Cyber Security Planning Guide
Cyber Security Planning Guide
The below entities collaborated in the creation of this guide. This does not constitute or imply an endorsement by the FCC of any commercial product, service or enterprise of these entities. This guide is not a substitute for consulting trained cyber security professionals.
Table of Contents
Thank you for using the FCCs Small Biz Cyber Planner, a tool for small businesses to create customized cyber security planning guides. Businesses large and small need to do more to protect against growing cyber threats. As larger companies take steps to secure their systems, less secure small businesses are easier targets for cyber criminals. This planning guide is designed to meet the specific needs of your company, using the FCCs customizable Small Biz Cyber Planner tool. The tool is designed for businesses that lack the resources to hire dedicated staff to protect their business, information and customers from cyber threats. Even a business with one computer or one credit card terminal can benefit from this important tool. We generally recommend that businesses using more sophisticated networks with dozens of computers consult a cyber security expert in addition to using the cyber planner. The FCC provides no warranties with respect to the guidance provided by this tool and is not responsible for any harm that might occur as a result of or in spite of its use. The guidance was developed by the FCC with input from public and private sector partners, including the Department of Homeland Security, the National Cybersecurity Alliance and The Chamber of Commerce.
Section
Privacy and Data Security Scams and Fraud Network Security Website Security Email Mobile Devices Employees Facility Security Operational Security Payment Cards Incident Response and Reporting Policy Development, Management Cyber Security Glossary Cyber Security Links
Page #s
PDS-1 - PDS-2 SF-1 - SF-3 NS-1 - NS-2 WS-1 - WS-4 E-1 - E-2 MD-1 - MD-3 EMP-1 - EMP-3 FS-1 - FS-2 OS-1 - OS-3 PC-1 - PC-2 IRR-1 - IRR-2 PDM-1 - PDM-2 CSG-1 - CSG-10 CSL-1 - CSL-3
TC-1
Depending on the types of data regularly handled by your business, it may also make sense to create separate policies governing who is responsible for certain types of data. For example, a business that handles large volumes of personally identifiable information (PII) from its customers may benefit from identifying a chief steward for customers privacy information. The steward could serve not only as a subject matter expert on all matters of privacy, but also to serve as the champion for process and technical improvements to PII handling.
PDM-1
Lastly, all users of social media need to be aware of the risks associated with social networking tools and the types of data that can be automatically disclosed online when using social media. Taking the time to educate your employees on the potential pitfalls of social media use, especially in tandem with geo-location services, may be the most beneficial social networking security practice of all.
All businesses should set a policy for managing these types of risks and plans to address such incidents if and when they occur. Such a policy should cover a regular process for identifying potential risks to the companys reputation in cyberspace, practical measures to prevent those risks from materializing and reference plans to respond and recover from potential incidents as soon as they occur.
Helpful links
US-CERTs Protect Your Workplace Posters & Brochure: http://www.us-cert.gov/reading_room/distributable.html Socializing Securely: Using Social Networking Services: http://www.us-cert.gov/reading_room/safe_social_networking.pdf Governing for Enterprise Security: http://www.cert.org/governance/ FFIEC Handbook Definition of Reputation Risk: http://ithandbook.ffiec.gov/it-booklets/retail-payment-systems/retail-payment-systems-riskmanagement/reputation-risk.aspx What Businesses can do to help with cyber security: http://www.staysafeonline.org/sites/default/files/resource_documents/What%20Businesses%20Can%20Do %202011%20Final_0.pdf
PDM-2
SF-1
This advice is especially critical for protecting online banking accounts belonging to your organization. Criminals are targeting small business banking accounts more than any other sector.
SF-2
Helpful links
Find the most updated patches for your computer and software applications: http://www.softwarepatch.com/ Free computer security scan tools for your PC or network: http://www.staysafeonline.org/tools-resources/free-security-check-ups Stay on top of the latest scams, frauds and security threats as they happen: http://nakedsecurity.sophos.com/ Additional tops to prevent against phishing: http://www.fraud.org/tips/internet/phishing.htm Learn how to resist phishing techniques with this interactive game: http://cups.cs.cmu.edu/antiphishing_phil/
SF-3
Network Security
Securing your companys network consists of: (1) identifying all devices and connections on the network; (2) setting boundaries between your companys systems and others; and (3) enforcing controls to ensure that unauthorized access, misuse, or denial-of-service events can be thwarted or rapidly contained and recovered from if they do occur.
Cyber Plan Action Items: 1. Secure internal network and cloud services
Your companys network should be separated from the public Internet by strong user authentication mechanisms and policy enforcement systems such as firewalls and web filtering proxies. Additional monitoring and security solutions, such as anti-virus software and intrusion detection systems, should also be employed to identify and stop malicious code or unauthorized access attempts.
Internal network
After identifying the boundary points on your companys network, each boundary should be evaluated to determine what types of security controls are necessary and how they can be best deployed. Border routers should be configured to only route traffic to and from your companys public IP addresses, firewalls should be deployed to restrict traffic only to and from the minimum set of necessary services, and intrusion prevention systems should be configured to monitor for suspicious activity crossing your network perimeter. In order to prevent bottlenecks, all security systems you deploy to your companys network perimeter should be capable of handling the bandwidth that your carrier provides.
NS-1
Internal, non-public WLAN access should be restricted to specific devices and specific users to the greatest extent possible while meeting your companys business needs. Where the internal WLAN has less stringent access controls than your companys wired network, dual connections -- where a device is able to connect to both the wireless and wired networks simultaneously -- should be prohibited by technical controls on each such capable device (e.g., BIOS-level LAN/WLAN switch settings). All users should be given unique credentials with preset expiration dates to use when accessing the internal WLAN.
