Cyber Security Cookbook for Practitioners

Risks are identified and managed in accordance with corporate strategy and the corporation’s risk appetite (Wheeler, 2011 Chapter 3 as of Page 43). Risk management incorporates the following:

Resource Profiling

The Factor Analysis of Information Risk (FAIR)3 is used as a model for understanding, analyzing and quantifying information risk in financial terms and builds a foundation for developing a scientific approach to information risk management.

Figure 1.

For resource profiling, all resources are identified and the level of sensitivity is defined for each. A detailed threat analysis is performed quarterly to identify exposure and quantify risk and security controls are defined and implemented. It classifies the likelihood and consequences associated with each risk and how that risk could impact the business (See Tables 1, 2).

A set of 15 must-have policies complements the company’s cybersecurity best practices and accompany the strategy to enforce its fulfilment. Policies and Procedures are communicated to all employees. Additionally, where required, appropriate sections are distributed to suppliers and contractors. In doing so, their importance is emphasized. Given that fulfilling them is compulsory, the firm audits compliance, provide continuous oversight, demand accountability, and, where necessary, impose sanctions upon those who violate these rules. The list of policies can be found as an Appendix B.

At any Institutions, employees’ safety is a priority. Therefore, counting with the experience of a private security company, specific measures have been taken to ensure the safety of all employees either when working on premises (garage included) or when they travel for work purposes.

On the other hand, understanding that cyber-attacks can sometimes begin with a physical breach -for instance, when an outsider to surreptitiously gather fodder for a social engineering scheme or when an insider (such as a so-called “bad leaver”) gains access to a company’s network and wreak havoc, without initially using malware or other clandestine technological means- Institutions should take the physical security of facilities into consideration as part of the Cybersecurity strategy. The physical security in the firm’s premises including the reception and entry checkpoints; ID scanner and other access records; video; physical logs; and garage records. Safety and physical security measures are audited periodically by a renowned firm to check they are implemented and working as expected, and updated or fixed if necessary.

All information systems, including operational systems, systems under development, and systems undergoing modification or upgrade, are in some phase of a system development life cycle. Requirements definition is a critical part of any system development process and begins very early in the life cycle, typically in the initiation phase. Security requirements are a subset of the overall functional and nonfunctional (e.g., quality, assurance) requirements levied on an information system and are incorporated into the system development life cycle simultaneously with the functional and nonfunctional requirements. As recommended by the NIST4, early integration of information security requirements into the system development life cycle is the most cost-effective and efficient method for an organization to ensure that its protection strategy is implemented.

With regard to configuration management and control, it is important to document the proposed or actual changes to the information system and its environment of operation and to subsequently determine the impact of those proposed or actual changes on the overall security state of the system. Information systems and the environments in which those systems operate are typically in a constant state of change (e.g., upgrading hardware, software, or firmware; redefining the missions and business processes of the organization; discovering new threats). Documenting information system changes as part of routine SDLC processes and assessing the potential impact those changes may have on the security state of the system is an essential aspect of continuous monitoring, maintaining the current authorization, and supporting a decision for reauthorization when appropriate.

As recommended by the NIST5, a critical aspect of managing risk to information from the operation and use of information systems involves the continuous monitoring of the security controls employed within or inherited by the system. The objective of the continuous monitoring program is to determine if the set of deployed security controls continue to be effective over time in light of the inevitable changes that occur. Continuous monitoring is a proven technique to address the security impacts on an information system resulting from changes to the hardware, software, firmware, or operational environment. A well- designed and well-managed continuous monitoring program can effectively transform an otherwise static security control assessment and risk determination process into a dynamic process that provides essential, near real-time security status-related information to organizational officials in order to take appropriate risk mitigation actions and make cost-effective, risk-based decisions regarding the operation of the information system. Continuous monitoring programs provide organizations with an effective mechanism to update security plans, security assessment reports, and plans of action and milestones. Using the Template

After the text edit has been completed, the paper is ready for the template. Duplicate the template file by using the Save As command, and use the naming convention prescribed by your conference for the name of your paper. In this newly created file, highlight all of the contents and import your prepared text file. You are now ready to style your paper.

