Page 47 - Cyber Warnings

simple and logical; smaller businesses do not have the associated larger budgets to spend on
security technology or services and they also do not have the in-house expertise to manage and
interpret the threats and methodologies criminals use to infiltrate business systems.

Smaller companies who service larger corporates are more likely to be targeted due to their
association and interconnectivity. There is the classic example from 2013 of the American
retailer Target who suffered one of the largest data breaches so far, (which is estimated to have
cost the company $252 million), the breach emanating from one of the companies air
conditioning providers who had network access to monitor HVCA activity on chillers.

This associated company were targeted as a result of the nature of their association with larger
companies. Forensic analysis concluded that Target had been breached for over 12 months
before any data was exfiltrated. One of the most telling judgements against the company was
that Target failed to employ reasonable and appropriate security measures to protect personal
information.

So what are “reasonable and appropriate security measures”? Companies generally put into
place a series of important stock defences in order to counter the “general” threat of hackers.
These usually amount to; a firewall, email screening or filtering, web filtering, VPN technology
for remote access, Anti-Virus/Malware for end-point protection.

Ecommerce organisations such as Target might deploy encryption for credit card information
and some form of Intruder Detection System (IDS) and Intruder Protection System (IPS).

Some form of Data Leak Prevention (DLP) where files have a unique digital signature which is
prevented from leaving the system it resides in. As we list the security systems needed here the
growing questions are around the cost, management, maintenance and sheer manpower to
interpret and utilise these disparate systems.

THREATS

Security comes from intelligence and the divination of threats that are as yet unseen, which
covertly remain undetected.
In February 2002 the United States Secretary of Defence, Donald Rumsfeld, famously said
“Reports that say that something hasn't happened are always interesting to me, because as we
know, there are known knowns; there are things we know we know.

We also know there are known unknowns; that is to say we know there are some things we do
not know.

But there are also unknown unknowns – the ones we don't know we don't know.” Although
Rumsfeld was heavily lampooned in the press and criticised at the time for the statement which
was initially seen as being nonsense, careful analysis of the statement reveals that most
scientific research and investigation is based on investigating the known unknowns.

47 Cyber Warnings E-Magazine – July 2017 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide