set objectives are reached, verifying that organizational resources are used responsibly and risks are managed appropriately. Figure 3 (model based upon the Direct-Control cycle by Von Solms & Von Solms, 2006) provides a governance overview showing that the layers of an organization (strategic, tactical and operational) are involved in governing the strategic goals and directives. Cyber risk governance accordingly requires an integrated approach and should be a transparent part of the corporate governance structure of an organization. Cyber risks towards a governance framework
- 7. 3. A governance framework for cyber risks The previous section described challenges and risks which call for an adequate governance. They can be perceived as focus areas applied as input for constructing a framework useful for top executives. It contains a meta-model and includes a structure with multiple components for organizational activities and explanatory content. The framework is an auxiliary instrument which provides high level guidelines for any organization dealing with Cyber risks. This chapter discusses the designed framework in a top down fashion by starting with the metamodel which provides a high level overview of this structure to support governing risks. It is subsequently presented in combination with a strategic approach. 3.1 The meta-model A meta-model including a set of interlinked topics is developed with the aim to provide simplicity and overview of the cyber risk governance framework. The directives (strategy) encapsulate four main concepts: risks, reputation, response and resources. They are supported by policies and processes, to protect the organization in its cyber ecosystem which is positioned in the center of the model. Another characteristic depicted at the top of the meta-model displayed in figure 4 is the possibility of multiple governance structures beyond the concerned organizational context. IT outsourcing for instance implies the adaption of (multiple) governance structures of third parties which are beyond (direct) control of the organization. Depending on (parts of) the governance of other organizations, a combined governance structure along the supply chain can be enabled. When this possible situation occurs, it is clear that organizations should then conduct a dependency analysis with all stakeholders to comprehensively manage risks, given these interdependencies. They influence or determine an organizationโs risk profile in its cyber ecosystem. Risks and response are positioned on the opposite side of each other. Risks directly influence an organizationโs posture as well does the response mitigating possible unwanted consequences of risks. A secure cyber ecosystem and an effective response against cyber related risks depend on sufficient funding and resources. The response to cyber risks and the establishment of a secure cyber ecosystem contribute to an organizationโs ability to secure its reputation and assets. Table 3 shows an overview of all the individual characteristics related to the core concepts of the framework. 3.2 The framework The meta-model (figure 4) serves as the foundation for the governance framework. Figure 5 depicts the designed framework where the indicated core concepts (i.e. risks, resources, response and reputation) continuously revolve around cyber and its interrelated governance aspects. Figure 5. The framework TINUOUS STRATEGY CON RISKS Figure 4. The meta-model DIRECTIVES Threats Vulnerabilities RISKS CYBER DIRECTIVES RISKS CYBER PR O C ESSES RESPONSE DIRECTIVES D IR E C TI V E S REPUTATION RESOURCES C POLI IES CYBER Processes Information Technology a orm Inf T sabotage I RESPONSE D IR E C TI V E S Fundin g IT resour ces O CESSES RESOUR CES PR SSETS ION & A TAT PU RE tion theft REPUTATION RESOURCES C POLI IES RISKS CYBER PR REPUTATION RESOURCES POLICIES Ap g t A e c ri n pr ware D et ne oa c h - n e s s - A s s e s s - - Pa r t Responsibilities R E S P O NSE O CESSES RESPONSE CON TINUOUS STRATEGY DI R E C T I V E S Cyber risks towards a governance framework 7
- 8. Table 3 - Cyber risk governance framework description Core concepts Sub concepts Description Risks Threats Threats emerging from the cyber risk landscape which threaten business reputation and assets. Vulnerabilities Possible vulnerabilities of an organization reinforcing and nurturing threat potential. Information theft The organization provides an adequate response to reduce the possibility of information theft. IT Sabotage Organizational assets might be targeted by adversaries able to perform different forms of deliberate destruction. Awareness The organization is aware of the potential risks that it faces in correlation with possible painful consequences. Assess Assessment of the governance strategy is continuously executed to ensure the adequate protection of the organization against cyber risks. Detect Risks are adequately detected which is followed by an effective approach for countering them. Approach Organizational approach for mitigation and minimizing the consequences of a direct threat. Responsibilities Cyber risk governance strategy tasks are delegated to the designated employees as a result of which they are formally responsible for this crucially defined piece of work. Partnering Sharing information with partners to jointly mitigate the risk of cyber threats. Funding Employees possess the right skills and proper knowledge to prevent incidents or possible wrong performance. They are supported by organizational resources to receive time and space for carrying out their operational tasks. The organization invests in its cyber risk