The monitoring program is integrated into the organization’s system development life cycle processes. A robust continuous monitoring program requires the active involvement of information system owners and common control providers, CIO, CISO, and authorizing officials. The monitoring program allows an organization to: (i) track the security state of an information system on a continuous basis; and (ii) maintain the security authorization for the system over time in highly dynamic environments of operation with changing threats, vulnerabilities, technologies, and missions/business processes. Continuous monitoring of security controls using automated support tools facilitates near real- time risk management and represents a significant change in the way security authorization activities have been employed in the past. The firm uses vulnerability scanning tools, system and network monitoring tools, and other automated support tools that can help to determine the security state of an information system.

Configuration management and control processes for organizational information systems;

The results of our cybersecurity strategy are measured through a set of metrics that help us to monitor and control the implementation of the same, better manage our risk and make informed decisions. The list of metrics can be found as an Appendix C.

Continuous monitoring results are considered with respect to any necessary updates to the security plan, security assessment report, and plan of action and milestones, since these documents are used to guide future risk management activities. Updated security plans reflect any modifications to security controls based on the risk mitigation activities carried out by information system owners or common control providers. Updated security assessment reports reflect additional assessment activities conducted by assessors to determine security control effectiveness based on modifications to the security plan and deployed controls. The results of monitoring activities are reported to authorizing officials on an ongoing basis in the form of status reports to determine the current security state of the information system, to help manage risk, and to provide essential information for potential reauthorization decisions.

Institutions should implement a Cybersecurity Framework based on NIST7. These are the framework’s core functions:

Identify

These core functionalities translate into the following actions:

1) Identify known cybersecurity risks to their infrastructure

2) Develop safeguards to protect the delivery and maintenance of infrastructure services

3) Implement methods to detect the occurrence of a cybersecurity event

4) Develop methods to respond to a detected cybersecurity event

5) Develop plans to recover and restore the companies’ capabilities that were impaired as a result of a cybersecurity event

The following attack vectors have been considered and a decision tree based on the framework is provided below:

Data Loss

Figure 2.

When a potential incident is reported, the incident will be investigated to determine if it is valid based on known attack vectors. Once validated, one or more members of the incident response team will collaborate to determine and classify the impact using the Consequence Table. The categories of incidents are insignificant, minor, moderate, major, and extreme. (See Consequence Table)

Each attack vector has the potential to overlap, particularly for data loss or insider threat. One or more of the following decision trees may be put into action depending on the circumstances of the breach.

Figure 3.

An incident that involves loss of data must be immediately analyzed for the loss of classified or sensitive data. If the data contains PII (Personally Identifiable Information), PCI (Payment Card Industry), SOX (Sarbanes Oxley) or other types of data deemed as classified or sensitive, then specific communications will be formulated to the necessary individual(s) and agencies.

The Communications Officer will be responsible for these communications with oversight from the C-Suite, CEO, CISO, CFO and CIO. For any other loss of data, the data recovery, backup and restore will be performed by Information Technology and business will resume as usual.

Figure 4.

If it is determined that any compromise was the result of an insider threat, whether it be a vendor, employee, consultant or former employee, an official investigation will be conducted to determine the goals of the attacker, data loss and entry points on the intrusion. Additionally, the investigation will expand to cover any individuals with close relations to the attacker and identification of additional known conspirators.

Immediately following the identification of an insider threat, the users account will be disabled based on IT guidelines. Furthermore, checks will be performed to identify any unknown accounts and logs will be assessed regularly for other suspicious unauthorized activity.

Figure 5.

In the event that a vendor account or endpoint is compromised, a line of communication will be opened with the vendor to assist in identifying the extent and nature of the breach. Data loss and network breach decision trees will be acted upon as well as investigation into any insider threats based on those who have access and knowledge of vendor systems and their inner workings. The goal will be to restore operations with the vendor in a timely manner while gathering the appropriate data to assess the damage and enable additional security protocols to secure the connection in the future.

Figure 6.

If an individual device is compromised, the Desktop Support team will determine if the device is recoverable through scan and removal of malicious software or through backup and restore. If the device is an unrecoverable state, or the device is known to contain highly sensitive information, the device will be isolated, removed from the network and sent for forensic analysis. The CISO will work with the CIOO to communicate unusual findings.

Figure 7.

