You can also apply a checklist approach to ranking risk. Generally, you have a list of threats, and you rank each item as a high, medium, or low risk. This works much better at the system level than the organization level. There are examples of a modified quantitative method and several checklist style qualitative method risk assessments at

http://www.nswc.navy.mil/ISSEC/Form/AccredForms/index.html.

The accreditation "part II" forms at the web site are for the various architectures (Windows 95, NT, Macintosh, UNIX) are the qualitative method examples. The SCORE checklists at www.sans.org/SCORE are another resource. Finally, the Center for Internet Security www.cisecurity.org has a number of tools that you can run to assess your security posture. These tools pretend to be quantitative because they give you a numeric score; but if you look under the hood, you will quickly realize they are qualitative.

Why They Don't Work

In theory, both approaches to risk assessment work fine. In practice, they do not work so well. This is because we have a natural tendency not to tell the truth, because if we do show there is a vulnerability with a high risk, we have to do something to fix it. Therefore in practice, people who are performing a qualitative assessment come up with numbers that are really big. They know they cannot afford that much risk, so they do the assessment on smaller and smaller chunks until they get it down to the single desktop system, and that is silly! Guess which box (high, medium, or low risk) folks doing a quantitative assessment tend to pick. And if everything is a low risk, why bother?

Summary

From the time of the Cuban Missile Crisis to the fall of the Berlin Wall, if you were in the Department of Defense and you wanted money, the strategy was to go to Congress and say, "The Russians are coming." Despite the way TV and the movies portray the legislative branch, those folks aren't dumb and a lot of them have been on the hill for a long time. So at some point, they start pointing out that they funded this and they funded that all because the Russians were coming. Why hasn't that fixed the problem?

Now, we are doing it all over again to stop terrorism, or for the purposes of this book, to stop cyber-terrorism. If you don't need your year's worth of food and water and your thousand rounds of ammo for each gun to survive hackers, you certainly are going to need these things to survive the coming cyber-war. Sigh. This will work to extract money and attention for a season, but it is poor practice. This chapter has covered a sound organizational security model. We have looked at tools to assess and prioritize risk. We have a foundation for discussing what we do and why we do it with management. The next chapter discusses responses to attacks and system compromise. When we have these tools solidly in hand, we can discuss how the hackers are coming and how to survive a cyber-war in a reasonable manner.

Chapter 18. Automated and Manual Response

When we were learning how to analyze network traces, we discussed stimulus and response in detail. Now, we use the same concept but apply it at the organizational level as we consider the defensive responses available to us. The stimulus will generally be a "successful" attack or attack attempt. A successful attack, if detected, invokes an incident-handling procedure. How do we define a successful attack? In the vein of "any landing you can walk away from is a good one," we can say "any attack that causes us to take action above our normal filtering is a successful attack." Do you agree? If not, keep in mind that if we respond in any nonautomated, non-normal way, it has to cost us resources. What I would like to do is offer three attack examples. Take a look at each of these and consider whether they are successful attacks:

●Ping sweep. A series of ICMP echo requests from a party conducting reconnaissance. Ping sweeps are usually launched from outside our intranet or autonomous systems to internal subnet broadcast addresses. They might be detected by a sensor such as a firewall or intrusion detection system.

●Disk-based survey. An employee receives a letter with a disk. If he places the disk in his computer, answers all the questions, and mails the disk back, he receives a free T-shirt.

●TCP port 53 connections. An Internet company that produces banner ads for web pages is observed pinging systems that have gone to these web pages and attempted to initiate connections to TCP port 53 on these systems.

What do you think? I would say that if your perimeter router or firewall blocks ICMP echo requests, the ping sweep is not a success. I have heard folks assert that this is just a reconnaissance probe, not an attack; but the question is, does it cost you resources? I was looking at a network trace recently in which the attacker was going after only actual live systems. It is kind of scary when they know what they are looking for.

The disk-based survey? Certainly, this is a successful attack. Most employees would never know which files were scanned or added to their system, but it is certainly true the attacker gets the benefit from the information the employee types into the survey—and your organization is footing the bill. As a security professional, you should inform your organization's employees to throw these disk-based surveys straight into the trash, or if they must, take them home to fill them out.

The simple DNS lookups? DNS queries happen all the time, and it is hard to determine which queries might be reconnaissance as opposed to the function call gethostbyaddr that occurs whenever someone is web surfing. However, the HTTP protocol headers contain a lot of information about the client that is web surfing. Some of the fields include the following:

●Host operating system.

●Version of the browser being used.

●The last web server visited. This is the referrer field.

Web servers routinely collect this type of information for marketing purposes. The collected data helps the webmasters tune the look and feel of the pages as well as phrases that web clients are looking for. However, this information can also be used to collect information about the web clients. If you add DNS, and possibly netstat type information, you begin to compile an incredible amount of information about a given IP address, or IP address range.

You might notice that I did not use any "gulpers" for the examples (with the possible exception of the ping sweep; however, these are not script kiddie examples either). I am very impressed with the philosophy of Escrima, a martial art. The idea is to take whatever targets your adversary offers and cut them apart (literally, knives are the primary weapon) a piece at a time. This is a fundamental principal of information warfare. Folks are constantly employing a wide variety of techniques against your organization, taking whatever is vulnerable. This is why a sound protection scheme, including defense in depth and automated response, is so important.