governance programme by creating organizational awareness, welcoming suitable knowledge and supplying sufficient resources to execute the necessary activities. IT Resources Technical resources needed to build and maintain a safe and secure cyber ecosystem. Reputation & Assets Response Resources 3.3 Practical use โ Bring Your Own Device (BYOD) The meta-model (figure 4) and the framework (figure 5) illustrate an executive auxiliary tool for top executives to enable a cyber risk governance strategy in the organization. This model provides guidelines which support organizations in assessing the situation and incorporating the right strategy and necessary processes. They are naturally free to establish their own strategy, policies, procedures and processes given the framework for governing their cyber risk landscape and implementing their own organizational structure and culture. BYOD is one of the recent developments with which organizations allow employees to user their own laptop and smart-phone to connect to the business IT domain. It is a concept that contributes to an adaptive and mobile workplace. Nonetheless, BYOD enables a new way of working and also introduces IT related risks which should seriously be dealt with. If an organization decides to apply this concept, the framework can be helpful to fabricate a top down view. It starts with the construction of a strategic plan for implementing BYOD in the organization. Defining clear objectives (e.g. only peripherals can have access after a secured authentication process, followed by an encrypted and secured connection) followed by an assessment (what are the possibilities for employees in the current state and what in the desired state?) lead to an approach for implementing the strategy within the organization. In this case for example: which employees are involved and what are the responsibilities for reaching this goal? If the strategy is defined and incorporated in the business processes, its actual implementation on lower levels in the organization can be started. This act initiates the use of the risk governance framework depicted in figure 5. 8 Cyber risks towards a governance framework
- 9. The strategy is translated into organizational policies and processes which support the activities on operational level for the core concepts as defined: risks, resources, response and reputation. Table 4 provides an overview for translating the different concepts to the implementation of BYOD in the organization. Table 4- Example case BYOD BYOD implementation โ Risk governance framework (high level overview) Core concepts Sub concepts Description Risks Threats Identify the threats directly related to the use of BYOD. Vulnerabilities Identify the vulnerabilities which are introduced with BYOD. Organizations have less control over the devices, thus also over the vulnerabilities. Information theft What kind of company confidential information is at risk because of the introduction of BYOD? What if an employee lost his device? IT Sabotage How could adversaries affect the organization by sabotaging BYOD devices in use by employees? Awareness The organization should be aware of the risks related to BYOD. Complete security cannot be guaranteed so continuous awareness should be ensured. Assess Continuously assess the situation. Is a necessary security baseline in place for BYOD? Are there new developments? Detect If there is something wrong with any device in use, detection should display any illegal access or strange behavior. Approach 3.4 Continuous approach Maintaining a continuous approach is an important component of cyber risk governance as it is surely not a one time achievement. A top down approach implies developing a strategy that translates into policies and processes for the guidelines set in the framework (figure 5). These parts are interrelated and cover an equal motion of turning gears (figure 6). The turning speed on operational level is considerably higher in comparison with the strategic and tactical level. A strategy could evidently have a longer expiration date in comparison with activities on operational level. If there is an incident an effective approach needs to be in place and effectuated (e.g. if an employee loses a smartphone or laptop it should be remotely blocked). Reputation & Assets Response Responsibilities Partnering Resources Employees are responsible for the secure use of their peripherals on the network. The IT department is responsible for a secure and well organized environment. How are BYOD responsibilities assigned in case third parties are involved? Use available best practices for implementing BYOD, what are lessons learned which can be reused? Funding Figure 6. The framework in motion STRATEGIC TACTICAL OPERATIONAL Employees should be professionally trained and educated to gain the right knowledge and skills to securely work with BYOD. IT Resources Figure 6 visualizes a top-down motion starting from strategy downwards via the different levels. However, sudden developments on an operational level can initiate a reversed motion in the framework. New threats can emerge or existing policies may not be sufficient to define an effective response against risk which is incurred at operational level. This new knowledge could possibly influence the existing policies and strategy of an organization. The knowledge gained on operational level can possibly initiate a bottom-up approach as well that in turn affects the existing policies and strategy. Sufficient technical resources are needed to protect the devices in use against possible risks. Cyber risks towards a governance framework 9