If there is a malware detection that can be traced back to a phishing campaign, or a user reports a suspicious email or other form of communication that seems like a potential phishing attack, then the decision trees for data loss, system and network recovery will also be enacted.

There will be an investigation into the phishing target with the goal of determining the intention of the attacker and what information they were seeking (See Section 0 on common types of hackers) or may have retrieved. Depending on the extent of the breach, various members of the C-Suite will convene to determine next steps. The Human Resource department will be responsible for investigating the phishing target(s) to determine if any sensitive information was obtained. Further rules for response on data loss or network breach will be followed.

Figure 8.

In the event of an advanced persistent threat (APT), involving a multifaceted breach of network and system resources, it will be determined if systems can be restored with internal resources through collaboration of Information Technology and Information Security. If the breach is beyond internal expertise, external agencies such as the FBI (Federal Bureau of Investigation or DHS (Department of Homeland Security) will be contacted for assistance as needed. All members of the C-Suite, CEO, CISO, CIOO, CFO, as well as HR (Human Resources), will formulate a specific recovery plan and proper communications based on the severity and financial impact to the company by referring to the Consequences Table.

Figure 9.

In the unfortunate case of ransomware, where there is potentially unrecoverable data loss through encryption and the data is being held for ransom, the data loss decision tree will also be invoked. If the data is considered classified or sensitive, or poses a risk where the business cannot recover financial loses, than external agencies will be notified for advice and assistance. All members of the C-Suite will be active in assessing the damage of a ransomware attack and determining the proper action.

Figure 10.

In the event of a DDoS attack (Distributed Denial of Service), flooding of the network or targeted machines through an overload of requests, the IT Operations team will be responsible for denying traffic and reporting on any potential loss of data and or revenue streams. The CISO will work jointly with the CIOO to communicate the impact of the attack and set expectations for recovery time before returning to business as usual.

The CISO will be responsible for cyber security education and overseeing ongoing improvements to cyber defenses. The Incident Response team will review the cyber security playbook quarterly and conduct table top exercises to rehearse incident response procedures. Knowing that attack vectors evolve over time and that attacks become more sophisticated each day, the decision tree will be updated and will adapt to lessons learned.

The cyber security playbook decision tree is meant as a general guideline. Each incident must be accessed and categorized individually and it is the responsibility of the C-Suite to analyze, communicate and react according to the various circumstances of each individual threat.

The CEO makes sure that Cybersecurity is incorporated into our strategy as a cornerstone of our business. “Our brand reputation, partnerships, potential investment opportunities, and competitive advantage all rely on the integrity of our information”. The following factors have been taken into consideration to make our strategy succeed:

Identification of the information critical to the business

There are three initial considerations that the CEO takes into account: first of all, protecting our company against cybersecurity threats goes beyond the pure compliance with standards or regulations. Secondly, we strive to find the balance between cybersecurity and productivity, as. “Cost, performance, and ease of use are key attributes of an efficient and successful cybersecurity program.” (Touhill & Touhill, 2014, Page 273). Thirdly, we take into account the risk management lifecycle.

Based on these initial considerations, our cybersecurity strategy distinguishes three Areas of Focus:

1) Establishing a governance model for security, including enterprise-wide collaboration,

2) Identifying and protecting critical data and applications, and

3) Developing and implementing an effective response plan.

The details of the Response Plan can be found in Section 1 of this Playbook but the Appendix D includes a comprehensive checklist taken into consideration for the firm’s CEO when evaluating cybersecurity and taking major decisions before, during and after an incident.

Regarding the CEO responsibilities and according to the NIST Framework, “the head of agency (or chief executive officer) is the highest-level senior official or executive within an organization with the overall responsibility to provide information security protections commensurate with the risk and magnitude of harm (i.e., impact) to organizational operations and assets, individuals, other organizations, and the nation resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of: (i) information collected or maintained by or on behalf of the agency; and (ii) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.

As additional responsibilities, the following are considered:

Making sure cybersecurity is part of the company’s strategy and operational planning, the board discussion and the company’s daily routine. This involves transforming the company culture, providing the necessary resources in terms of security systems and security trained personnel, and taking into account lessons learnt from previous incidents (if any) to improve its security posture.

