Larry Clinton Operations Officer Internet Security Alliance lclinton@eia.

org 703-907-7028 202-236-0001

Growth in Incidents Reported to the CERT/CC

120000
110,000

100000 80000
55,100

60000 40000

21,756

20000
6 132 252 406 773 1,334 2,340 2,412 2,573 2,134 3,734 9,859

0 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002

The Dilemma: Growth in Number of Vulnerabilities Reported to CERT/CC

4,500 4,000 3,500 3,000 2,500 2,000 1,500 1,000 500 171 0
1995

4,129

2,437

1,090 417 345 311 262

2002

Attack Sophistication v. Intruder Technical Knowledge

stealth / advanced scanning techniques

Tools

High
Intruder Knowledge

packet spoofing sniffers sweepers

denial of service DDOS attacks www attacks automated probes/scans GUI

back doors disabling audits burglaries

network mgmt. diagnostics

Attack Sophistication

hijacking sessions exploiting known vulnerabilities password cracking self-replicating code

Low
1980

password guessing

Attackers 1995 2000

1985

1990

Computer Virus Costs (in billions)

$

150
billion

120 90 60 30 0

Range Dam age

'96 '97 '98 '99 '00 '01 '02 '03

(Through Oct 7)

Implications for Indian Companies

Corporate Financial Implications Legal Liability Could Effect Partnerships Cyber Security Could be Written into Trade Agreements

Corporate Finances
Attacks are inevitable You can mitigate risk, but not eliminate it. Many Companies are not insured

Chief Technology Officers Knowledge of their Cyber Insurance

34% Incorrectly thought they were covered 36% Did not have Insurance 23% Did not know if they had insurance 7% Knew that they were insured by a specific policy

ISAlliance Cyber-Insurance Program

Coverage for members Free Assessment through AIG Market incentive for increased security practices 10% discount off best prices from AIG Additional 5% discount for implementing ISAlliance Best Practices (July 2002)

Legal Liability
US State law already specifies liability Jones-Day review suggests companies must show they are above the mean in cyber security Partners will have to show security for its own sake and to fend off liability

Regulatory/Trade Implications
Intensive Interest in US Congress on Cyber Security Regulatory Proposals are being circulated demanding audits for cyber security Congressional Internet Committee 11/6/03 Should we write cyber security requirements into our future trade agreements?

Sponsors

What ISAlliance Does

Successful Information Sharing Develops Widely Approved Best Practices and standards Develops Tools for Assessment Creates/advocates market incentives to improve cyber security Education and Training Outreach e.g. Security Anchor Program+

Cooperative work on assessment/certification

TechNet CEO SelfAssessment Program Bring cyber security to the C-level based on ISA Best Practices Create a baseline of security even CEOs can understand American Security Consortium 3-Party Assessment program Risk Preparedness Index for assessment and certification Develop quantitative independent ROI for cyber security

ISAlliance/CERT Training
Concepts and Trends In Information Security Information Security for Technical Staff OCTAVE Method Training Workshop Overview of Managing Computer Security Incident Response Teams Fundamentals of Incident Handling Advanced Incident Handling for Technical Staff Information Survivability an Executive Perspective

India Security Anchor Proposal

Security Anchors are organizations who: ---Provide secure channel for receiving reports about vulnerabilities and incidents ---Provide assistance to members of its constituency ion handling incidents ---Disseminate incident related information ---License and provide CERT training ---Expand the culture of security

Larry Clinton Operations Officer Internet Security Alliance lclinton@eia.org 703-907-7028 202-236-0001