- 10. 4. Concluding remarks The development of this governance framework once more demonstrated the insight that the cyber risk landscape is a complex, dynamic and unpredictable environment. We hence deliberately chose not to focus on developing a โone size fits allโ solution, but a governance framework that contains a set of guidelines for organizations to govern their cyber risk strategy. Establishing a cohesive governance approach for protecting organizational assets asks for a comprehensive and integrated approach with specific and customized protective measures, which are possible to incorporate in the different aspects of the framework. One of the benefits of the chosen set-up is that organizations do not have to adopt new methodologies or approaches to their risk governance practices. Instead, this configuration provides an additional aid in creating a future-proof and robust approach which copes with the continuously changing nature of cyber risks. Additionally it is important to stress the importance of the collaboration with partners in your organizationโs cyber ecosystem. These (public and private) organizations also deal with the specifics of their cyber threat landscape, but creating a cyber resilient posture throughout the complete ecosystem requires extensive as well as measurable communication and collaboration. Alignment of cyber risk management practices and sharing lessons learned is an important prerequisite for building a secure industrial digital environment. This is the reason we specifically incorporated this aspect into the governance framework, so organizations actually stretch out to their ecosystem to realize collaborative cyber situational awareness. 10 Last but not least we gladly emphasize one final cornerstone for a successful cyber risk governance implementation: an organizationโs benevolence to invest and attention for the human factor. For decades security and risk management practitioners have dealt with difficulties showing the contribution to business value and caught in discussions around the business case and investment incentives. Hopefully nowadays organizations realize that the implementation of a governance framework for cyber risks is an absolute must, given the โalways onโ nature of our digital society. In addition to such a framework it is important to realize the critical contribution of the professionals with the specific knowledge to perform this daunting task. It is well known that skilled resources are hard to find, and university programmes across the globe are investing in cyber security programmes to keep up with the market demand. This cyber workforce might in fact be the most important success factor, combined with executive management support for these activities of course. Cyber risks towards a governance framework
- 11. References Betz, C. T. (2011). Architecture and Patterns for IT Service Management, Resource Planning, and Governance. Elsevier. Bodeau, D., Boyle, S., Fabius-Greene, J., & Graubart, R. (2010, September). Cyber security governance. Mitre. CACI. (2011). Cyber Threats to National Security. Department of Homeland Security. (2011, September). Blueprint for a secure cyber future. Retrieved February 1, 2012, from http://www.dhs.gov/files/ publications/blueprint-for-a-secure-cyber-future.shtm. Information Security Forum. (2011). Cyber Security Strategies: Achieving cyber resilience. Retrieved from https://www.securityforum.org/downloads/ documentview/5901. IT Governance Institute. (2006). Information Security Governance: Guidance for Boards of Directors and Executive Management 2nd Ed. (2nd ed.). IT Governance Institute. (2007). COBIT Security Baseline: An Information Survival Kit, 2nd Edition. Ottis, R., & Lorents, P. (2010). Cyberspace: Definition and Implications. Presented at the Proceedings of the 5th International Conference on Information Warfare and Security, Dayton. The Cabinet Office. (2011, November 25). The UK Cyber Security Strategy. Retrieved from http://www.cabinetoffice.gov.uk/resource-library/cyber-security-strategy. The World Economic Forum. (2012). Partnering for Cyber Resilience. Von Solms, B., & Von Solms, R. (2005). From information security toโฆbusiness security? Computers & Security, 24(4), 271โ273. doi:10.1016/j. cose.2005.04.004. Wiener, N. (1948). Cybernetics or Control and Communication in the Animal and the Machine. New York: John Wiley. Cyber risks towards a governance framework 11
- 12. About Atos Atos is an international information technology services company with annual 2012 revenue of EUR 8.8 billion and 76,400 employees in 47 countries. Serving a global client base, it delivers hi-tech transactional services, consulting and technology services, systems integration and managed services. With its deep technology expertise and industry knowledge, it works with clients across the following market sectors: Manufacturing, Retail, Services; Public sector, Healthcare & Transport; Financial Services; Telecoms, Media & Technology; Energy & Utilities. Atos is focused on business technology that powers progress and helps organizations to create their firm of the future. It is the Worldwide Information Technology Partner for the Olympic and Paralympic Games and is quoted on the Paris Eurolist Market. Atos operates under the brands Atos, Atos Consulting & Technology Services, Atos Worldline and Atos Worldgrid. More information: marketing-nl@atos.net atosconsulting.nl Atos, the Atos logo, Atos Consulting, Atos Worldline, Atos Sphere, Atos Cloud, Atos Healthcare (in the UK) and Atos Worldgrid are registered trademarks of Atos SE.. November 2013 ยฉ 2013 Atos