Wireless encryption
Due to demonstrable security flaws known to exist in older forms of wireless encryption, your companys internal WLAN should only employ Wi-Fi Protected Access 2 (WPA2) encryption.
Helpful links
Microsoft Password Strength Checker: https://www.microsoft.com/security/pc-security/password-checker.aspx Philip Zimmerman, Where to Get PGP: http://philzimmermann.com/EN/findpgp/ US-CERT Security Publications: http://www.us-cert.gov/reading_room/ NIST Special Publication 800-153, Draft Guidelines for Securing Wireless Local Area Networks (WLANs): http://csrc.nist.gov/publications/drafts/800-153/Draft-SP800-153.pdf
NS-2
Website Security
Website security is more important than ever. Web servers, which host the data and other content available to your customers on the Internet, are often the most targeted and attacked components of a companys network. Cyber criminals are constantly looking for improperly secured websites to attack, while many customers say website security is a top consideration when they choose to shop online. As a result, it is essential to secure servers and the network infrastructure that supports them. The consequences of a security breach are great: loss of revenues, damage to credibility, legal liability and loss of customer trust. The following are examples of specific security threats to web servers: Cyber criminals may exploit software bugs in the web server, underlying operating system, or active content to gain unauthorized access to the web server. Examples of unauthorized access include gaining access to files or folders that were not meant to be publicly accessible and being able to execute commands and/or install malicious software on the web server. Denial-of-service attacks may be directed at the web server or its supporting network infrastructure to prevent or hinder your website users from making use of its services. Sensitive information on the web server may be read or modified without authorization. Sensitive information on backend databases that are used to support interactive elements of a web application may be compromised through the injection of unauthorized software commands. Examples include Structured Query Language (SQL) injection, Lightweight Directory Access Protocol (LDAP) injection and cross-site scripting (XSS). Sensitive unencrypted information transmitted between the web server and the browser may be intercepted. Information on the web server may be changed for malicious purposes. Website defacement is a commonly reported example of this threat. Cyber criminals may gain unauthorized access to resources elsewhere in the organizations network via a successful attack on the web server. Cyber criminals may also attack external entities after compromising a web server. These attacks can be launched directly (e.g., from the compromised server against an external server) or indirectly (e.g., placing malicious content on the compromised web server that attempts to exploit vulnerabilities in the web browsers of users visiting the site). The server may be used as a distribution point for attack tools, pornography or illegally copied software.
Cyber Plan Action Items: 1. Carefully plan and address the security aspects of the deployment of a public web server.
Because it is much more difficult to address security once deployment and implementation have occurred, security should be considered from the initial planning stage. Businesses are more likely to make decisions about configuring computers appropriately and consistently when they develop and use a detailed, well-designed deployment plan. Developing such a plan will support web server administrators in making the inevitable tradeoff decisions between usability, performance and risk. Businesses also need to consider the human resource requirements for the deployment and continued operation of the web server and supporting infrastructure. The following points in a deployment plan: Types of personnel required -- for example, system and web server administrators, webmasters, network administrators and information systems security personnel. Skills and training required by assigned personnel. Individual (i.e., the level of effort required of specific personnel types) and collective staffing (i.e., overall level of effort) requirements.
WS-1
2. Implement appropriate security management practices and controls when maintaining and operating a secure web server.
Appropriate management practices are essential to operating and maintaining a secure web server. Security practices include the identification of your companys information system assets and the development, documentation and implementation of policies, and guidelines to help ensure the confidentiality, integrity and availability of information system resources. The following practices and controls are recommended: A business-wide information system security policy. Server configuration and change control and management. Risk assessment and management. Standardized software configurations that satisfy the information system security policy. Security awareness and training. Contingency planning, continuity of operations and disaster recovery planning. Certification and accreditation.
3. Ensure that web server operating systems meet your organizations security requirements.
The first step in securing a web server is securing the underlying operating system. Most commonly available web servers operate on a general-purpose operating system. Many security issues can be avoided if the operating systems underlying web servers are configured appropriately. Default hardware and software configurations are typically set by manufacturers to emphasize features, functions and ease of use at the expense of security. Because manufacturers are not aware of each organizations security needs, each web server administrator must configure new servers to reflect their business security requirements and reconfigure them as those requirements change. Using security configuration guides or checklists can assist administrators in securing systems consistently and efficiently. Initially securing an operating system initially generally includes the following steps: Patch and upgrade the operating system. Change all default passwords Remove or disable unnecessary services and applications. Configure operating system user authentication. Configure resource controls. Install and configure additional security controls. Perform security testing of the operating system.
4. Ensure the web server application meets your organizations security requirements.
In many respects, the secure installation and configuration of the web server application will mirror the operating system process discussed above. The overarching principle is to install the minimal amount of web server services required and eliminate any known vulnerabilities through patches or upgrades. If the installation program installs any unnecessary applications, services or scripts, they should be removed immediately after the installation process concludes. Securing the web server application generally includes the following steps: Patch and upgrade the web server application. Remove or disable unnecessary services, applications and sample content. Configure web server user authentication and access controls. Configure web server resource controls. Test the security of the web server application and web content.
WS-2
6. Ensure appropriate steps are taken to protect web content from unauthorized access or modification.
Although information available on public websites is intended to be public (assuming a credible review process and policy is in place), it is still important to ensure that information cannot be modified without authorization. Users of such information rely on its integrity even if the information is not confidential. Content on publicly accessible web servers is inherently more vulnerable than information that is inaccessible from the Internet, and this vulnerability means businesses need to protect public web content through the appropriate configuration of web server resource controls. Examples of resource control practices include: Install or enable only necessary services. Install web content on a dedicated hard drive or logical partition. Limit uploads to directories that are not readable by the web server. Define a single directory for all external scripts or programs executed as part of web content. Disable the use of hard or symbolic links. Define a complete web content access matrix identifying which folders and files in the web server document directory are restricted, which are accessible, and by whom. Disable directory listings. Deploy user authentication to identify approved users, digital signatures and other cryptographic mechanisms as appropriate. Use intrusion detection systems, intrusion prevention systems and file integrity checkers to spot intrusions and verify web content. Protect each backend server (i.e., database server or directory server) from command injection attacks.
