Having done cyber security consulting for both government and private sector, I will try to break down my experience doing so in:

• Analysis of the asset
• The vulnerability
• The exploit
• Remedial actions(or lack thereof)

When I arrive at most of my clients they do not have an inventory of the asset and if it is done it is more than likely misidentified and the quantitative or qualitative elements of the analysis are under and overestimated(mostly shifting towards underestimated quantitatively and overestimated qualitatively).

At the government level it is very difficult to grasp the total asset count for legal and practical issues. At the legal perspective there is a distinction between the assets owned by a corporation and the assets owned by government. This makes it hard to quantify the expected loss if the information about the asset is at the corporate side. While this information can be obtained there are many interdependencies that the corporation may have to go on that level of detail. these details are what makes or break a security strategy

Moving on to the vulnerability which mostly deals with:

• Legacy components
• Systems complexity
• Homogeneous systems
• Untrained personnel
• Human nature
• Plain bad programming practices

Legacy components are everywhere and not just government. Critical infrastructure runs on legacy software due to the old adage "if it ain't broke do not fix it". The problem is that " if it is old it is most likely vulnerable". Legacy systems coupled with systems complexity is a reality in most cyber incidents where the complexity of the system adds points of failure and vulnerability. To reduce somewhat the complexity of the system sysadmins will most likely try to homogenize the architecture which once hacked it is hacked completely. This vulnerabilities coupled with hard to find qualified personnel and good intentioned but untrained personnel mostly make up the complete vulnerability spectrum.

Almost all vulnerability variants come from the above points but with special emphasis on the last point. good programming practices will avoid most technological vulnerabilities. Yet the problem is one that I fear will just be resolved by liability assignment upon those who did the programming.

The nature of the exploits keep changing continuously, since once a vulnerability is covered more will creep up at higher levels. The sophistication of the attacks are also evolving so counter cyber terrorism is a moving target. Unfortunately governments and corporate bureaucracy are moving at a pace that is too slow to catch up with the rate of evolution of cyber attacks.

The last point is the remedial action and this is the problem itself. The solution needs to move from reactive to proactive. The solution is not technological(and most clients think that with the newest IPS they will solve everything), but requires a legal framework on which to prioritize technolgy as an asset that needs to be protected. Policy and technology will follow.

Just a thought

According to my view, one of the major challenge will be jurisdiction and applicable Law.The Cyber terrorism attack is uniform and universal in nature but the laws which regulates Cyber terrorism is different in different countries around the world,only the world body kind of organisation can regulate the Cyber terrorism by its uniform application of law for countries around the world.   

Challenge 1

There is now a sophisticated and self-sufficient digital underground economy in which data is the illicit commodity. Stolen personal and financial data – used, for example, to gain access to existing bank accounts and credit cards, or to fraudulently establish new lines of credit – has a monetary value. This drives a range of criminal activities, including phishing, pharming, malware distribution and the hacking of corporate databases, and is supported by a fully fledged infrastructure of malicious code writers, specialist web hosts and individuals able to lease networks of many thousands of compromised computers to carry out automated attacks.

Challenge 2

In the last decade advances in communications technologies and the "informatisation" of society have converged as never before in human history. This has given rise to the industrialisation of a type of crime where the commodity, personal information, moves far too quickly for conventional law enforcement methods to keep pace.

The unprecedented scale of the problem threatens the ability of the authorities to respond – with (according to one estimate) more than 150,000 viruses and other types of malicious code in global circulation, and 148,000 computers compromised per day. At the same time, the authorities have more data on criminal activity at their disposal than ever before, and now have an opportunity to harness this information in ways which make intelligence development and investigation more streamlined and cost effective.

Cyber crime rates continue to increase in line with Internet adoption: mobile Internet access and the continuing deployment of broadband internet infrastructure throughout the world therefore introduces new levels of vulnerability; with potential victims online for longer periods of time and capable of transmitting much more data than before; the adoption of these internet technologies in developing countries poses a potential external threat to the EU; and the increasing trend for outsourcing data management to third parties presents imminent risks to information security and data protection.

At the same time, the organic development of Internet technology has resulted in the existence of myriad actors in the information security field. By way of illustration, the (ENISA) directory of network and information security stakeholders in the EU alone already stretches to over 400 pages.

Challenge 3

Cyber crime is a truly global criminal phenomenon which blurs the traditional distinction between threats to internal (criminality and terrorist activity) and external (i.e. military) security and does not respond to single jurisdiction approaches to policing. The liability of networks to exploitation for a number of different ends, and the ease with which individuals may move from one type of illegal activity to another suggests that territorialism in all its forms (both of nations and regions, and specific authorities within nations) hinders efforts to successfully combat the misuse of communications technology.

At present, national authorities are overcoming jurisdictional restrictions by coordinating regionally (as in the EU, ASEAN and AMERIPOL nations) or with agencies with similar levels of capability/capacity (as in the Virtual Global Taskforce) to better understand and respond to Internet-facilitated crime.

The basics are the same regardless of terrorism. Its hard or almost impossible in an open democratic society.

However the key is intelligence (HUMINT, SIGINT, COMINT, cyberINT etc.) about groups that have an interest in conducting terror acts and towards which societal organizations, functions, services (e.g. critical infrastructure, law, military, civilians) they would like to attack.

Arturo Geigel above presents the traditional process of Cyber and Information Security process and starts with the Critical Business Functions, Information Assets,  Vulnerabilities, (Exploits), Actions

I rather would like to start with WHY would some one attack, WHO are they, with WHAT Goal do they have (i.e. Intent) with WHAT capacity (endurance, skill etc.), WHERE can they reach us, WHERE can they operate from, WHEN are they able to attack us, and HOW will they conduct their attack. From that one can map towards the Business Process and Information Assets what the IMPACT of and adversary could be and what strategy is best to use, and the mix of defensive or offensive operations to be used (Absorb, Divert, Deny, Disrupt, Destroy)

To move from reactive to pro-active and further to prediction and prescription is indeed a challenge. Within in Military Command and Control Systems/research/technology domain there are research in sensors, situation awareness, decision making, Course of Action analysis, Mission Rehearsal, Training etc. that all can be transferred into the cyber domain and then connecting all four domains (i.e. air,sea,land,cyber).

On of the most critical assets to protect will then be the list of all critical assets with their vulnerability ranking and precautions made to hinder an attack...