As most firms have the proper C-Suite executives working together in order for a strong collaborative effort to respond to any potential issues, the Chief Financial Officer (CFO) must be aligned for financial data. The CFO works closely already with CEO and CISO to understand the value in the data that could be possibly taken from a cybersecurity breach. From a financial view, the CFO works directly with technology and security to understand the leaks from a breach to manage potential risks. Majority of hacks including ransom cyber-attacks have a dollar value tied to them. The CFO needs to address these type of concerns, plus the costs of remediating the attack with appropriate amount of resources, risk mitigation activities, software upgrades, and patches. The CFO works with General Counsel, Legal, and Director of Communications to analyze the financial impact of the current hack and potential future hacks to understand the deep dive financial matters.

The CFO works directly with the CEO to discuss briefing matters on financials budgets associated with cyber-attacks. Each attack a company encounters needs to be justified to provide the correct amount of costs for man-hours for a patch, and software upgrades to internal systems to build preventive measures within an organization. The CFO is responsible for recommending a budget with C-Suite executives on an annual 3-year rolling forecast to factor in maintenance of upgrades to all internal and external systems that could possibly be faced with any type of cyber threats.

An approved allocated budget from the C-Suite executives allows CTO and CISO to work with external consulting providers to recommend equipment upgrades instead of fulfilling the requirements of hacker if a ransom was requested. It’s worth remembering that when a company pays a ransom once, it will flood the gates with additional hackers in the foreseeable future to attack our organization for a quick payment instead of the organization getting cybersecurity expert law enforcement involved. Plus, this type of preventive measure keeps senior management in the loop to keep on investing more in security space of our organization by increasing annual budget to build workshops for firm awareness and risk mitigation.

Budget: For 2017, the total is $650,000 for consulting and professional services for gap assessments for the year, which will allow senior management to focus on meeting requirements for 2018.

Due to our complete reliance on technology to conduct business, the board may decide to combine the roles of CIO and COO into one: the CIOO. The combined role yields pronounced efficiencies/benefits in as far as cybersecurity is concerned, more so during and after attacks.

The firm assigns the highest priority in assessing the impact of an attack to the following classes of data:1)

Personally Identifiable Data (PII)

Attacks impacting systems housing any of the above three types of data are high risk by nature. The default severity of any such attack is Major until it is downgraded.

Since remediation and recovery entail changing components in the ecosystem and infrastructure, the CIO has put in place the following processes:

1) Emergency Change Management –Extreme and Major events justify the activation of these processes where signed pre-approvals are deposited by:a)

Business Application Owners

2) Expedited Change Management –Moderate events warrant a scaled down change process where:

a) Pre-approved Damage Control (limited isolation of components/apps)

b) Fast-track change management - convening skeleton meetings within pre-approved timeframes based on affected apps/components attended by Application Owner and Business Unit representatives.

The CIO has two delegates working in tandem and collectively participating in day-to-day business as well as during cybersecurity events:

VP Operations Management

The CIO participation and delegation during cyber events is based on severity as shown below

Please note that a similar model applies to the rest of the members of the C-Suite.

Participation levels are described as follows:

100% :

Change is inevitable in every industry. But in finance, the pace of change is driven by regulatory flux, ever changing geopolitical landscape and the constant evolution of technology. Today’s financial organizations face an unprecedented array of new challenges in the form of cyber-attacks. According to Cisco, “Playbook is perspective collection of repeatable queries against security event data sources that lead to incident detection and response”. Cyber threats are dynamic in nature so it is important for the CISO’s to have essential planning and communication skills while protecting shareholder value.

It is a sole responsibility for C-Suite Executives to be aware of all information security regulations that apply to the company, such as Health Insurance Portability and Accountability Act (HIPAA), 1999 Gramm-Leach-Bliley Act, and the Federal Information Security Management Act (FISMA) as part of the 2002 Homeland Security Act, General Data Protection Regulation (GDPR), and Payment Card Industry Data Security Standard (PCI DSS). General Counsel needs to work with both CISO and CIO to ensure information system security practices follow proper guidelines. Moving forward we need to be up to date on National Institute on Standards and Technology on best practices of cyber security infrastructure and policies.