7. Use active content judiciously after balancing the benefits and risks.
Static information resided on the servers of most early websites, typically in the form of text-based documents. Soon thereafter, interactive elements were introduced to offer new opportunities for user interaction. Unfortunately, these same interactive elements introduced new web-related vulnerabilities. They typically involve dynamically executing code using a large number of inputs, from web page URL parameters to hypertext transfer
WS-3
protocol (HTTP) content and, more recently, extensible markup language (XML) content. Different active content technologies pose different related vulnerabilities, and their risks should be weighed against their benefits. Although most websites use some form of active content generators, many also deliver some or all of their content in a static form.
8. Use authentication and cryptographic technologies as appropriate to protect certain types of sensitive data.
Public web servers often support technologies for identifying and authenticating users with differing privileges for accessing information. Some of these technologies are based on cryptographic functions that can provide a secure channel between a web browser client and a web server that supports encryption. Web servers may be configured to use different cryptographic algorithms, providing varying levels of security and performance. Without proper user authentication in place, businesses cannot selectively restrict access to specific information. All information that resides on a public web server is then accessible by anyone with access to the server. In addition, without some process to authenticate the server, users of the public web server will not be able to determine whether the server is the authentic web server or a counterfeit version operated by a cyber criminal. Even with an encrypted channel and an authentication mechanism, it is possible that attackers may attempt to access the site by brute force. Improper authentication techniques can allow attackers to gather valid usernames or potentially gain access to the website. Strong authentication mechanisms can also protect against phishing attacks, in which hackers may trick users into providing their personal credentials, and pharming, in which traffic to a legitimate website may be redirected to an illegitimate one. An appropriate level of authentication should be implemented based on the sensitivity of the web servers users and content.
WS-4
Email
Email has become a critical part of our everyday business, from internal management to direct customer support. The benefits associated with email as a primary business tool far outweigh the negatives. However, businesses must be mindful that a successful email platform starts with basic principles of email security to ensure the privacy and protection of customer and business information.
E-1
thumb is only as long as it supports your business efforts. Many companies implement a 60-90 day retention standard if not compelled by law to another retention period. To ensure compliance, companies should consider mandatory archiving at a chosen retention cycle end date and automatic permanent email removal after another set point, such as180-360 days in archives. In addition, organizations should discourage the use of personal folders on employee computers (most often configurable from the e-mail system level), as this will make it more difficult to manage company standards.
E-2
Mobile Devices
If your company uses mobile devices to conduct company business, such as accessing company email or sensitive data, pay close attention to mobile security and the potential threats that can expose and compromise your overall business networks. This section describes the mobile threat environment and the practices that small businesses can use to help secure devices such as smartphones, tablets and Wi-Fi enabled laptops. Many organizations are finding that employees are most productive when using mobile devices, and the benefits are too great to ignore. But while mobility can increase workplace productivity, allowing employees to bring their own mobile devices into the enterprise can create significant security and management challenges. Data loss and data breaches caused by lost or stolen phones create big challenges, as mobile devices are now used to store confidential business information and access the corporate network. According to a December 2010 Symantec mobile security survey, 68 percent of respondents ranked loss or theft as their top mobile-device security concern, while 56 percent said mobile malware is their number two concern. It is important to remember that while the individual employee may be liable for a device, the company is still liable for the data.
MD-1
MD-2
Helpful links
Teach your employees about mobile apps: http://onguardonline.gov/articles/0018-understanding-mobile-apps Keep your laptops secure: http://onguardonline.gov/articles/0015-laptop-security
MD-3
Employees
Businesses must establish formal recruitment and employment processes to control and preserve the quality of their employees. Many employers have learned the hard way that hiring someone with a criminal record, falsified credentials or undesirable background can create a legal and financial nightmare. Without exercising due diligence in hiring, employers run the risk of making unwise hiring choices that can lead to workplace violence, theft, embezzlement, lawsuits for negligent hiring and numerous other workplace problems.
Cyber Plan Action Items: 1. Develop a hiring process that properly vets candidates
The hiring process should be a collaborative effort among different groups of your organization, including recruitment, human resources, security, legal and management teams. It is important to have a solid application, resume, interview and reference-checking process to identify potential gaps and issues that may appear in a background check. An online employment screening resource called the Online Safe Hiring Certification Course can help you set the groundwork for a safe recruitment process. The course will teach your teams what to look for in the different stages of the hiring process, how to interview and how to set up a safe hiring program to avoid hiring an employee that may be problematic. The course is available here: http://www.esrcheck.com/ESRonlineSafeHiringCourse.php.
Depending on the type of your business, other screening criteria may consist of credit check, civil checks and federal criminal checks. Conducting post-hire checks for all employees every two to three years, depending on your industry, is also recommended. If you do conduct background checks, you as an employer have obligations under the Fair Credit Reporting Act. For more information about employer obligations under the FCRA, visit http://business.ftc.gov/documents/bus08using-consumer-reports-what-employers-need-know.
