1. Threat Trends and Protection Strategies Barbara Laswell, Ph. D
Threat Trends and Protection Strategies Barbara Laswell, Ph.D. September 2003
CERT® Centers
Software Engineering Institute Carnegie Mellon Pittsburgh, PA
Sponsored by the U.S. Department of Defense

2. Software Engineering Institute
Federally Funded Research and Development Center (FFRDC)
Sponsored by the U.S. Department of Defense
Operated by Carnegie Mellon
Purpose is to help others make measured improvements in their software engineering capabilities
CERT® Centers are part of the SEI

3. Growth in Number of Incidents Reported to the CERT/CC

4. Growth in Number of Vulnerabilities Reported to the CERT/CC

5. Attack Sophistication vs. Intruder Knowledge

6. Lack of Boundaries
Today we see the shift in thinking from bounded to unbounded systems, specifically shifting from the presence of well-defined geographic, political, cultural, and legal/jurisdictional boundaries to their absence.

7. Trends
Steady increase in both vulnerabilities and incidents, as well as a growing dependency on the Internet
Cyber attackers using vulnerabilities and easy connectivity to the Internet to conduct criminal activities, compromise information, and launch denial of service attacks that seriously disrupt operations
Attacks are cheap, easy, difficult to trace, and growing increasingly sophisticated
Cyber-space and physical space are one

8. Strategy for Organizations

9. Protect Strategy Conduct risk analyses
Develop policy and implement risk mitigation plans
Use security practices

10. Protect Resources
Risk-based information security assessment methods OCTAVE
Security practices
Survey on network security and insider threats [USSS and CERT]

11. Detect Strategy
Use modern technology and system management processes to identify and analyze attacks and compromises

12. Detect Resources Analysis techniques and methods

13. Respond Strategy
Have incident response teams and procedures in place to quickly react to attacks and compromises
Recover and restore critical services
Conduct cybercrime investigations

14. Respond Resources CERT Advisories Vulnerability notes database
Vulnerability notes database
Automated Incident Reporting (AirCERT)
Computer Security Incident Response Team (CSIRT) guidance, training and certification
“Tracking and Tracing Cyber Attacks”

15. Sustain/Improve Strategy
Develop an information assurance empowered workforce

16. Sustain/Improve Resources
Awareness and training at all levels
Secure programming practices and training
TSP/PSP pilots

17. Our Mission An Internet community that is
in information assurance and survivability

18. Countries of CERT course attendees

19. Recent Publications

20. For More Information
CERT® Centers Software Engineering Institute Carnegie Mellon University Pittsburgh, PA USA +1 (412)