1copyright 2012 Elsevier Incall Rights Reservedchapter 4diversityc ✓ Solved
1 All Rights Reserved Chapter 4 Diversity Cyber Attacks Protecting National Infrastructure, 1st ed. 2 All rights Reserved C h a p te r 4 – D iv e rs ity Introduction • The securing any set of national assets should include a diversity strategy • The deliberate introduction of diversity into national infrastructure to increase security has not been well explored • Two system are considered diverse if their key attributes differ • Diversity bucks the trend to standardize assets for efficiency's sake 3 Fig. 4.1 – Diverse and nondiverse components through attribute differences All rights Reserved C h a p te r 4 – D iv e rs ity 4 All rights Reserved C h a p te r 4 – D iv e rs ity Diversity and Worm Propagation • Worm propagation is an example of an attack that relies on a nondiverse target environment • Worm functionality in three steps: – Step #1: Find a target system on the network for propagation of worm program – Step #2: Copy program to that system – Step #3: Remotely execute program – Repeat • Diversity may be expensive to introduce, but saves money on response costs in the long run 5 All rights Reserved C h a p te r 4 – D iv e rs ity Fig.
4.2 – Mitigating worm activity through diversity 6 All rights Reserved C h a p te r 4 – D iv e rs ity Desktop Computer System Diversity • Most individual computers run the same operating system software on a standard processor platform and browse the Internet through one or two popular search engines with the one of only a couple browsers • The typical configuration is a PC running Windows on an Intel platform, browsing the Internet with Internet Explorer, searching with Google • This makes the average home PC user a highly predictable target 7 All rights Reserved C h a p te r 4 – D iv e rs ity Fig. 4.3 – Typical PC configuration showing diversity 8 All rights Reserved C h a p te r 4 – D iv e rs ity Desktop Computer System Diversity • Three Considerations – Platform costs – Application interoperability – Support and training 9 • Ultimate solution for making desktops more secure involves their removal – Not a practical solution • Cloud computing may offer home PC users a diverse, protected environment All rights Reserved C h a p te r 4 – D iv e rs ity Diversity Paradox of Cloud Computing 10 All rights Reserved C h a p te r 4 – D iv e rs ity Fig.
4.4 – Spectrum of desktop diversity options 11 All rights Reserved C h a p te r 4 – D iv e rs ity Fig. 4.5 – Diversity and attack difficulty with option of removal 12 • Modern telecommunications consist of the following two types of technologies – Circuit-switched – Packet-switched • When compared to one another, these two technologies automatically provide diversity • Diversity may not always be a feasible goal – Maximizing diversity may defend against large-scale attacks, but one must also look closely at the entire architecture All rights Reserved C h a p te r 4 – D iv e rs ity Network Technology Diversity 13 All rights Reserved C h a p te r 4 – D iv e rs ity Fig. 4.6 – Worm nonpropagation benefit from diverse telecommunications 14 All rights Reserved C h a p te r 4 – D iv e rs ity Fig.
4.7 – Potential for impact propagation over shared fiber 15 • Any essential computing or networking asset that serves a critical function must include physical distribution to increase survivability • Physical diversity has been part of the national asset system for years – Backup center diversity – Supplier/vendor diversity – Network route diversity All rights Reserved C h a p te r 4 – D iv e rs ity Physical Diversity 16 All rights Reserved C h a p te r 4 – D iv e rs ity Fig. 4.8 – Diverse hubs in satellite SCADA configurations 17 • A national diversity program would coordinate between companies and government agencies – Critical path analysis – Cascade modeling – Procurement discipline All rights Reserved C h a p te r 4 – D iv e rs ity National Diversity Program Practicing a Virtue and Reflection Assignment Select a virtue that you would like to incorporate into your character.
You are wrapping up a gratitude journal and reflection as part of this course. It is one of the big three virtues associated with happiness. The other two are forgiveness and humility. Many of my students decide to work on patience. One of my high school students worked on truthfulness.
