Protection of Transportation Infrastructure from Cyber Attacks: A Primer (2016) / Chapter Skim
Currently Skimming:
Pages 8-37
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 8... ...
8 Chapter 2 Cybersecurity Risk Management, Risk Assessment and Asset Evaluation Risk Management Managing the risks associated with cyber, IT and ICS, can prove to be intractably challenging. For even the most robust and up-to-date security systems there is an evergrowing risk that the next exploitation methodology will be discovered by an attacker and be introduced without detection.
|
From page 9... ...
9 Risk Management /Risk Mitigation Strategies • R sk Assessment • Threat Assessment • Vulnerab ty Assessment • Consequence Assessment identifiers, and shipments are irretrievably lost. Optimally, significant inherent operational risk should be viewed in the context of transportation business and environmental control factors resulting in recommendations for Risk Response Options.
|
From page 10... ...
10 and government sectors face unprecedented numbers of data breaches and cybersecurity threats. Today the lack of cybersecurity talent can be an organization's biggest vulnerability, exposing it to serious risk that can equate to unacceptable losses.
|
From page 11... ...
11 challenging. Particularly since the very nature of an open architecture network demands the exchange of data from disparate information sources, of which an attacker could take advantage.
|
From page 12... ...
12 STEP 2: CONDUCT RISK ASSESSMENT Task 2-1. Identify Threat Sources – Identify and characterize threat sources of concern, including capability, intent, and targeting characteristics for adversarial threats and range of effects for non-adversarial threats.
|
From page 13... ...
13 areas, technical experts from these areas, and auxiliary groups. For instance a team might include Engineering, Operations, Maintenance, HR, Safety, IT, Security 3.
|
From page 14... ...
14 A core component of ICS-CERT's risk management mission is conducting security assessments in partnership with ICS stakeholders, including critical infrastructure owners and operators, ICS vendors, integrators, Sector-Specific Agencies, other Federal departments and agencies, SLTT governments, and international partners. ICS-CERT works with these and other partners to assess various aspects of critical infrastructure (cybersecurity controls, control system architectures, and adherence to best practices supporting the resiliency, availability, and integrity of critical systems)
|
From page 15... ...
15 to identify components, resources, and protections. Gather information using open source discovery of organizational information.
|
From page 16... ...
16 d. Deliver malware by providing removable media.
|
From page 17... ...
17 privileged capability to get to another capability.
|
From page 18... ...
18 m. Compromise information systems or devices used externally and reintroduced into the enterprise.
|
From page 19... ...
19 organizational facilities (e.g., breaks a water main, cuts a power line)
|
From page 20... ...
20 through malware injections) , firmware, and hardware that performs critical functions for organizations.
|
From page 21... ...
21 pages of organizations with the intent of finding sensitive information.
|
From page 22... ...
22 low.
|
From page 23... ...
23 However as NIST Special Publication 800-30 points out, "vulnerabilities are not identified only within information systems...vulnerabilities can be found in organizational governance structures (e.g., the lack of effective risk management strategies and adequate risk framing, poor intra- agency communications, inconsistent decisions about relative priorities of missions/business functions, or misalignment of enterprise architecture to support mission/business activities)
|
From page 24... ...
24 operation of the program. A careful and successful memory overwrite can cause the program to begin execution of actual code submitted by the attacker.
|
From page 25... ...
25 Traversal)
|
From page 26... ...
26 exploiting a vulnerable service running with more privileges than the attacker has currently obtained.
|
From page 27... ...
27 considered. The attacker may be able to cause invalid data to be displayed on a console or create invalid commands or alarm messages.
|
From page 28... ...
28 which are freely downloadable, can be used to view this type of network traffic. As a result, the content of the ICS communication packets can be intercepted, read, and manipulated.
|
From page 29... ...
29 through assigned access authorization, 2) lack of lockout system enforcement for failed login attempts, and 3)
|
From page 30... ...
30 smaller facilities, have no test facilities, so security changes must be implemented using the live operational systems.
|
From page 31... ...
31 between networks, making sensitive data susceptible to monitoring/eavesdropping on the other network, and providing individuals with unauthorized access to systems.
|
From page 32... ...
32 network access through physical access to network equipment includes the lack of physical access control to the equipment, including the lack of security configuration functions that limit functionality even if physical access is obtained. A malicious user who has physical access to an unsecured port on a network switch could plug into the network behind the firewall to defeat its incoming filtering protection.
|
From page 33... ...
33 political cyber attacks may result in disruption of major systems without loss of life, but with consequent financial damage, or in disruption of minor systems that serve mainly to annoy or cause public relations damage. The political attacks against transportation systems described in this report resulted in defaced web sites, compromised user credentials and some disruption to operations.
|
From page 34... ...
34 Cybersecurity Considerations for Public Transit does provide a very useful grouping of critical assets in transit into three main categories. The transit IT "ecosystem" and definitions for each of the categories follows: Figure 4: Transportation Information Ecosystem.
|
From page 35... ...
35 NIST Special Publication 800-30 guidelines recommend identifying information system critical assets based on an assessment perceived or potential: • Harm to Operations o Inability to perform current missions/business functions In a sufficiently timely manner With sufficient confidence and/or correctness Within planned resource constraints o Inability, or limited ability, to perform missions/business functions in the future o Inability to restore missions/business functions In a sufficiently timely manner With sufficient confidence and/or correctness Within planned resource constraints o Harms (e.g., financial costs, sanctions) due to noncompliance With applicable laws or regulations With contractual requirements or other requirements in other binding agreements (e.g., liability)
|
From page 36... ...
36 o Damage to or incapacitation of a critical infrastructure sector o Loss of government continuity of operations o Relational harms Damage to trust relationships with other governments or with nongovernmental entities Damage to national reputation (and hence future or potential trust relationships) Damage to current or future ability to achieve national objectives Harm to national security.
|
From page 37... ...
37 Cybersecurity Challenges Protecting Your Transportation Management Center (Fok, ITE Journal, February 2015) posed the following questions: What would happen if the United States could not… 1.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.