Larry Clinton Operations Officer Internet Security Alliance

The Past

Source: The Present

The Internet Security Alliance The Internet Security Alliance is a collaborative effort between Carnegie Mellon University’s Software Engineering Institute (SEI) and its CERT Coordination Center (CERT/CC) and the Electronic Industries Alliance (EIA), a federation of trade associations with over 2,500 members.

Sponsors

US National Strategy to Secure Cyber Space The vast majority of cyber attacks originate or pass through systems abroad, cross several boarders and require international cooperation to stop

US National Strategy to Secure Cyber Space “The US interests in promoting cyber security extends well beyond its boarders. Critical information infrastructures are directly connected to Canada, Mexico, Europe, Asia and LA. The nations economy and security are reliant on far-flung corporations and trading partners that requires secure and reliable information infrastructure to function.”

Human Agents Hackers Disgruntled employees White collar criminals Organized crime Terrorists Methods of Attack Brute force Denial of Service Viruses & worms Back door taps & misappropriation, Information Warfare (IW) techniques Exposures Information theft, loss & corruption Monetary theft & embezzlement Critical infrastructure failure Hacker adventures, e- graffiti/defacement Business disruption Representative Incidents Code Red, Nimda, Sircam CD Universe extortion, e-Toys “Hactivist” campaign, Love Bug, Melissa Viruses The Threats – The Risks

Attack Sophistication v. Intruder Technical Knowledge High Low password guessing self-replicating code password cracking exploiting known vulnerabilities disabling audits back doors hijacking sessions sweepers sniffers packet spoofing GUI automated probes/scans denial of service www attacks Tools Attackers Intruder Knowledge Attack Sophistication “stealth” / advanced scanning techniques burglaries network mgmt. diagnostics DDOS attacks

The Dilemma: Growth in Number of Vulnerabilities Reported to CERT/CC

Growth in Incidents Reported to the CERT/CC

Machines Infected per Hour at Peak

Computer Virus Costs (in billions) (Through Oct 7) $ billion

Economic Impact of Cyber Attacks “Estimates of total world-wide losses attributable to virus and worm attacks in 2003 range from $13 billion due to viruses and worms only to $226 billion for all forms of overt attacks-- -Congressional Research Service Report to Congress April 2004

Largest Study Ever Conducted Finds : PricewaterhouseCoopers Sept Actual Spending on Security is flat Most “plan” to increase security spending “The greatest barrier to effective security is inadequate budget”

Companies Integrating Internet into Security 58% North America 41 % Asia 37 % South America 36% Europe

North America 51 % Asia 44 % Europe 40 % South America 24 % Data Protection as part of Policy

A Coherent 10 step Program of Cyber Security 1. Members and CERT create best practices 2. Members and CERT share information 3. Cooperate with industry and government to develop new models and products consistent with best practices

A Coherent Program of Cyber Security 4. Provide Education and Training programs based on coherent theory and measured compliance 5. Coordinate across sectors 6. Coordinate across borders

A coherent program 7. Develop the business case (ROI) for improved cyber security 8. Develop market incentives and tools for consistent maintenance of cyber security 9. Integrate sound theory and practice and evaluation into public policy 10. Constantly expand the perimeter of cyber security by adding new members

ISA Security Anchor Proposal Go beyond isolated conferences to Full service trade association for cyber security providing on-going services in: Information sharing on threats and incidents Best practices/standards/assessment development Locally-based education and training Domestic & international policy development Develop market incentives for cyber security

ISA Wholesale Membership Program Method of Reaching Smaller Companies Trade Associations Join for ISA lowest rate. ALL their small members receive full associate services FREE OF CHARGE

Wholesale Services FREE Best Practices Guide for Small Businesses FREE On-Line assessment and suggestions FREE access to secure Portal with news on Emerging threats, vulnerabilities & what to do FREE meetings/calls with experts FREE Newsletter on Cyber & Physical for SB

Larry Clinton Operations Officer Internet Security Alliance