She wrote in her reflection that she needed to develop a better memory or clean up her act. She couldn’t remember what lie she had told to which person. You need to make a minimum of three log entries per week for the duration of this assignment. This will vary on the semester but is two to four weeks long. At the end of the experience you will submit your log entries and reflection.
Look at the entire document. You will find some initial information to fill out, your reflection template and log entry templates. You will submit all of it at the conclusion of this assignment. Fill out the following initial information before you begin practicing your Virtue. 1.
Relate what virtue you have determined to practice for this assignment and why you have selected that virtue. 2. What challenges do you expect to encounter as you practice your virtue? 3. What cues will you use to remind yourself to practice your selected virtue?
Virtue Reflection Relate your overall progress as you practiced your virtue. Did you have any setbacks? Were you able to recover from setbacks? Was your progress steady or did you fluctuate up and down? Were you satisfied with your progress?
Why of why not? Do you think you will continue to practice this virtue? Are there other virtues that you would like to practice and incorporate as part of your character? What are those virtues and why would you like to practice them? Motivational experts tell us that is best to concentrate on improving one aspect of our character at a time?
Would you agree or disagree? Justify your response. Explain what you learned through this experience. What are your other comments or observations? Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: Virtue Log Entries Date: Relate an experience when you practiced your virtue since your last log entry: Were you satisfied with your effort and your results?
Why or why not? What could you have done to make the experience better? How did you recognize this opportunity to practice your virtue? How did you reward yourself for practicing your virtue? Other pertinent comments about the experience: 1 All Rights Reserved Chapter 5 Commonality Cyber Attacks Protecting National Infrastructure, 1st ed.
2 • Certain security attributes must be present in all aspects and areas of national infrastructure to ensure maximum resilience against attack • Best practices, standards, and audits establish a low- water mark for all relevant organizations • Audits must be both meaningful and measurable – Often the most measurable things aren’t all that meaningful All rights Reserved C h a p te r 5 – C o m m o n a lity Introduction 3 • Common security-related best practices/standards – Federal Information Security Management Act (FISMA) – Health Insurance Portability and Accountability Act (HIPAA) – Payment Card Industry Data Security Standard (PCI DSS) – ETSI Cyber Security Technical Committee (TC-CYBER) – ISO/IEC 27000 Standard family (ISO27K) • ISO 27001 – Security management systems • ISO 27002 – Code of practice for InfoSec controls – COBIT - Control Objectives for Information and related Technology – NIST Cybersecurity Framework All rights Reserved C h a p te r 5 – C o m m o n a lity Introduction 4 Fig.
5.1 – Illustrative security audits for two organizations All rights Reserved C h a p te r 5 – C o m m o n a lity 5 All rights Reserved C h a p te r 5 – C o m m o n a lity Fig. 5.2 – Relationship between meaningful and measurable requirements 6 • The primary motivation for proper infrastructure protection should be success based and economic – Not the audit score • Security of critical components relies on – Step #1: Standard audit – Step #2: World-class focus • Sometimes security audit standards and best practices proven through experience are in conflict All rights Reserved C h a p te r 5 – C o m m o n a lity Meaningful Best Practices for Infrastructure Protection 7 All rights Reserved C h a p te r 5 – C o m m o n a lity Fig.
5.3 – Methodology to achieve world-class infrastructure protection practices 8 • Four basic security policy considerations are recommended – Enforceable: Policies without enforcement are not valuable – Small: Keep it simple and current – Online: Policy info needs to be online and searchable – Inclusive: Good policy requires analysis in order to include computing and networking elements in the local nat’l infrastructure environment All rights Reserved C h a p te r 5 – C o m m o n a lity Locally Relevant and Appropriate Security Policy 9 All rights Reserved C h a p te r 5 – C o m m o n a lity Fig. 5.4 – Decision process for security policy analysis 10 • Create an organizational culture of security protection • Culture of security is one where standard operating procedures provide a secure environment • Ideal environment marries creativity and interest in new technologies with caution and a healthy aversion to risk All rights Reserved C h a p te r 5 – C o m m o n a lity Culture of Security Protection 11 All rights Reserved C h a p te r 5 – C o m m o n a lity Fig.
