Cyber-Risk Management

Cybersecurity is the set of activities that try to protect the assets from cyber threats, so when dealing with cybersecurity we are focused to everything that interact with the cyberspace. While information security is the protection of the information itself, so preserving the CIA properties. There is an intersection between IS and Cybersecurity, but there can be some elements that deals with one but not the other. For example there may be some information that must be protected, but their threats do not come from the cyber space (It belongs to the IS area, but it not belongs to the cybersecurity area). Most probably in few years information security will be almost completely contained in cybersecurity.

It is important to differentiate information security and critical infrastructure protection. Critical Infrastructures are infrastructures that provide basics services to the community: grid, water, transportation, finance. Today many of the CIP are provided or supported via ICT infrastructures, so there is always a step toward the digitalization that will introduce vulnerabilities. The subset of CIP that regards information protection is the CIIP (Critical Information Infrastructure Protection), it deals with the prevention of the disruption, disabling, destruction or malicious control of infrastructure. There are parts of CIIP that belong to both Cybersecurity and IS, parts that belong only to the IS, and others that are related to cybersecurity, and lastly there are also aspects that are outside of IS and Cybersecurity.

The main difficult tasks are those that belongs to Information Security, Cyber Security and CIIP.

The cyber risk is basically a risk that is caused by a cyber threat. Given that we have two types of cyber threats, we can classify the cyber risk in malicious and non-malicious cyber risk. But the same kind of risk can be classified differently depending in the threat that we are going to analyze.

When dealing with cyber systems, additional challenges arise. The problems comes from the fact that, given that the cyberspace has no boundaries there may be infinite stakeholders. So it is impossible to consult all of them. It is important to identify the right stakeholders that can give the right estimation, given the fact that in the cyberspace may there been adversaries every were.

An help, comes from repositories of up-to-date information, for example they can come from a National CERT (Computer Emergency Response Team) or a SOC, that will act as a proxy for a stakeholders. Repositories also stores information about cyber-threats, vulnerabilities and incidents, potential and confirmed adversary profile. An important example is represented by the NIST ndv repository.

All these information helps to gather knowledge from publicly available sources used to deals with cyber-risk management.

In cyberspace threats can be possible spread globally, and the number of threats sources and threats, both malicious and non, can be very huge. The first main difference from the general Risk Identification is that we have to differentiate the identification of malicious cyber risk, from the identification of non-malicious risks. When We are identifying malicious risks, we have to play together the role of the attacker and of the defender; the challenge is due to the fact that there is no perfect knowledge of the resources, motivations and strategy of the attacker.

It is the same as the General Case.

MITRE is a publicly available catalogue of attack patterns along with a a comprehensive schema and a classification taxonomy created to assist in the building of secure software

It provides, semi structured information, on how an attack can be performed by an attacker, abstracting it from the single technique and vulnerabilities, but an overview of the steps of the attacks to consider. Mostly of the time this kind of information is used by the analyst during the Evaluation phase, by tester to perform penetration testing activities and for awareness purposes.

The document is not mapped 1:1 to the online repository. An interesting aspect of this repository is that it gives pointer to external repository that provide information which an high level of granularity.

The repository has a tree based structure, when exploring the repository we are presented by a view of the tree, depending on the view the links are arranged differently considering the criteria selected. The three views are: domain, mechanism and other.

• Targeted: fits perfectly
• Secondary: intermediate node.

The main problem of this repository is that it is full of plain text, from the human perspective is nice, but if we want to use this information to feed a semi-automatic system it is difficult: NLP is needed to correctly use the information provided.

CWE is a community-developed list of common software security weaknesses. It serves as a common language, a measuring stick for software security tools, and as a baseline for weakness identification, mitigation, and prevention efforts.

It has the same structure of the CAPEC repository, some entries also include snippet of vulnerable code.

The common vulnerability scoring system, captures the principal technical characteristics of software, hardware and firmware vulnerabilities.

It outputs a numerical score that ranges from 1 to 10, and tells how critical a vulnerability is. Each entry in the NVD database as a Base Score and a Vector. There are two version of the CVSS score, that consider a different set of attributes for evaluate the score. Today both scores are available for retro-compatibility reason.

CVSS is used to capture and quantify the severity of a vulnerability starting from its characteristics. The score gives an overview of the degree of problems that the exploit can cause inside the system. To assign a score the CVSS score use three categories of metrics:

• Base metrics: the metrics inside this category regard intrinsic properties of the vulnerabilities. In this category there are two families of metrics: the exploitability metrics and the impact metrics.
  • Exploitability metrics. The attack vector tells which kind of access is required to the machine to perform the attack, attack complexity has three discrete values (how much is difficult for the attacker to perform the exploit), privileges required is self explanatory, user interaction tells if the exploit can be performed with any kind of user interaction.
  • Impact metrics. They regard the impact on the CIA properties. The last attribute: scope depends on whether the exploit of the vulnerability will change the type of control that the exploit has (like privilege escalation, or control of the physical machine).
• Temporal Metrics: they adjust the base metric of a vulnerability based on factor that change overtime. It has three attributes: exploit code maturity, Remediation level and Report confidence, they are not quantified inside NVD, but must quantified by the analyst.
• Environmental metrics: it is used to adjust the base metric considering the specific computing environment; taking into account the actors affected by the venerability, and the impact on the business flow of the company. It is composed by the: modified based metrics, and the CIA requirements that depends on the specific context.

The vector can be used as a complementary information to the aggregated value. The CVSS is the most used score because it gives quantitative information that can be used to quantify the likelihood of an exploit.

So it starts by providing a generic assessment for each vulnerability, but it also provides to the analyst the capabilities to customize the severity of the vulnerabilities given temporal metrics and environmental metrics (customize it on the particular environment in which the vulnerability has been discovered).

The common weakness scoring system provides a mechanism for prioritizing software weaknesses in a consistent, flexible and open manner.

It is similar to the CVSS, but it applied to weaknesses (so it applies to CWE). It is a collaborative, community-based effort that is addressing the needs of its stakeholders across government, academia and industry. The methodology provided can be applied to implement the control process (in this case to the risk management process). CVSS and CWSS can be leveraged together, because they give information at different level of granularity, the first is very detailed, the latter quantify an high level concept.

It produce a quantitative value that as a qualitative meaning; and it gives a common framework for prioritizing security errors (weakness) that are discovered. It’s structure is similar tu the CVSS:

CWSS in organized into three metric groups: base findings, attack surface and environmental.

The base findings metric group captures the inherent risk of the weakness confidence in the accuracy of the finding, and strength of controls. The attack surface metric group regard the barriers that an attacker must overcome in order to exploit the weakness. The environmental metric group is the set of characteristics of the weakness that are specific to a particular environment or operational context.

The document provides the scale used to compute the score, and explain how to combine all the sub-scores to obtain the final one. The CWSS is not directly published with the weakness; it has been published last year, so it is evolving. The Base Findig sub-score range between 0 and 100, while the attack surface and environmental metrics sub-scores ranges between 0 and 1; The final result ranges between 0 and 100.