EMP-1
EMP-2
security policy, and following rules established to avoid social engineering attacks and deter the spread of spam or viruses and worms. A clear categorization of what is considered sensitive data versus non-sensitive data is also needed. Typically, the following data are considered sensitive information that should be handled with precaution: Government issued identification numbers (e.g., Social Security numbers, drivers license numbers) Financial account information (bank account numbers, credit card numbers) Medical records Health insurance information Salary information Passwords
The training should cover security policies for all means of access and transmission methods, including secure databases, email, file transfer, encrypted electronic media and hard copies. Employers should constantly emphasize the critical nature of data security. Regularly scheduled refresher training courses should be established in order to instill the data security culture of your organization. Additionally, distribute data privacy and security related news articles in your training, and send organization-wide communication on notable data privacy related news as reminders to your employees.
Helpful links
Internet Safety at Work PowerPoint Presentation: http://go.microsoft.com/?linkid=9745638 Tip Cards: Top Tips for Internet Safety at Work: http://go.microsoft.com/?linkid=9745642 Video: "Stay Sharp on Internet Safety at Work": http://go.microsoft.com/?linkid=9745640
EMP-3
Facility Security
Protecting employees and members of the public who visit your facility is a complex and challenging responsibility. Its also one of your companys top priorities.
Cyber Plan Action Items: 1. Recognize the importance of securing your company facilities
The physical security of a facility depends on a number of security decisions that can be identified through a comprehensive risk-management process. The objective of risk management is to identify an achievable level of protection for your company that corresponds as closely as possible to the level of risk without exceeding the risk. It is easy to think about physical security of your companys facility as merely an exercise in maintaining control of access points and ensuring there is complete visibility in areas that are determined to be of high-risk either because of the threat of easy public access or because of the value of information located nearby. However, maintaining security of your companys facility also includes the physical environment of public spaces. For instance: Employees whose computers have access to sensitive information should not have their computer monitors oriented toward publicly accessible spaces such as reception areas, check-in desks and waiting rooms. Employees should be trained to not write out logins and passwords on small pieces of paper affixed to computer equipment viewable in public spaces. Easy-to-grab equipment that could contain sensitive or personally identifiable information such as laptops, electronic tablets and cell phones should be located away from public areas. If you have an environment where employees are working in a waiting room or reception area, train them to not leave these types of devices out on their desks unsecured. Consider implementing a badge identification system for all employees, and train employees to stop and question anyone in the operational business area without a badge or who appears to be an unescorted visitor.
FS-1
FS-2
Operational Security
While operational security, or OPSEC, has its origins in securing information important to military operations, it has applications across the business community today. In a commercial context, OPSEC is the process of denying hackers access to any information about the capabilities or intentions of a business by identifying, controlling and protecting evidence of the planning and execution of activities that are essential the success of operations. OPSEC is a continuous process that consists of five distinct actions: Identify information that is critical to your business. Analyze the threat to that critical information. Analyze the vulnerabilities to your business that would allow a cyber criminal to access critical information. Assess the risk to your business if the vulnerabilities are exploited. Apply countermeasures to mitigate the risk factors.
In addition to being a five-step process, OPSEC is also a mindset that all business employees should embrace. By educating oneself on OPSEC risks and methodologies, protecting sensitive information that is critical to the success of your business becomes second nature. This section explains the OPSEC process and provides some general guidelines that are applicable to most businesses. An understanding of the following terms is required before the process can be explained: Critical information Specific data about your business strategies and operations that are needed by cyber criminals to hamper or harm your business from successfully operating. OPSEC indicators Business operations and publicly available information that can be interpreted or pieced together by a cyber criminal to derive critical information. OPSEC vulnerability A condition in which business operations provide OPSEC indicators that may be obtained and accurately evaluated by a cyber criminal to provide a basis for hampering or harming successful business operations.
OS-1
Importantly, what is critical information for one business may not be critical for another business. Use your companys mission as a guide for determining what data are truly vital.
2. Analyze threats
This action involves research and analysis to identify likely cyber criminals who may attempt to obtain critical information regarding your companys operations. OPSEC planners in your business should answer the following critical information questions: Who might be a cyber criminal (e.g. competitors, politically motivated hackers, etc.)? What are cyber criminals goals? What actions might the cyber criminal take? What critical information does the cyber criminal already have on your companys operations? (i.e., what is already publicly available?)
3. Analyze vulnerabilities
The purpose of this action is to identify the vulnerabilities of your business in protecting critical information. It requires examining each aspect of security that seeks to protect your critical information and then comparing those indicators with the threats identified in the previous step. Common vulnerabilities for small businesses include the following: Poorly secured mobile devices that have access to critical information. Lack of policy on what information and networked equipment can be taken home from work or taken abroad on travel. Storage of critical information on personal email accounts or other non-company networks. Lack of policy on what business information can be posted to or accessed by social network sites.
4. Assess risk
This action has two components. First, OPSEC managers must analyze the vulnerabilities identified in the previous action and identify possible OPSEC measures to mitigate each one. Second, specific OPSEC measures must be selected for execution based upon a risk assessment done by your companys senior leadership. Risk assessment requires comparing the estimated cost associated with implementing each possible OPSEC measure to the potential harmful effects on business operations resulting from the exploitation of a particular vulnerability. OPSEC measures may entail some cost in time, resources, personnel or interference with normal operations. If the cost to achieve OPSEC protection exceeds the cost of the harm that an intruder could inflict, then the application of the measure is inappropriate. Because the decision not to implement a particular OPSEC measure entails risks, this step requires your companys leadership approval.
