IDENTIFYING THREATS IN A GLOBAL MARKETPLACE Ira S. Somerson, BCFE, CPP

1. Institute for Global Management Studies And Temple CIBER Global Security Concerns October 2 & 3, 2003 The Philadelphia Federal Reserve IDENTIFYING THREATS IN A GLOBAL MARKETPLACE Ira S. Somerson, BCFE, CPP Loss Management Consultants, Inc.

2. “The regulatory, ethical, and legal framework that provide protections to us and individuals and to our business activities at home do not apply abroad.” Overseas Security Advisory Council LMC™

3. THREATS BY REGION 2003 to Date LMC™ Overseas Security Advisory Council - 2003

4. THREATS BY INDUSTRY: 2003 to Date LMC™ Overseas Security Advisory Council - 2003

5. THREATS TO BE CONSIDERED IN AN INTERNATIONAL ENVIRONMENT • TERRORISM • PERSONAL SECURITY • PERSONNEL SECURITY • PHYSICAL SECURITY OF FACILITY • INFORMATION AND DATA SECURITY • COMMUNICATIONS SECURITY • INFRASTRUCTURE SECURITY Overseas Security Advisory Council - 2003 LMC™

6. THREATS TO BE CONSIDERED IN AN INTERNATIONAL ENVIRONMENT • DISGRUNTLED INSIDERS • CIVIL UNREST AND/OR CULTURAL CONFLICTS • CRIMINAL THREATS • ECONOMIC COMPETITION • ACTS OF INTELLIGENCE SERVICES • ACTS OF WAR Overseas Security Advisory Council - 2003 LMC™

7. LESSONS FROM RECENTCYBER ATTACK CASE STUDIES • CYBER ATTACKS IMMEDIATELY ACCOMPANY PHYSICAL ATTACKS • CYBER ATTACKS ARE INCREASING IN VOLUME, SOPHISTICATION, AND COORDINATION • CYBER ATTACKERS ARE ATTRACTED TO HIGH VALUE TARGETS INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™ I

8. POTENTIAL SOURCES OFCYBER ATTACKES • TERRORIST GROUPS • TERRORIST SYMPATHIZERS AND ANTI-U.S. HACKERS • TARGETED NATION-STATES • THRILL SEEKERS INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™

9. CYBER ATTACKERS HAVE RECENTLY: DEFACED ELECTRONIC INFORMATION SITES IN THE UNITED STATES AND ALLIED COUNTRIES AND SPREAD DISINFORMATION AND PROPAGANDA. INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™

10. CYBER ATTACKERS HAVE RECENTLY: DENIED SERVICE TO LEGITIMATE COMPUTER USERS IN THE U.S. AND ABROAD BY USE OF: • WORMS • VIRUSES • OTHER COMPUTER WEAKNESSES INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™

11. CYBER ATTACKERS HAVE RECENTLY: COMMITTED UNAUTHORIZED INTRUSIONS INTO SYSTEMS AND NETWORKS BELONGING TO THE UNITED STATES AND ALLIED COUNTRIES, RESULTING IN CRITICAL INFRASTRUCCTURE OUTAGES AND CORRUPTION OF VITAL DATA. INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE, 9/22/01 LMC™

12. ONLINE RESOURCES • www.cert.org (The Carnegie Mellon Computer Emergency Response Team) • www.fedcirc.gov (The Federal Computer Incident Response Center) • www.incidents.org (community and business collaboration of victimization) • www.ists.dartmouth.edu (The Institute for Security Technology Studies at Dartmouth) • www.nipe.gov (The National Infrastructure Protection Center) • www.sans.org (The System Administration, Networking and Security) LMC™

13. RISK, THREAT & VULNERABILITY CONSIDERATIONS • THREAT = INTENT + CAPABILITY • CAPABILITY = TOOLS + KNOWLEDGE • RISK = THREAT + COUNTERMEASURES • HOW OFTEN WILL THE RISK OCCUR? LMC™ Overseas Security Advisory Council - 2003