Next aspect of General Counsel is to ensure that audits follow proper methodology for Federal Review and are set in place in order to produce efficient controls. Keeping semi-annual audits of internal information security infrastructure, where a draft is written up to help conclude how the system can be improved. With all of the Third-Party vendors working with our organization we need to ensure audits are conducted based on information security policies and systems will not be a liability to the company. General Counsel needs to adhere to best practices in risk management so as to have minimal or no damage in an attack.

The General Counsel moves in the direction to ensure that proper law enforcement barriers are set up in our preventive measures and resolution plan. We have drafted a created list based on scenarios on how much damage and type of damage expectations to occur before involving the federal authorities. Internally, within our organization, we have established connections with security clearance authorities as well to understand the scope of the investigation to address how it will affect the firm’s information and business processes.

General Counsel has developed a proper Data Retention Policy for internal employees and external clients to keep data secured then protected. We need to understand the policies of data retention of how to properly manage and maintain data as evidence in case of a customer request for information (RFI). Then a major focus is on ensuring the integrity of the data is preserved as well as having documented the chain of custody which begins in the collection phase.

General Counsel have created the proper documentation to executive opinions that could possibly affect Attorney-Client privilege. The knowledge of the incident response fall under normal operations and which are protected under attorney client privilege. Counsel should be involved in all communication whether it be phone, email, etc. between company and the cyber security consultants brought in for the attack. Direct contact with General Counsel is required immediately after an attack as the worst part of the attack is right after it has taken place because of speculation on incomplete information, damaging communication is likely to occur.

The main responsibility of the Director of Internal and External Communication in a cybersecurity breach is to keep the public aware of any risk mitigation issues and a strong response to the media that we as C-Suite level employees are ensuring best practices to safely protect the data of our customers. In this day and age, it is very crucial to develop relationships outside the organization with correct media outlets to release significant details while gaining the trust of our shareholders. These types of breaches have in the past caused many issues by not focusing efforts on communication and keeping shareholders and stakeholders in the loop.

3)

Communications to regulators

The firm has decided to adopt a doctrine of transparency in reporting cybersecurity attacks, despite the fact that the practice is optional. The reporting, however, is qualified in that it should apply only to Extreme and Major events. The rationale is that the company needs to guard against long-term reputational loss/damage, despite the short-term risks of stock price fluctuation. In the event of Extreme and Major attacks, the executive board will approve communications based on form 8-k using Fish & Richardson Disclosure Decision Tree depicted in figure below:

Figure 17.

TABLE VI.

APPENDIX B. CYBERSECURITY POLICIES

Retrieved from (Touhill & Touhill, 2014, Page 197)
1. Acceptable Use Policy	6. Employee Internet UseMonitoring and Filtering Policy	11. Remote Access Policy
2. Computer Ethics Policy	7. Technology Disposal Policy	12. Mobile Device Policy
3. Password Protection Policy	8. Physical Security Policy	13. Software Policy
4. Clean Desk Policy	9. Electronic Mail Policy	14. Access Control Policy
5, Use of the Internet Policy	10. Removable Media Policy	15. Network Management Policy

TABLE VII.