OS-2
Helpful links
These resources provide additional information on the origins, purpose and implementation of operational security. National Security Agency/Central Security Service, PURPLE DRAGON: The Origin and Development of the United States OPSEC Program (1993): http://www.nsa.gov/public_info/_files/cryptologic_quarterly/purple_dragon.pdf Joint Publication 3-13.3, Operations Security (29 June 2006): Available through Joint Doctrine Education and Training Electronic Information System (JDEIS): http://www.iad.gov/ioss/media/documents/Joint_Pub_3-13-3.pdf National OPSEC Program: https://www.iad.gov/ioss/ OPSEC Professionals Society: http://opsecsociety.org/ Operations Security Professionals Association: http://www.opsecprofessionals.org/
OS-3
Payment Cards
If your business accepts payment by credit or debit cards, it is important to have security steps in place to ensure your customer information is safe. You also may have security obligations pursuant to agreements with your bank or payment services processor. These entities can help you prevent fraud. In addition, free resources and general security tips are available to learn how to keep sensitive information beyond payment information safe.
Cyber Plan Action Items: 1. Understand and catalog customer and card data you keep
Make a list of the type of customer and card information you collect and keep names, addresses, identification information, payment card numbers, magnetic stripe data, bank account details and Social Security numbers. Its not only card numbers criminals want; theyre looking for all types of personal information, especially if it helps them commit identity fraud; Understand where you keep such information and how it is protected. Determine who has access to this data and if they need to have access.
2. Evaluate whether you need to keep all the data you store
Once you know what information you collect and store, evaluate whether you really need to keep it. Often businesses may not realize theyre logging or otherwise keeping unnecessary data until they conduct an audit. Not keeping sensitive data in storage makes it harder for criminals to steal it; If youve been using card numbers for purposes other than payment transactions, such as a customer loyalty program, ask your merchant processor if you can use alternative data instead. Tokenization, for example, is technology that masks card numbers and replaces it with an alternate number that cant be used for fraud.
PC-1
For e-commerce retailers: - The CVV2 code is the three-digit number on the signature panel that can help verify that the customer has physical possession of the card and not just the account number. - Retailers can also use Address Verification Service to ensure the cardholder has provided the correct billing address associated with the account. - Services such as Verified by Visa prompt the cardholder to enter a personal password confirming their identity and providing an extra layer of protection. For brick and mortar retailers: - Swipe the card and get an electronic authorization for the transaction. - Check that the signature matches the card. - Ensure your payment terminal is secure and safe from tampering.
Helpful links
You dont have to tackle security on your own. Work with your bank or processor to make sure youre getting the support and expertise you need. Visa offers a data security guide for small business as part of its Cardholder Information Security Program: http://usa.visa.com/merchants/risk_management/data_security_demo/popup.html Information about industry security standards is available from the PCI Security Standards Council: https://www.pcisecuritystandards.org The Paysimple.com blog offers a helpful post on credit card security: http://paysimple.com/blog/2011/09/01/5-tips-for-proper-handling-of-customer-credit-card-accountinformation/ American Express provides data security advice for merchants: https://www260.americanexpress.com/merchant/singlevoice/dsw/FrontServlet?request_type=dsw&pg_nm= merchinfo&ln=en&frm=US MasterCard offers resources for on safeguarding customer information: http://www.mastercard.com/us/business/en/smallbiz/resources/industry/ecommerce/articles/0802CustomerData.html
PC-2
Types of breaches
Physical breaches include real-world crimes such as burglaries and equipment theft, as well as any event when your companys equipment is misplaced or lost in transit. Unauthorized devices may be installed on a system or network, permitting further compromises of data confidentiality and integrity. Physical breaches can also result from reselling, donating or recycling old equipment that has not been properly cleansed of potentially sensitive information. Network and system security breaches include events when computers become infected with malicious code, are accessed by unauthorized individuals remotely or are used by authorized individuals to perform malicious activity. This can also include breaches to network routers and firewalls, both within and outside your organizations boundary and control. Data breaches, meaning the leakage or spillage of sensitive information into insecure channels, can result from any of the types of events described above. Data breaches can also occur if sensitive information is left improperly exposed by mistake.
Cyber Plan Action Items, if Breach Occurs: 1. Notify law enforcement if necessary
Depending on the type of breach and type of business, your company may be required to notify local law enforcement or other government authorities upon discovery of a data breach. In the event of exposure of customer information, you should notify the customer(s) of the incident, record the data that was lost or exposed and record the measures taken to ensure against future exposure.
2. Work cohesively across technical and leadership teams to limit the damage
Once your company becomes aware that a breach has occurred, technical personnel and business decision makers should work together to decide on the most practical and effective containment plan. Containment plans will vary from one set of circumstances to the next, and they may quickly become intensive in terms of time and resources from both the technological and business impact perspectives. In any case, the containment of data breaches should be focused on determining the extent of the compromise and preserving the confidentiality and integrity of sensitive data that has not yet been stolen or disclosed. Other issues affecting the selection and execution of a containment plan include your companys reputation-risk management strategy and the decision on whether to request outside assistance either from local or federal law enforcement, a private consulting firm or a computer incident response organization such as US-CERT.
IRR-1
careful restoration of data from backups. Bear in mind that backups may also contain malicious code and should be carefully checked for compromise; otherwise, the security breach will be perpetuated after the recovery phase.
IRR-2
Depending on the types of data regularly handled by your business, it may also make sense to create separate policies governing who is responsible for certain types of data. For example, a business that handles large volumes of personally identifiable information (PII) from its customers may benefit from identifying a chief steward for customers privacy information. The steward could serve not only as a subject matter expert on all matters of privacy, but also to serve as the champion for process and technical improvements to PII handling.
PDM-1
Lastly, all users of social media need to be aware of the risks associated with social networking tools and the types of data that can be automatically disclosed online when using social media. Taking the time to educate your employees on the potential pitfalls of social media use, especially in tandem with geo-location services, may be the most beneficial social networking security practice of all.
