Defending against Attacks on Information Systems

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1N2sJWndyYwv4sT-IHQPFI8GOHjCiHIhjL5iv-6LxZXAkAejsRGpHWdbBxz6SUTo3nbaPbx95jOS3HvaLrlqFGmkXZ8rx_tsmSK-CHsZ55qX2y9XEvKqZ6eDfWL_zSrU4pFx6qAtkY_i5/s1600/methods+of+defense.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1N2sJWndyYwv4sT-IHQPFI8GOHjCiHIhjL5iv-6LxZXAkAejsRGpHWdbBxz6SUTo3nbaPbx95jOS3HvaLrlqFGmkXZ8rx_tsmSK-CHsZ55qX2y9XEvKqZ6eDfWL_zSrU4pFx6qAtkY_i5/s1600/methods+of+defense.png" /></a></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">In broad terms, there are six different approaches that can be used to defend information systems against attacks by malicious parties. The first of these approaches is prevention, and preventing an attack can be accomplished by either blocking the attack, or by entirely closing or eliminating a vulnerability. Remember that an attack occurs when someone intentionally exploits a vulnerability. If we are therefore able to close or entirely eliminate the vulnerability, then the attack cannot occur. The second method of defense is deterrence, and deterring an attack can be accomplished by finding ways to make the attack more difficult to carry out. The third method of defense is deflection, and in order to deflect an attack, another target must be provided for the attacker which seems to be more attractive than the original target. In this way, it may be possible to artfully encourage the attacker to pursue a target that is of little real value.<o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">After prevention, deterrence, and deflection, the fourth approach to defending information systems is through mitigation. An attack can be mitigated by taking steps to make the impact of the attack less severe. If despite our best efforts we are unable to prevent, deter, or deflect an attack, then the best strategy is to have mechanisms in place which will contain the damage.<o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">The fifth method of defense is detection, and detection can take place either while an attack is in progress, or after the attack has been completed. If an attack can be detected while it is still underway, then it may be possible to stop the attack immediately, thus preventing further harm. It is, however, important to realize that detecting an attack after it has taken place can also be of great value. If an attack can be detected after it has taken place, then it may be possible to repair the damage and learn from the attack by determining exactly how the system was compromised. Such information can be useful in identifying and closing vulnerabilities, thus preventing similar attacks from being successful in the future.</span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">Finally, the sixth method of defense is to recover from an attack. It is necessary to have mechanisms in place such as organizational protocols, backup copies of data, and so forth that allow us to quickly recover from a successful attack. Recovery is a legitimate method of defense because if an attacker finds that the effects of her attack are short-lived and quickly fixed, then she may be less likely to attack us in the future.</span></div><div class="MsoNormal"><o:p></o:p></div>

Defending against Attacks on Information Systems

In broad terms, there are six different approaches that can be used to defend information systems against attacks by malicious parties. The ...

Read more »

Prerequisites for Attacking an Information System

<div class="MsoNormal"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxzCXm-qsDzwAJDf3UxSSMJsUYIlXktYXzzn9B5ieW1XIZJpm3uTIxL2k2NAbod2UQITgEqdS-955782RpPdF5kBNiWisBRVopd4xx7hZuupTR-DLTi21WWzFvvk54CWQOEvu7FMZtqp_g/s1600/attack+prerequisites.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxzCXm-qsDzwAJDf3UxSSMJsUYIlXktYXzzn9B5ieW1XIZJpm3uTIxL2k2NAbod2UQITgEqdS-955782RpPdF5kBNiWisBRVopd4xx7hZuupTR-DLTi21WWzFvvk54CWQOEvu7FMZtqp_g/s1600/attack+prerequisites.png" /></a><span style="font-family: Arial, Helvetica, sans-serif;">In order for an attack on an information system to succeed, an attacker must possess three specific things: (1) <i>method</i>, (2) <i>opportunity</i>, and (3) <i>motive</i>. One useful way of remembering these prerequisites is through the acronym MOM (<u>M</u>ethod, <u>O</u>pportunity, and <u>M</u>otive). In the context of conducting attacks on information systems, method refers to the skills, knowledge, tools, experience, and so forth that an attacker must have in order for an attack to be realistically attempted. Opportunity, by contrast, refers to the time and the necessary access that are required in order for an attacker to attempt an attack on an information system. Finally, motive simply refers to the purpose for conducting an attack or the reason for which an attacker desires to carry out an attack.<o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><span style="font-family: Arial, Helvetica, sans-serif;">From an information security perspective, it is critical that security personnel understand these three prerequisites for conducting attacks on information systems. If any of these three prerequisites can be eliminated -- that is, if we are able to effectively remove or disrupt an attacker’s method, opportunity, or motive -- then the attack will not succeed. If efforts aimed at defending against attacks on information infrastructure or protecting information assets are to have the best chance possible of succeeding, those efforts should therefore target one or more of these three prerequisites.</span><br /><div class="MsoNormal"><o:p></o:p></div>

Prerequisites for Attacking an Information System

In order for an attack on an information system to succeed, an attacker must possess three specific things: (1) method , (2) opportunity , a...

Read more »