Webinar Series

Learning Principles for Cybersecurity Practice

January 29, 2020
NICE Framework Knowledge Descriptions

2

K0004: Knowledge of cybersecurity and privacy 

principles.
Learning Principles for 

Cybersecurity Practice

An Introduction to the Information Security Practice Principles

29 JAN 2020

Center for Applied Cybersecurity Research

3
POLL

4
INDIANA UNIVERSITY

Roadmap

1. Background

2. The Principles: Walkthrough

3. The Principles In Action 

5
INDIANA UNIVERSITY

THE PRINCIPLES 1. Comprehensivity (“Am I covering all of my bases?”)

Identify and account for all relevant systems, actors, and risks in the environment.

Related concepts: Complete Mediation, End-to-end Encryption, Reconnaissance, Inventory 

2. Opportunity (“Am I taking advantage of my environment?”) 

Take advantage of the actor relationships, material resources, and strategic opportunities available in the environment.

Related concepts: Information Sharing, White Hat Testing, Deception, Common Tools

3. Rigor (“What is correct behavior, and how am I ensuring it?”)

Specify the expected states, behaviors, and processes governing the relevant systems and actors.

Related concepts: Governance, Requirements, Monitoring, Audits, Follow-Through

4. Minimization (“Can this be a smaller target?”)

Minimize the size, quantity, and complexity of what is to be protected, and limit externally facing points of attack.

Related concepts: Attack Surface, Compactness, Data Minimization

5. Compartmentation (“Is this made of distinct parts with limited interactions?”) 

Isolate system elements, and enable and control the interactions that are strictly necessary for their intended purposes.

Related concepts: Modularity, Forward Secrecy, Least Privilege, Air Gapping, Cryptography

6. Fault Tolerance (“What happens if this fails?”)

Anticipate and address the potential compromise and failure of system elements and security controls.

Related concepts: Resilience, Failsafe Defaults, Defense in Depth, Revocability

7. Proportionality (“Is this worth it?”)

Tailor security strategies to the magnitude of the risks, accounting for the practical constraints imposed by the mission 

and the environment.

Related concepts: Risk Management and Acceptance, Usability

6
Background

7
INDIANA UNIVERSITY

Our purpose was to identify the underlying and invariant

principles that inform cybersecurity and information 

security generally...

...those which have driven and guided information 

security decision-makers across technologies, sectors, 

and epochs.

BACKGROUND

8
INDIANA UNIVERSITY

Principle (n.)

A general law or rule adopted or professed as a guide to 

action; a settled ground or basis of conduct or practice; a 

fundamental motive or reason for action, esp. one 

consciously recognized and followed.

-Oxford English Dictionary, online

BACKGROUND

9
INDIANA UNIVERSITY

What is “Cybersecurity”?

BACKGROUND

1. Surprisingly contentious

2. Names are hard:

a. “Information Security,” “IT Security,” 

“Computer Security,” “Assurance”

i. Do you hyphenate?

1. One word or two?

a. Nobody knows . . .

3. Blue padlocks are somehow involved

4. Goal: Mission Assurance

10
INDIANA UNIVERSITY

Why?

BACKGROUND

1. Cybersecurity needs a foundational mental model. Cybersecurity rarely has 

simple “right answers.” Our decision-making model must confront complex 

problems. 

2. Cybersecurity needs to support broad, novel analyses. Cybersecurity canon is 

too often highly detailed/technical, narrowly applicable, and highly prescriptive.

3. Cybersecurity needs a scalable model of education. We cannot rely entirely on 

master-apprentice, mimetic transfer of knowledge and know-how. We need 

universal tools.

4. Cybersecurity literacy is necessary for all decisionmakers. People up and 

down the chain of command need to understand information security 

fundamentals.

11
INDIANA UNIVERSITY

Methodology

BACKGROUND

1. Feasibility review of prior work.

– Has anyone else successfully unearthed and collected these 

principles? If so, how clearly, rigorously, and 

comprehensively? (See, in particular, Saltzer & Schroeder, 

1975)

– Where else have we found sets of principles that help 

communities frame and solve problems? (See, e.g., Fair 

Information Practice Principles,

https://obamawhitehouse.archives.gov/sites/default/files/rss

_viewer/NSTICstrategy_041511.pdf) See pg. 45

– Very broad search (across related fields and throughout 

history) for evidence of the principles.

2. Apply selection and tailoring criteria.

12
INDIANA UNIVERSITY

Selection and Tailoring Criteria (full set)

BACKGROUND

1. Sufficiently inclusive of the practice 

of information security. Did we miss 

anything?

2. Internal consistency. The principles 

must be able to logically interact, 

even if those interactions mean they 

come into conflict in practical 

application.

13
INDIANA UNIVERSITY

Selection and Tailoring Criteria (per principle)

BACKGROUND

1. Grounded in prior work

2. Guides action

3. Causally related to security outcomes

4. Work across time and space

5. Clarity for multiple audiences

14
INDIANA UNIVERSITY

Principles Overview 

BACKGROUND

● Mental Model: The Principles structure how you think about 

cybersecurity

● Decision-Making: The Principles emphasize decision-making

○ Particularly when there is limited time or no clear best approach

● A Set: They work individually, but (more importantly) as a set.

● General Purpose: The Principles apply in every scenario, but are 

specialized to none; their use should be supplemented with evidence

● Aspirational: the Principles are not a state you achieve; they guide 

action

15
INDIANA UNIVERSITY

Applications

BACKGROUND

1. Cybersecurity Education & Training

2. Cybersecurity Assessments

3. Cybersecurity Decisionmaking

4. Cybersecurity Communication

5. Analysis of Frameworks/Best Practices

16
INDIANA UNIVERSITY

More Resources 

BACKGROUND

● ISPP Foundational Whitepaper

○ Our most complete discussion of the Principles 

currently available.

○ Available at: https://cacr.iu.edu/principles/ISPPFoundational-Whitepaper-2017.pdf

● O’Reilly “Security from First Principles”

○ Shorter, written for a more general technologist 

audience

17
INDIANA UNIVERSITY 18

Q&A
POLL

19
The Principles

A walkthrough

20
INDIANA UNIVERSITY

THE PRINCIPLES 1. Comprehensivity (“Am I covering all of my bases?”)

Identify and account for all relevant systems, actors, and risks in the environment.

Related concepts: Complete Mediation, End-to-end Encryption, Reconnaissance, Inventory 

2. Opportunity (“Am I taking advantage of my environment?”) 

Take advantage of the actor relationships, material resources, and strategic opportunities available in the environment.

Related concepts: Information Sharing, White Hat Testing, Deception, Common Tools

3. Rigor (“What is correct behavior, and how am I ensuring it?”)

Specify the expected states, behaviors, and processes governing the relevant systems and actors.

Related concepts: Governance, Requirements, Monitoring, Audits, Follow-Through

4. Minimization (“Can this be a smaller target?”)

Minimize the size, quantity, and complexity of what is to be protected, and limit externally facing points of attack.

Related concepts: Attack Surface, Compactness, Data Minimization

5. Compartmentation (“Is this made of distinct parts with limited interactions?”) 

Isolate system elements, and enable and control the interactions that are strictly necessary for their intended purposes.

Related concepts: Modularity, Forward Secrecy, Least Privilege, Air Gapping, Cryptography

6. Fault Tolerance (“What happens if this fails?”)

Anticipate and address the potential compromise and failure of system elements and security controls.

Related concepts: Resilience, Failsafe Defaults, Defense in Depth, Revocability

7. Proportionality (“Is this worth it?”)

Tailor security strategies to the magnitude of the risks, accounting for the practical constraints imposed by the mission 

and the environment.