All businesses should set a policy for managing these types of risks and plans to address such incidents if and when they occur. Such a policy should cover a regular process for identifying potential risks to the companys reputation in cyberspace, practical measures to prevent those risks from materializing and reference plans to respond and recover from potential incidents as soon as they occur.
Helpful links
US-CERTs Protect Your Workplace Posters & Brochure: http://www.us-cert.gov/reading_room/distributable.html Socializing Securely: Using Social Networking Services: http://www.us-cert.gov/reading_room/safe_social_networking.pdf Governing for Enterprise Security: http://www.cert.org/governance/ FFIEC Handbook Definition of Reputation Risk: http://ithandbook.ffiec.gov/it-booklets/retail-payment-systems/retail-payment-systems-riskmanagement/reputation-risk.aspx What Businesses can do to help with cyber security: http://www.staysafeonline.org/sites/default/files/resource_documents/What%20Businesses%20Can%20Do %202011%20Final_0.pdf
PDM-2
CSG-1
Bandwidth The capacity of a communication channel to pass data such as text, images, video or sound through the channel in a given amount of time. Usually expressed in bits per second. Blacklisting Software A form of filtering that blocks only websites specified as harmful. Parents and employers sometimes use such software to prevent children and employees from visiting certain websites. You can add and remove sites from the not permitted list. This method of filtering allows for more full use of the Internet, but is less efficient at preventing access to any harmful material that is not on the list. See also Whitelisting Software. Blended Threat A computer network attack that seeks to maximize the severity of damage and speed of contagion by combining methodsfor example, using characteristics of both viruses and worms. See also Electronic Infection. Blog Short for Web log, a blog is usually defined as an online diary or journal. It is usually updated frequently and offered in a dated log format with the most recent entry at the top of the page. It often contains links to other websites along with commentary about those sites or specific subjects, such as politics, news, pop culture or computers. Broadband General term used to refer to high-speed network connections such as cable modem and Digital Subscriber Line (DSL). These types of always on Internet connections are actually more susceptible to some security threats than computers that access the Web via dial-up service. Browser A client software program that can retrieve and display information from servers on the World Wide Web. Often known as a Web browser or Internet browser, Examples include Microsofts Internet Explorer, Googles Chrome, Apples Safari, and Mozillas Firefox. Brute Force Attack An exhaustive password-cracking procedure that tries all possibilities, one by one. See also Dictionary Attack and Hybrid Attack. Clear Desk Policy A policy that directs all personnel to clear their desks at the end of each working day, and file everything appropriately. Desks should be cleared of all documents and papers, including the contents of the in and out trays not simply for cleanliness, but also to ensure that sensitive papers and documents are not exposed to unauthorized persons outside of working hours.
CSG-2
Clear Screen Policy A policy that directs all computer users to ensure that the contents of the screen are protected from prying eyes and opportunistic breaches of confidentially. Typically, the easiest means of compliance is to use a screen saver that engages either on request or after a specified short period of time. See also Shoulder Surfing. Cookie A small file that is downloaded by some websites to store a packet of information on your browser. Companies and organizations use cookies to remember your login or registration identification, site preferences, pages viewed and online shopping-cart so that the next time you visit a site, your stored information can automatically be pulled up for you. A cookie is obviously convenient but also presents potential security issues. You can configure your browser to alert you whenever a cookie is being sent. You can refuse to accept all cookies or erase all cookies saved on your browser. Credit Card A card indicating the holder has been granted a line of credit. Often sought after by criminals looking for an easy way to purchase things without having to pay for them. For this reason and others, a credit card preferable to a debit card for online shopping since it provides a buffer between buyer and seller, affording more protections to the buyer in case there is a problem with the order or the card number is compromised. See also Debit Card. Cyberbullying Sending or posting harmful, cruel, rude or threatening messages, or slanderous information, text or images using the Internet or other digital communication devices. Debit Card A card linked directly to the holders bank account, withdrawing money from the account. Not as safe as credit cards for online shopping since if problems arise, the buyers money has already been spent and is harder to get back. See also Credit Card. Denial of Service Attack The prevention of authorized access to a system resource or the delaying of system operations and functions. Often this involves a cyber criminal generating a large volume of data requests. See also Flooding. Dictionary Attack A password-cracking attack that tries all of the phrases or words in a dictionary. See also Brute Force Attack and Hybrid Attack.
CSG-3
Digital Certificate The electronic equivalent of an ID card that establishes your credentials when doing business or other transactions on the Web. It contains your name, a serial number, expiration dates, a copy of the certificate holders public key (used for encrypting messages and digital signatures) and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real. Domain Hijacking An attack in which an attacker takes over a domain by first blocking access to the domains DNS server and then putting his own server up in its place. Domain Name System (DNS) The DNS is the way that Internet domain names are located. A websites domain name is easier to remember than its IP (Internet Protocol) address. Dumpster Diving Recovering files, letters, memos, photographs, IDs, passwords, checks, account statements, credit card offers and more from garbage cans and recycling bins. This information can then be used to commit identity theft. Electronic Infections Often called viruses, these malicious programs and codes harm your computer and compromise your privacy. In addition to the traditional viruses, other common types include worms and Trojan horses. They sometimes work in tandem to do maximum damage. See also Blended Threat. Encryption A data security technique used to protect information from unauthorized inspection or alteration. Information is encoded so that it appears as a meaningless string of letters and symbols during delivery or transmission. Upon receipt, the information is decoded using an encryption key. End User License Agreement (EULA) A contract between you and your softwares vendor or developer. Many times, the EULA is presented as a dialog box that appears the first time you open the software and forces you to check I accept before you can proceed. Before accepting, though, read through it and make sure you understand and are comfortable with the terms of the agreement. If the softwares EULA is hard to understand or you cant find it, beware! Evil Twins A fake wireless Internet hot spot that looks like a legitimate service. When victims connect to the wireless network, a hacker can launch a spying attack on their transactions on the Internet, or just ask for credit card information in the standard pay-for-access deal. See also Man-in-the-Middle Attacks.
