# Presentation: 774767

## IT Security 2004

- NOAA Office of the CIO
- Carl Staton
- IT Security
- Slides for comparisons from: 2004 CSI/FBI Computer Crime and Security Survey
*                                                                    **by Lawrence A. Gordon, Martin P. Loeb,*
*                                                                    **William Lucyshyn and Robert Richardson*

## Escalating and Evolving Requirements

**Regulations and guidance are changing at an increasing rate.**
- Federal Information Security Management Act (FISMA) --- Dec 2002
- NIST SP 800-64 - Security Considerations in the Information System  Development Life Cycle---- October 2003
- SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories--- June 2004
- Development of Homeland Security Presidential Directive (HSPD) -7 Critical Infrastructure Protection Plans to Protect Federal Critical Infrastructures and Key Resources--- June 2004
- NIST SP 800-37 Guide for the Security Certification and Accreditation of Federal Information Systems--- May 2004
- NIST FIPS 199 Standards for Security Categorization of Federal   Information and Information Systems--- February 2004
- NIST SP 800-61 Computer Security Incident Handling Guide--- January 2004
- NIST SP 800-55 Security Metrics Guide for Information Technology Systems--- July 2003 --- **And many others!!!!**

**Notes:**
What do we all see for trends in IT Security.  First, just like for every one, security requirements are evolving at an unheralded rate.   All of these and other New Laws, OMB/DOC Policy and a host of new draft standards and we’re expected to stay in compliance.   

## Evolving Technologies

**Technology is changing even faster than the evolution of requirements....  **
- New technology is deployed without security employed (wireless devices, ipods, thumbdrives, keyloggers, cell phones with cameras)
- Any PC with a USB port is a host for unauthorized peripherals
- Telecommuters need to have home and portable PC configured for access
- When security blocks progress of a business process, users tend to work around  countermeasures
- Malicious software trends – new zero-day exploits, more destructive attacks

**Notes:**
And, technology moves even faster than changes in requirements.  As technology advances trends in security begin to shift.

Here's an old, but apt and interesting graphic....

## NOAA Statistics 

**Successful Intrusions Resulted from....  **
- Installation of un-patched systems
- Installation of systems without security properly configured
- New (unknown) vulnerability

**Notes:**
	        FY 2000	FY 2001	FY 2002	FY 2003	FY 2004	
Probes	    270	    551	1236	         527	          345	
Intrusion Atts    82	             457	   85	         113	          250	
Intrusions	     51	             121	   72	           90	            82	

## Slide 5

**Notes:**
It takes less and less technical skills and knowledge to use new attack tools.  They have evolved in sophistication and ease of use.  Anyone, even our own users get more and more capable of subverting our controls, (soft under belly) and secure perimeters or peripheral protection is with lax internal control no longer “OK”.  Our security must get better.  What can we glean about trends from such sources as the 2004 CSI/FBI Computer Survey 

## Reports Of Unauthorized Use of Computer Systems

- Do We Measure Up?

**Notes:**
Overall -frequency of (successful) attacks on computer systems declined this year, a continuing a trend for the survey that began in 2001.  
Organizations experiencing unauthorized use of computer systems declined to 53 percent, the smallest percentage since 1999.  
Organizations experiencing no unauthorized use of their systems increased to 35 percent, 
Respondents not knowing if such unauthorized use occurred dropped to a low of 11 percent.
These trends can be misleading.  
While our reported successful intrusions (and attempts ) track similarly and have gone down, our perimeter defenses have been gradually improved with deployments of new firewalls and IDS/IPS throughout NOAA. 
The data from the survey demonstrates the trend that cybersecurity breaches are declining.  

## Types of Attacks or Misuse Detected (by percent)

**Notes:**
This Figure is quite busy but provides a visual demonstration that attacks on computer systems or (detected) misuse of these systems has been slowly, but fairly steadily decreasing over many years in nearly all  categories.  As seen in the figure, there has been a dramatic drop in reports of system  penetrations, insider abuse, and theft of proprietary information. 

Three new categories were added to this year’s survey, and obviously trend data is not available. However, for this year’s survey, 15 percent of the respondents reported abuse of wireless networks, 7 percent reported Web site defacement, and 10 percent reported misuse of public Web applications.  All the organizations covered by this year’s survey experienced some some Web site incidents.   

## FY 04 Dollar Amount of Losses by Type

**Notes:**
Survey respondents’ estimates of the losses caused by type of computer security incident are shown in this figure. A number of important points are related to this figure, some of which are not readily accessible from inspection of the figure. First, the real story of losses is that the total losses reported (on a per respondent basis) declined. Although the dollar amounts/employee were not available from previous surveys, total losses for 2004 were $141,496,560, down from  $201,797,340 in 2003. Second, as in the past, respondents are generally either unable or unwilling to estimate the dollar losses. In this year’s survey, 269 respondents out of a total of 494 provided dollar loss estimates. Third, the denial of service category emerged for the first time as the  incident type generating the largest total losses (replacing theft of proprietary information, which had been the most expensive category of loss for five consecutive years). To the extent that this result can be generalized to the whole population, it may be due to last year’s rise in the degree to which virus threats were entwined with denial of service attacks (witness the numerous variants of the MyDoom worm, which carried as its payload a time-triggered denial of service attack program).

While specific number are not available, NOAAs estimates of costs of losses by type would reflect a similar chart for the past three years with DOS being our highest type followed by System Penetration, unauthorized access and Web site defacements.  Our costs resulting from the other types would be very small. 

## Security Technologies Used

**Notes:**
Survey takers were asked to identify the types of security technology used by their organizations. This year’s survey updated the categories, clarifying and adding some, and eliminating others. Several categories addressed systems defending against network attack. As in previous years, anti-virus software was reported as being used by 99 percent of the organizations. Nearly all organizations, 98 percent, also reported using firewalls. Intrusion detection systems were being used by 68 percent of the organizations (a 5-percent drop from last year), while 45 percent of the respondents’ organizations jumped on the intrusion prevention system bandwagon. Several categories shown in this figure deal with access control technologies.  Server-based access control lists were reported to be used by 71 percent of the respondents. Reusable account/login passwords was reported to be used by 56 percent, the use of smart cards and other one-time password tokens used was claimed by 35 percent, and biometrics remained flat at 11 percent. Measures to protect information while in transit included encryption of data in transit, reported to be used by 64 percent of respondents, use of encrypted files at 42 percent, and use of public key infrastructure system at 30 percent.

This tracks with NOAA, we have enhanced our enterprise wide Virus solution every year to accommodate new technologies, we have purchased firewalls for and continue to deploy IDS and IPS at our major network operations centers, we have also invested in personal firewalls for 7500 NOAA remote access users, fisheries has employed end to end encryption for sensitive information transfer, and all other technologies are either being tested or are used in varying small scales across NOAA networks. 

NOTE: Intrusion prevention systems attempt to identify and block malicious network activity in real time. Although these systems look like firewalls they work differently—firewalls block all traffic except that which they have a reason to pass, while intrusion prevention systems pass all traffic unless they have a reason to block it. 

## If you experienced intrusion(s) which actions did you take?

**Notes:**
This figure shows how the organizations surveyed responded to computer intrusions in each  year of the survey beginning with 1999. The top line shows that more than 90 percent of  respondents indicated that their organization responds by patching security holes. The high percentage of organizations that react by patching holes has remained high through the years, and only once dipped below 80 percent. The next line down in the figure shows that only half of all respondents indicated that their organization shares information about a security breach. The percentage sharing did not increase in the past year, and remains at virtually the same level as in the 1999 survey. Surprisingly, as shown by the third line down in the figure, the latest year shows a noticeable downturn in the percentage of organizations that reported computer intrusions to law enforcement. 

Unfortunately, NOAA statistics for patching holes appear to exceed these numbers.  To the bane of my existence nearly all of NOAA successful intrusions have resulted in patching holes in un-patched systems.  

## What Do You Need To Do?

- Practice and Preach the Guidance from the Awareness Course
- Know Who Your System Administrator and ITSO/ITSSO Are
- Be Aware of your IT and Physical Security Environments at all times
- Look to new areas where we are not addressing IT Security
- Ensure IT Security is Not an Afterthought
**It must be integrated into all planning for new technologies and systems**
**It must be actionable, repeatable and measurable**
- The CSI/FBI Survey Referenced throughout can be found at:
- _[http://i.](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[cmpnet](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[.com/](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[gocsi](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[/db_area/](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[pdfs](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[/](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[fbi](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[/FBI2004.](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)__[pdf](http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf)_

**Notes:**
Obviously we track very well within the framework of this particular study.  The survey provides many other reports and tables and NOAA would track well with those also.  What we need to remember most from this presentation is our Vulnerability and the “Old but Apt Slide from US Cert” which demonstrates that “script kiddies” with curiosity and our own internal users with access to the internet are becoming more serious threats than ever.  So remember "One of the tests of leadership is the ability to recognize a problem before it becomes an emergency." - Arnold Glasgow
Based on this survey and our comparison (we track almost totally) the shifts in problem areas could be our next emergency!