APPENDIX C. CYBER SECURITY METRICS

Question	Metric Category	Metric
How Vulnerable Are We	1.0	Number of Threats Detected
	1.0.1	How many times are we being “pinged” and “probed”?
	1.0.2	How much spam is filtered?
	1.0.3	How many phishing messages are we receiving?
	1.0.4	Who is targeting us?
	1.1	Number of Known Vulnerabilities
	1.1.1	System vulnerabilities
	1.1.1.1	Number of vulnerabilities discovered
	1.1.1.2	Percentage of vulnerabilities mitigated in prescribed time frames
	1.1.1.3	Number of residual vulnerabilities
	1.1.2	Other Vulnerabilities
	1.1.2.1	Percentage of systems and devices beyond projected life span
	1.1.2.2	Percentage of software beyond projected life span
	1.2	How Many Cyber security Incidents Have We Detected?
	1.2.1	Number of cybersecurity incidents detected
	1.2.2	Number of detected cybersecurity incidents by category
	1.2.3	Cost per incident
	1.2.4	Who is responsible for cyber security incidents
How Effective Are Our Systems and Processes?	2.0	Network Performance Measures
	2.0.1	Network Performance Measurement
	2.0.2	How does network performance compare to previous measurements?
	2.0.3	Percentage of devices with current security software
	2.1	Change Management
	2.1.1	Number of unauthorized changes, Unauthorized changes to your systems are not good
	2.1.2	Percentage of maintenance successfully accomplished within schedule and budget
	2.2	Software configuration management
	2.2.1	Percentage of software current with all known patches. This is a critical cybersecurity measure. It makes sense to patch your soft
	2.2.2	Number of unauthorized software and media detected on network and devices
	2.3	Physical Security
	2.3.1	Number of physical security incidents allowing unauthorized access into facilities
	2.3.2	Number of violations of clean desk policy
	2.4	Acquisition
	2.4.1	Percentage of System and service contracts that include security Requirements and/or Specifications
Do we have the right people, are they properly trained, and are they following proper procedures?	3.0	Percentage of employees who have current Cybersecurity training
	3.1	Percent of technical staff with current certifications
	3.2	Number of Users with system administrator privileges
	3.3	Number of security violations during reporting period
	3.4	Percentage of security incidents/violations reported within required timelines
Am I Spending the Right Amount on Seurity?	4.0	Cyber security Costs
	4.0.1	Percentage of the IT budget devoted to cybersecurity
	4.0.2	Percentage of the organization budget devoted to cybersecurity
	4.0.3	Execution of current budget
	4.1	Value of Information
	4.2	Consequences of Information loss, Tampering, or Destruction
	4.2.1	Cost to replace
	4.2.2	Estimated costs associated with loss, tampering, or destruction of information
	4.2.3	Estimated costs associated with regulatory fines for failing compliance
	4.3	Cybersecurity Risk Exposure
	4.3.1	Cybersecurity risk

TABLE VIII.

APPENDIX D. CHECKLIST FOR CEO(EXECUTIVES IN GENERAL)

Appendix D. Checklist for CEO (Executives in general)
Retrieved from (Vantage Point, 2016)
Before an Incident
1 - Stay current on the latest threads and cyber security best practices	4 - Research, design, and deploy security technology. Consider access control, data security, training, processes, and procedures	7 - Ensure the response plan covers communications, analysis, mitigation, and other critical tasks	10 - Discuss with counsel whether cybersecurity risk factors in the company should be disclosed (i.e. SEC 10-K filings) in public
2 - Designate a board committee tasked with cyber security responsibilities. Establish links between board and C-level executives, specially CIO and CISO	5 - Develop and deploy the appropriate systems to identify a cyber security event as soon as possible	8 - Run practice drills to test the plan and revise it as needed	11 - Obtain liability insurance specifically covering cyber security risk for directors and officers as well as for the corporation
3 - Identify the firm’s security posture and the risks to the company. Assess the company’s systems, assets, data, and capabilities. And identify risks unique to your industry	6 - Create an incident response plan that lays out who reports to whom. Build m contingencies in case some people are unavailable at the time of an incident	9 - Establish a recovery plan to restore any capabilities or services impaired by a breach and to protect the company from further attacks	12 - To limit the company’s liability in certain kinds of attacks, consider cyber security vendors certified by U.S. Department of Homeland Security’s SAFETY (“Support Anti-Terrorism By Fostering Effective Technologies”) Act

TABLE IX.

ONE EVENT FOLLOWED BY ANOTHER

During an Incident
1 - Oversee an incident response. Serve as a conduit between incident responders within the company and external stakeholders including customers, partners, and regulators	2 - Understand that news of the incident usually comes to the company from outsiders, such as law enforcement or partner companies. Keeping the event under wraps is no longer very likely	3 - Work closely with your legal counsel and public relations team to advise C-level executives about how to disclose incident details, especially to news media. Don’t disclose facts until they’ve been verified	4 - Stay in touch with your response team to assist as needed during response and through remediation
After an Incident
1 - After a breach has been repaired, intruders ejected, and systems restored, assist in damage control to fix the company’s infrastructure and reputation	2 - Review incident response to assess how it went. Identify weaknesses in equipment, systems, and procedures to determine where to make improvements	3 - With guidance from your legal counsel, determine how to make customers whole if their data was exposed or stolen	4 - Consider offering free credit monitoring, issuing new account numbers, and so on. Identify the “chum rate”. Counsel can advise as to any consumer remedies required by law