CSG-4
File-Sharing Programs Sometimes called peer-to-peer (P2P) programs, these allow many different users to access the same file at the same time. These programs are often used to illegally upload and download music and other software. Examples include Napster, Grokster, Kazaa, iMesh, Ares and Limewire. Firewall A hardware or software link in a network that inspects all data packets coming and going from a computer, permitting only those that are authorized to reach the other side. Flooding An attack that attempts to cause a failure in the security of a computer by providing more input, such as a large volume of data requests, than it can properly process. See also Denial of Service Attack. Grooming Using the Internet to manipulate and gain trust of a minor as a first step towards the future sexual abuse, production or exposure of that minor. Sometimes involves developing the childs sexual awareness and may take days, weeks, months or in some cases years to manipulate the minor. Hacker An individual who attempts to break into a computer without authorization. HTTPS When used in the first part of a URL (e.g., http://), this term specifies the use of hypertext transfer protocol (HTTP) enhanced by a security mechanism such as Secure Socket Layer (SSL). Always look for the HTTPS on the checkout or order form page when shopping online or when logging into a site and providing your username and password. Hybrid Attack Builds on other password-cracking attacks by adding numerals and symbols to dictionary words. See also Dictionary Attack and Brute Force Attack. Instant Messaging (IM) A service that allows people to send and get messages almost instantly. To send messages using instant messaging you need to download an instant messaging program and know the instant messaging address of another person who uses the same IM program. See also Spim. IP (Internet Protocol) Address A computers inter-network address, written as a series of four 8-bit numbers separated by periods, such as 123.45.678.990. Every website has an IP Address, although finding a website is considerably easier to do when using its domain name instead. See also Domain Name System (DNS).
CSG-5
Internet Service Provider (ISP) A company that provides internet access to customers. Keystroke Logger A specific type of electronic infection that records victims keystrokes and sends them to an attacker. This can be done with either hardware or software. See also Trojan Horse. Malware A generic term for a number of different types of malicious code. See also Adware and Spyware. Man-In-the-Middle Attack Posing as an online bank or merchant, a cyber criminal allows a victim to sign in over a Secure Sockets Layer (SSL) connection. The attacker then logs onto the real server using the clients information and steals credit card numbers. Monitoring Software Software products that allow parents to monitor or track the websites or email messages that a child visits or reads. See also Blacklisting Software and Whitelisting Software. Network Two or more computer systems that are grouped together to share information, software and hardware. Operating System (OS) Programs that manage all the basic functions and programs on a computer, such as allocating system resources, providing access and security controls, maintaining file systems and managing communications between end users and hardware devices. Examples include Microsofts Windows, Apples Macintosh and Red Hats Linux. Password A secret sequence of characters that is used as a means of authentication to confirm your identity in a computer program or online. Password Cracking Password cracking is the process of attempting to guess passwords, given the password file information. See also Brute Force Attacks, Dictionary Attacks and Hybrid Attacks. Password Sniffing Passive wiretapping, usually on a local area network, to gain knowledge of passwords.
CSG-6
Patch A patch is a small security update released by a software manufacturer to fix bugs in existing programs. Your computers software programs and/or operating system may be configured to check automatically for patches, or you may need to periodically visit the manufacturers websites to see if there have been any updates. Peer-to-Peer (P2P) Programs See File-Sharing Programs. Phishing Soliciting private information from customers or members of a business, bank or other organization in an attempt to fool them into divulging confidential personal and financial information. People are lured into sharing user names, passwords, account information or credit card numbers, usually by an official-looking message in an email or a pop-up advertisement that urges them to act immediately, usually by clicking on a link provided. See also Vishing. Pharming Redirecting visitors from a real website to a bogus one. A user enters what is believed to be a valid Web address and is unknowingly redirected to an illegitimate site that steals the user's personal information. On the spoofed site, criminals may mimic real transactions and harvest private information unknowingly shared by users. With this, the attacker can then access the real website and conduct transactions using the credentials of a valid user. Router A hardware device that connects two or more networks and routes incoming data packets to the appropriate network. Many Internet Service Providers (ISPs) provide these devices to their customers, and they often contain firewall protections. Script A file containing active content -- for example, commands or instructions to be executed by the computer. Shoulder Surfing Looking over a persons shoulder to get confidential information. It is an effective way to get information in crowded places because its relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine or type a password. Can also be done long-distance with the aid of binoculars or other visionenhancing devices. To combat it, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand. Also, be sure you passwordprotect your computer screen when you must leave it unattended, and clear your desk at the end of the day. See also Clear Desk Policy and Clear Screen Policy.