Related concepts: Risk Management and Acceptance, Usability

21
INDIANA UNIVERSITY 22

Comprehensivity
INDIANA UNIVERSITY

Comprehensivity: What is it?

THE PRINCIPLES

The Principle: Identify and account for all relevant systems, actors, and 

risks in the environment.

Key Question: Am I covering all of my bases?

Related Concepts: Complete Mediation, End-to-End Encryption, 

Reconnaissance, Inventory, Threat Modeling

23
Comprehensivity: Example

Achilles’ Heel:

• A single vulnerability can undermine 

an otherwise “invulnerable system”

• Attackers will prioritize your weak 

points: so should you

24

THE PRINCIPLES
INDIANA UNIVERSITY 25

Opportunity
INDIANA UNIVERSITY

Opportunity: What is it?

THE PRINCIPLES

The Principle: Take advantage of the actor relationships, material 

resources, and strategic opportunities available in the environment.

Key Question: Am I taking advantage of my environment?

Related Concepts: Information Sharing, White Hat Testing, Deception, 

Common Tools

26
Opportunity: Example

DOD Bug Bounty Program:

• DOD has launched half a dozen bug 

bounty programs since 2016

• Researchers have identified more 

than 5000 flaws 

• Program is now being expanded to 

include more sensitive DOD assets

27
INDIANA UNIVERSITY 28

Rigor
INDIANA UNIVERSITY

Rigor: What is it?

THE PRINCIPLES

The Principle: Specify and enforce the expected states, behaviors, and 

processes governing the relevant systems and actors.

Key Question: What is correct behavior, and how am I ensuring it?

Related Concepts: Governance, Requirements, Monitoring, Audits

29
Rigor: Example

Mars Climate Orbiter:

• Burned up in the Martian atmosphere 

rather than going into orbit

• Lockheed Martin engineers typically 

express force in pounds.

• NASA engineers assumed the 

software was converted to use metric 

units but was off by a factor of 4.5

• NASA soon abandoned “better, 

cheaper, faster” as their mantra

30

By NASA/JPL/Corby Waste - http://www.vitalstatistics.info/uploads/mars%20climate%20orbiter.jpg (see 

also http://www.jpl.nasa.gov/pictures/solar/mcoartist.html), Public Domain, 

https://commons.wikimedia.org/w/index.php?curid=390903
INDIANA UNIVERSITY 31

Minimization
INDIANA UNIVERSITY

Minimization: What is it?

THE PRINCIPLES

The Principle: Minimize the size, quantity, and complexity of what is to 

be protected, and limit externally facing points of attack.

Key Question: Can this be a smaller target?

Related Concepts: Attack Surface, Compactness, Data Minimization, 

Simplicity

32
INDIANA UNIVERSITY 33

“I have yet to see a house that lacked 

sufficient storage. The real problem is that we 

have far more than we need or want.” -

Marie Kondo
INDIANA UNIVERSITY

Minimization: Example

VS.

THE PRINCIPLES

34
Minimization: NTP Rescue

Network Time Protocol:

• Rescue effort on reference 

implementation

• Removed unreachable or obsolete 

code

• Dodged 85% of vulnerabilities that the 

team hadn’t found before disclosure

35
INDIANA UNIVERSITY 36

Compartmentation
INDIANA UNIVERSITY

Compartmentation: What is it?

THE PRINCIPLES

The Principle: Isolate system elements, and enable and control the 

interactions essential for their intended purpose.

Key Question: Is this made of distinct parts with limited interactions?

Related Concepts: Modularity, Forward Secrecy, Least Privilege, Air 

Gapping, Cryptography

37
Compartmentation: Example

RMS Titanic

• Utilized 16 watertight compartments

• But could only survive flooding four . . .

• Actually a partial Compartmentation 

success story

38
INDIANA UNIVERSITY 39

Fault Tolerance
INDIANA UNIVERSITY

Fault Tolerance: What is it?

