CERT Centers, Software Engineering Institute Carnegie Mellon University Pittsburgh, PA SEI is sponsored by the U.S. Department of Defense © 2000 by Carnegie Mellon University :8-1 Models of Information Security Analysis

© 2002 by Carnegie Mellon University Model - 2 Outline Definitions Analysis framework Cautionary factors Sample analysis

© 2002 by Carnegie Mellon University Model - 3 Definitions Trend: 1.to extend in a general direction: follow a general course or veer in a new direction 2.to show a tendency for example, to incline or trend upwards or to become deflected or shift Trend analysis: search for patterns over time in order to identify the ways in which they change and develop, veer in new directions, or shift Incident - Any event that harms security at one or more sites

© 2002 by Carnegie Mellon University Model - 4 Analysis Framework Types of trends Sources of data Interpretation of results

© 2002 by Carnegie Mellon University Model - 5 Types of Trends Internal and External patterns Temporal trends Spatial trends Associational trends Compound trends

© 2002 by Carnegie Mellon University Model - 6 Sources of Data CERT/CC Data Year ,756 Incidents reported to CERT/CC Year 2001 (Q1) - 7, 457 Incidents reported to CERT/CC Profiled 1654 incidents, all active during July Feb 2001 (plus some preliminary June data) Open Source Data: Web page defacement mirrors Lexus/Nexus Full disclosure sites Social data

© 2002 by Carnegie Mellon University Model - 7 Limits of Trending Inherently partial data Baseline in dynamic environment Correlation vs. Causation Implications Need to be cautious in kinds of conclusions Consider strategies for dealing with trends gone wrong

© 2002 by Carnegie Mellon University Model - 8 Internal Pattern: Staged Attack 1 2 3

© 2002 by Carnegie Mellon University Model - 9 External Pattern: Tool Development Intruder 1 Intruder 2 Analysts

© 2002 by Carnegie Mellon University Model - 10 Temporal Trend Defenders Intruders

© 2002 by Carnegie Mellon University Model - 11 Vulnerabilities in Incidents

© 2002 by Carnegie Mellon University Model - 12 Service Shifts

© 2002 by Carnegie Mellon University Model - 13 Analysis Process Incident Information Flow Identify Profiles and Categories Isolate Variables Identify Data Sources Establish Relevancy Identify Gaps

© 2002 by Carnegie Mellon University Model - 14 Conclusions Typifying trends simplifies interpretation Clarification of goals Identification of relative importance of characteristics Understanding cyber security is growing in importance