5.5 – Spectrum of organizational culture of security options 12 • Organizations should be explicitly committed to infrastructure simplification • Common problems found in design and operation of national infrastructure – Lack of generalization – Clouding the obvious – Stream-of-consciousness design – Nonuniformity All rights Reserved C h a p te r 5 – C o m m o n a lity Infrastructure Simplification 13 All rights Reserved C h a p te r 5 – C o m m o n a lity Fig. 5.6 – Sample cluttered engineering chart 14 All rights Reserved C h a p te r 5 – C o m m o n a lity Fig. 5.7 – Simplified engineering chart 15 • How to simplify a national infrastructure environment – Reduce its size – Generalize concepts – Clean interfaces – Highlight patterns – Reduce clutter All rights Reserved C h a p te r 5 – C o m m o n a lity Infrastructure Simplification 16 • Key decision-makers need certification and education programs • Hundred percent end-user awareness is impractical; instead focus on improving security competence of decision-makers – Senior Managers – Designers and developers – Administrators – Security team members • Create low-cost, high-return activities to certify and educate end users All rights Reserved C h a p te r 5 – C o m m o n a lity Certification and Education 17 All rights Reserved C h a p te r 5 – C o m m o n a lity Fig.
5.8 – Return on investment (ROI) trends for security education 18 • Create and establish career paths and reward structures for security professionals • These elements should be present in national infrastructure environments – Attractive salaries – Career paths – Senior managers All rights Reserved C h a p te r 5 – C o m m o n a lity Career Path and Reward Structure 19 • Companies and agencies being considered for national infrastructure work should be required to demonstrate past practice in live security incidents • Companies and agencies must do a better job of managing their inventory of live incidents All rights Reserved C h a p te r 5 – C o m m o n a lity Responsible Past Security Practice 20 • Companies and agencies being considered for national infrastructure work should provide evidence of the following past practices – Past damage – Past prevention – Past response All rights Reserved C h a p te r 5 – C o m m o n a lity Responsible Past Security Practice 21 • A national commonality plan involves balancing the following concerns – Plethora of existing standards – Low-water mark versus world class – Existing commissions and boards All rights Reserved C h a p te r 5 – C o m m o n a lity National Commonality Program
Paper for above instructions
Practicing Patience: A Virtue Reflection
Initial Information
1. Selected Virtue: The virtue I have chosen to practice is patience. I selected patience as it is fundamentally intertwined with personal growth, relationships, and overall emotional well-being. In today’s fast-paced world, it's easy to feel rushed or overwhelmed, which often leads to frustration and impulsiveness. By cultivating patience, I hope to foster a stronger emotional equilibrium and enhance my response to challenging situations.
2. Expected Challenges: I anticipate facing challenges such as immediate frustrations in daily situations, such as waiting in lines, dealing with slow internet connections, or encountering individuals who are difficult to work with. These scenarios can mentally test my patience. Additionally, my tendency to rush through tasks may pose a challenge when trying to implement a more deliberate approach.
3. Cues for Reminder: To remind myself to practice patience, I will set daily reminders on my phone with affirmations like "Be patient" or "Take a deep breath." I will also place sticky notes in strategic locations at home and work, such as my desk or fridge, to prompt me to pause and consider my responses during potential irritants.
---
Virtue Log Entries
Date: Week 1
Experience: I encountered a situation when I was stuck in traffic on my way to an important meeting. Instead of succumbing to frustration, I took a moment to breathe deeply and reflect on the increased time ahead.
Effort and Results: I was satisfied with my effort because I allowed myself to accept the situation instead of stressing. However, I initially felt the tension rise in my shoulders—an indicator of my impatience.
Improvements: I could improve this experience by preparing earlier next time to account for potential traffic delays.
Recognition of Opportunity: I recognized this opportunity as I saw the traffic becoming heavier—an immediate cue to practice patience.
Rewarding Myself: I rewarded myself by allowing my mind to wander, thinking about a vacation I hope to take next year.
Other Comments: The experience underscored how often we rush through life and need to embrace the now.
---
Date: Week 2
Experience: I practiced patience with a colleague who was struggling to grasp a concept in our project meeting. Instead of rushing to explain, I listened for a few minutes and then offered my help gently.
Effort and Results: I was happy with my approach because I felt that allowing my colleague to express his frustrations showed respect. The meeting was more productive as a result.
Improvements: I could make this experience better by ensuring I’m fully attentive without preoccupying my mind with my tasks.
Recognition of Opportunity: The opportunity arose when I noticed my colleague's discomfort and frustration as he tried to express his thoughts.
Rewarding Myself: I treated myself to a nice cup of coffee afterward, reflecting on the benefits of that interaction.
Other Comments: I realized that patience not only affects my state but significantly improves the morale of those around me.
---
Date: Week 3
Experience: During a family dinner, I experienced moments of impatience when my relatives began to debate about a controversial topic. Instead of intervening, I remained quiet and allowed them to express their opinions freely.
Effort and Results: I felt proud of my choice to remain patient, which defused a potentially heated discussion and resulted in a lighter atmosphere.
Improvements: In hindsight, I could have asked a reflective question to shift the conversation instead of remaining entirely silent.
Recognition of Opportunity: I recognized this opportunity as emotional tensions started rising around the dining table.
Rewarding Myself: I rewarded myself by savoring my dessert a little longer, taking the time to enjoy it fully.
Other Comments: This experience taught me the value of silence and the impact of waiting to respond thoughtfully.
---
Final Reflection
Overall, my journey in practicing patience has been profound and enlightening. While I did encounter setbacks, including moments when I faltered in my efforts and allowed impatience to surface, I recognized these instances as part of the learning process rather than failures. My progress was not entirely linear; I experienced fluctuations where some days seemed easier than others. However, this fluctuation itself became an integral part of my understanding of personal growth.
I am satisfied with my progress because I noticed a decline in my instinctual reaction to rush or feel frustrated when things didn't go as planned. Instead of immediate irritation, I learned to pause and reflect, enabling me to respond rather than react. I do intend to continue practicing patience as it has enriched my interactions and brought a sense of tranquility to my daily life.
Moreover, there are other virtues I would like to incorporate into my life, including humility and gratitude. Humility appeals to me as a way to remain grounded, while gratitude can enhance my overall sense of well-being. I fully agree with motivational experts suggesting a focused approach to personal development. Concentrating on one aspect, such as patience, allowed me to delve deeper and cultivate meaningful change.
Through this experience, I've learned that virtues like patience are not just about waiting longer but about nurturing a more profound respect for life's rhythm. As I continue to embrace patience as a core part of my character, I look forward to exploring additional virtues and integrating them into my personal growth journey.
---
References
1. Emmons, R. A., & McCullough, M. E. (2003). Counting blessings versus burdens: An experimental investigation of gratitude and subjective well-being in daily life. Journal of Personality and Social Psychology, 84(2), 377.
2. Peterson, C., & Seligman, M. E. P. (2004). Character strengths and virtues: A handbook and classification. Oxford University Press.
3. Seligman, M. E. P. (2002). Positive psychology, positive prevention, and positive therapy. In Handbook of Positive Psychology (pp. 3-12). Oxford University Press.
4. Neff, K. D. (2003). Self-compassion: An alternative conceptualization of a healthy attitude toward oneself. Self and Identity, 2(2), 85-101.
5. Schwartz, B. (2004). The paradox of choice: Why more is less. HarperCollins.
6. Csikszentmihalyi, M. (1990). Flow: The psychology of optimal experience. Harper & Row.
7. Kuehnast, K., & Pomeroy, A. (2005). Building peace: The challenges of managing changes in diverse communities. United States Institute of Peace.
8. Duhigg, C. (2012). The Power of Habit: Why We Do What We Do in Life and Business. Random House.
9. Gilbert, D. (2006). Stumbling on Happiness. Knopf.
10. Miller, W. R., & Rollnick, S. (2013). Motivational interviewing: Helping people change. Guilford Press.
This reflection paper not only addresses my personal growth through practicing patience but also encapsulates broader concepts surrounding the development of helpful character virtues for well-being.