14. SECURITY RISK COSTS LEGAL & DAMAGE CONTROL EXPECTED REVENUE LOSS SHAREHOLDER VALUE REPUTATION (GOOD WILL) LOSS OF PRODUCTIVITY MARKET SHARE & TIMING RELATIONSHIPS WITH CONTRACTORS LMC™ LMC™

15. FINANCIAL IMPACT OF SECURITY LOSSES IMPACT TO OTHER PRODUCT DESIGN EMPLOYEE MORALE COST TO SERCURE (AFTER THE FACT) RESEARCH & DEVELOPMENT SPECIAL EQUIPMENT CAPITALIZED STAFF RECRUITING & TRAINING OVERHEAD COSTS DEBT SERVICE LMC™

16. NET PRESENT VALUE COMPUTATION OF INFORMATION LOSS NET PRESENT LOSS OR NET PRESENT GAIN COST OF PROGRAM PREDICTABILITY OF LOSS LMC™

17. EXAMPLE COST OF ONE INFORMATION LOSS $1,000,000.00 COST DIVIDED BY POTENTIAL FOR LOSS TO OCCUR OVER A TEN-YEAR PERIOD. IF ONLY ONCE, DIVIDE BY 10=COST/YR 100,000.00 LESS COST OF PROGRAM/YR 75,000.00 NET PRESENT VALUE -------------------- $ 25,000.00 LMC™

18. SECURITY OBJECTIVES • DETER • DETECT • DELAY • RESPOND • RECOVER LMC™ LMC™

19. THE MISSION OF NTERNATIONAL SECURITY MANAGEMENT R I S K S E C U R I T Y A T T I T U D E C H A N C E LMC™

20. THE MISSION OF NTERNATIONAL SECURITY MANAGEMENT SECURTY OF: S E C U R I T Y R I S K • PEOPLE • INFORMATION • PROPERTY • REPUTATION CHANCE ATTITUDE LMC™

21. RISK ASSESSMENT THE ART AND SCIENCE OF MEASURING THE FORESEEABILITY OF EVENTS AFFECTING THE SAFETY AND SECURITY OF ASSETS LMC™

22. EXAMPLES OF WHAT A RISK ASSESSMENT SHOULD CONSIDER • INTELLIGENCE GATHERING • OPERATIONAL ASPECTS OF THE ASSET/FACILITY • NATURE OF NEIGHBORING FACILITIES (OR TENANTS) • ACCESS ROADS TO FACILITY LMC™

23. EXAMPLES OF WHAT A RISK ASSESSMENT SHOULD CONSIDER • ORGANIZATION’S INCIDENT HISTORY AND ABILITY TO ANALYZE THE DATA • FACILITY MANAGEMENT EFFICIENCY • EFFICIENCY OF EXISTING SECURITY STRATEGY LMC™

24. HOW DO WE DETER, DETECT, DENY, RESPOND TO AND/OR RECOVER FROM ATTACKS? • TECHNOLOGY MANAGEMENT • PROCEDURAL MANAGEMENT • SECURITY AWARENESS • INTELLIGENCE GATHERING AND ANALYSIS • LAW ENFORCEMENT MANAGEMENT LMC™

25. STANDARD SECURITY INDUSTRY PRACTICES SECURITY PROJECTS PUBLISH SECURITY GUIDELINES PREPARE SUPPORT MATERIALS EMPLOYEE & CONTRACTOR(NEW & EXISTING) ORIENTATION SECURITY AWARENESS TRAINING LMC™

26. PAY ATTENTION TO GOVERNMENT ALERT LEVELS. CARE ENOUGH TO REPORT SOMETHING THAT DOESN’T LOOK RIGHT TO YOU! BE AWARE BUT NOT PARANOID THE MISSING LINK LMC™

27. WHAT YOU CAN DO? BECOME PART OF THE SOLUTION VS. BEING PART OF THE PROBLEM LMC™