CSG-7
Skimming A high-tech method by which thieves capture your personal or account information from your credit card, drivers license or even passport using an electronic device called a skimmer. Such devices can be purchased online for under $50. Your card is swiped through the skimmer and the information contained in the magnetic strip on the card is then read into and stored on the device or an attached computer. Skimming is predominantly a tactic used to perpetuate credit card fraud, but is also gaining in popularity amongst identity thieves. Social Engineering A euphemism for non-technical or low-technology meanssuch as lies, impersonation, tricks, bribes, blackmail and threatsused to attack information systems. Sometimes telemarketers or unethical employees employ such tactics. Social Networking Websites Sites specifically focused on the building and verifying of social networks for whatever purpose. Many social networking services are also blog hosting services. There are more than 300 known social networking websites, including Facebook, MySpace, Friendster, Xanga and Blogspot. Such sites enable users to create online profiles and post pictures and share personal data such as their contact information, hobbies, activities and interests. The sites facilitate connecting with other users with similar interests, activities and locations. Sites vary in who may view a users profilesome have settings which may be changed so that profiles can be viewed only by friends. See also Blogs. Spam Unwanted, unsolicited email from someone you dont know. Often sent in an attempt to sell you something or get you to reveal personal information. Spim Unwanted, unsolicited instant messages from someone you dont know. Often sent in an attempt to sell you something or get you to reveal personal information. Spoofing Masquerading so that a trusted IP address is used instead of the true IP address. A technique used by hackers as a means of gaining access to a computer system. Spyware Software that uses your Internet connection to send personally identifiable information about you to a collecting device on the Internet. It is often packaged with software that you download voluntarily, so that even if you remove the downloaded program later, the spyware may remain. See also Adware and Malware. SSL (Secure Socket Layer) An encryption system that protects the privacy of data exchanged by a website and the individual user. Used by websites whose URLs begin with https instead of http.
CSG-8
Trojan Horse A computer program that appears to be beneficial or innocuous, but also has a hidden and potentially malicious function that evades security mechanisms. A keystroke logger, which records victims keystrokes and sends them to an attacker, or remote-controlled zombie computers are examples of the damage that can be done by Trojan horses. See also Electronic Infection. URL Abbreviation for Uniform (or Universal) Resource Locator. A way of specifying the location of publicly available information on the Internet. Also known as a Web address. URL Obfuscation Taking advantage of human error, some scammers use phishing emails to guide recipients to fraudulent sites with names very similar to established sites. They use a slight misspelling or other subtle difference in the URL, such as monneybank.com instead of moneybank.com to redirect users to share their personal information unknowingly. Virus A hidden, self-replicating section of computer software, usually malicious logic, that propagates by infectingi.e., inserting a copy of itself into and becoming part of -another program. A virus cannot run by itself; it requires that its host program be run to make the virus active. Often sent through email attachments. Also see Electronic Infection and Blended Threat. Vishing Soliciting private information from customers or members of a business, bank or other organization in an attempt to fool them into divulging confidential personal and financial information. People are lured into sharing user names, passwords, account information or credit card numbers, usually by an official-looking message in an email or a pop-up advertisement that urges them to act immediatelybut in a vishing scam, they are urged to call the phone number provided rather than clicking on a link. See also Phishing. Vulnerability A flaw that allows someone to operate a computer system with authorization levels in excess of that which the system owner specifically granted. Whitelisting Software A form of filtering that only allows connections to a pre-approved list of sites that are considered useful and appropriate for children. Parents sometimes use such software to prevent children from visiting all but certain websites. You can add and remove sites from the permitted list. This method is extremely safe, but allows for only extremely limited use of the Internet.
CSG-9
Worm Originally an acronym for Write once, read many times, a type of electronic infection that can run independently, can propagate a complete working version of itself onto other hosts on a network, and may consume computer resources destructively. Once this malicious software is on a computer, it scans the network for another machine with a specific security vulnerability. When it finds one, it exploits the weakness to copy itself to the new machine, and then the worm starts replicating from there, as well. See also Electronic Infection and Blended Threat. Zombie Computer A remote-access Trojan horse installs hidden code that allows your computer to be controlled remotely. Digital thieves then use robot networks of thousands of zombie computers to carry out attacks on other people and cover up their tracks. Authorities have a harder time tracing criminals when they go through zombie computers.
Sources:
National Institute of Standards and Technology:
CSG-10
CSL-1
Government Resources
Department of Homeland Security (DHS)s National Strategy to Secure Cyberspace: www.dhs.gov/xlibrary/assets/National_Cyberspace_Strategy.pdf DHS testimony before the House on Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies: http://www.dhs.gov/ynews/testimony/testimony_1300283858976.shtm FCC Cyber Security Encyclopedia Page http://www.fcc.gov/cyberforsmallbiz FCC Public Safety and Homeland Secuirity Bureau Clearinghouse: http://publicsafety.fcc.gov/pshs/clearinghouse/index.htm FCC Public Safety and Homeland Security Bureau Guidelines for Emergency Planning: http://transition.fcc.gov/pshs/emergency-information/guidelines/ FCC Ten Cybersecurity Tips for Small Businesses http://hraunfoss.fcc.gov/edocs_public/attachmatch/DOC-306595A1.pdf Federal Trade Commission Guide for Business http://www.ftc.gov/bcp/edu/microsites/infosecurity/ Federal Trade Commission Identity Theft Information: http://www.onguardonline.gov/topics/computer-security.aspx Federal Trade Commissions Interactive Tutorial: www.ftc.gov/infosecurity National Institute of Standards and Technology (NIST)s Computer Security Resource Center: www.csrc.nist.gov NIST briefing on Cybersecurity for Small Businesses: http://csrc.nist.gov/groups/SMA/sbc/documents/smb-presentation.pdf
CSL-2
Publications
2011 Awards for best computer security tools, SC Magazine: http://www.scmagazineus.com/2011-sc-awards-us-finalists/section/1908/ Cloud Security Alliance https://cloudsecurityalliance.org/csaguide.pdf Computer Security Resource Center, National Instiitute of Standards and Technology: http://csrc.nist.gov/groups/SMA/sbc/library.html Microsoft Small Business Guide: http://www.microsoft.com/smallbusiness/support/security-toolkit-pdf.mspx Protecting Your Small Business, Entrepreneur Magazine: http://www.entrepreneur.com/magazine/entrepreneur/2010/june/206656.html Small business Information Security: The Fundamentals, National Institute of Standards and Technology: http://csrc.nist.gov/publications/nistir/ir7621/nistir-7621.pdf
CSL-3