THE PRINCIPLES

The Principle: Anticipate and address the potential compromise and 

failure of system elements and security controls.

Key Question: What happens if this fails?

Related Concepts: Resilience, Failsafe Defaults, Defense in Depth, 

Revocability, Incident Response, Business Continuity and Disaster 

Recovery, Murphy’s Law

40
Fault Tolerance: Example

NotPetya & Maersk: 

• Massive ransomware attack.

• Only one Maersk domain controller 

was unaffected.

• Because of a power outage in 

Ghana.

• That one machine was used to restart 

their entire operation.

• Fault Tolerance by accident?

41
INDIANA UNIVERSITY 42

Proportionality
INDIANA UNIVERSITY

Proportionality: What is it?

THE PRINCIPLES

The Principle: Tailor security strategies to the magnitude of the risks, 

accounting for the practical constraints imposed by the mission and the 

environment.

Key Question: Is this worth it?

Related Concepts: Risk Management and Acceptance, Usability

43
Proportionality: Example

Airport Security:

• Too much security is bad for the 

mission.

• Good security finds an appropriate 

balance between the risks faced, the 

security obtained, and the cost and 

hassle the security imposes.

• Airports went overboard, and so the 

general public was frustrated by them. 

44
INDIANA UNIVERSITY 45

Q&A
POLL

46
The Principles

In Action

47
INDIANA UNIVERSITY 48

Ransomware Targets Local 

Government
INDIANA UNIVERSITY 49

Welcome to the plucky but under-funded 

cybersecurity staff of Anytown, USA.

You’ve been asked for a plan to prevent 

ransomware attacks from disrupting the town’s 

most critical services, to be implemented within the 

coming year.
INDIANA UNIVERSITY 50

Mayoral Top Priorities:

● Water and Sewer Service

○ including billing for same

● 911 Service

● Police Activities

● Volunteer Fire Service

● Electronic Scoreboard for Little League Games
INDIANA UNIVERSITY

1. Comprehensivity (“Am I covering all of my bases?”)

Identify and account for all relevant systems, actors, and risks in the 

environment.

2. Opportunity (“Am I taking advantage of my environment?”) 

Take advantage of the actor relationships, material resources, and 

strategic opportunities available in the environment.

3. Rigor (“What is correct behavior, and how am I ensuring it?”)

Specify the expected states, behaviors, and processes governing the 

relevant systems and actors.

4. Minimization (“Can this be a smaller target?”)

Minimize the size, quantity, and complexity of what is to be protected, 

and limit externally facing points of attack.

5. Compartmentation (“Is this made of distinct parts with limited 

interactions?”) 

Isolate system elements, and enable and control the interactions that 

are strictly necessary for their intended purposes.

6. Fault Tolerance (“What happens if this fails?”)

Anticipate and address the potential compromise and failure of system 

elements and security controls.

7. Proportionality (“Is this worth it?”)

Tailor security strategies to the magnitude of the risks, accounting for 

the practical constraints imposed by the mission and the environment.

51

Mayoral Top Priorities:

● Water and Sewer Service

○ including billing for same

● 911 Service

● Police Department Activities

● Volunteer Fire Service

● Electronic Scoreboard for Little 

League Games
INDIANA UNIVERSITY 52

Q&A
INDIANA UNIVERSITY

Thank You!

Email: 

● Craig Jackson: scjackso@iu.edu

● Scott Russell: scolruss@indiana.edu

● Susan Sons: sesons@iu.edu

Principles home page: https://cacr.iu.edu/principles

O’Reilly Book: http://go.iu.edu/282b

53
INDIANA UNIVERSITY 54

Q&A
Thank You for Joining Us!

nist.gov/nice/webinars

55

Upcoming Webinar: “The Intersection of the Privacy and 

Cybersecurity Workforce” 

When: Wednesday, February 19, 2020 at 2:00pm EST 

Register: https://nistnice.adobeconnect.com/webinarfeb20/event/registration.html