Information Security Models

 

1. Bell-La Padula Confidentiality Model:

Prevents unauthorised data flow through "no read up, no write down" policy.

   

2. BIBA Integrity Model:

Focuses on integrity by implementing "no read down, no write up" policy; 

primarily addresses external threats and doesn't prevent covert channels.

3. Clark Wilson Integrity Model:

Ensures integrity by prohibiting unauthorized modifications, 

maintaining internal and external consistency; 

uses access triple (Subject, Program, Object), 

Separation of Duty (SoD), 

Constrained Data Item (CDI), Unconstrained Data Item (UDI), 

Integrity Verification Procedure (IVP), and Transformation Procedures (TP).

4. Brewer and Nash Model (Chinese Wall Model):

Access control mechanisms vary based on user authorization, 

creating barriers between sensitive information.

5. Graham Denning Model:

Implemented through an Access Control Matrix, where subjects can perform actions on objects, each object owner holds special rights, and each subject has a special rights-granting subject.

6. Take Grant Model:

Defines rules for transferring rights: "Take" allows a subject to take rights over an object, "Grant" permits a subject to grant rights to an object, "Create" enables the creation of new rights, and "Remove" allows a subject to eliminate its own rights.

Things to consider in Risk Management

1. Risk Models - Always ideal to use the well established methods for risk analysis tasks rather than starting from scratch and preparing own risk models.
2. Risk Assessment - Should not be relating Risk Assessment with Audit. Audit role is to help company understand and implement security controls to determine where the controls failure will occur and/or where the breakdown in security controls will happen. But with Risk Assessment the focus is on checking that controls are in place to protect against the security threats by identifying risks to the organisation, its technology and its processes. The risk management role encompasses managing the risks associated with the use of information technology, to determine how to get most out of the investment in security controls and related processes. 
3. Cost/Loss Expectancy - Risk Management must also consider the Total Cost of Ownership (TCOR) - such like Insurance cost, Loss Cost, Annual Loss Expectancy, Administration cost, etc., 
4. Conflating Precision with Accuracy - It is not always possible to give exact numbers for risk assessment, vulnerabilities, incidents. Hence a range 60-90% can be considered as a probability. 
5. Risk Register - Document a list and rank all the risks/events that can go wrong in the risk register repository. Risk register should not overemphasise on esoteric risks, instead consider real world risks in the register and rate and prioritise on more threatening risks to the organisation and business. 
6. Risk Exception Management - when a risk identified fails to comply with organisation policy of risk management, deviate from standards practice for stipulated period of time, risk exception process is to be followed. It helps to clearly determine the areas of non compliance, timelines of impact, determine if there's risk of fines, penalties or malicious activity due to non-compliance. 
7. Risk Rating to assess the risks identified and classify them as low medium or high considering their probability, frequency and impact of the risk. 
8. Risk Intelligence program aims to identify potential risks that can help organisation recognise the challenges that could compromise their business. Provide a proactive approach to discover risks identify likelihood ad eliminate them. Help define a risk posture to provide a structure to the risks tailored to the organisation/business operations. It will be baselined on Threats, Controls, Assets and impacts (TCAI) and any changes to aforementioned will alter the risk posture. Also define and explain what makes a valid source of risk intelligence. Implement risk intelligence which will be capable to deal with new information/change that will induce changes to risk posture. 
9. Multiplying by ordinals - Just considering risks on an ordinal scale such like High, Medium, Low without considering the quantities represented by their value can lead to ineffective management and wrong utilisation of cost and resources in mitigation. If wee have high level risk and he probability is extremely low then emphasising on risk management with particular threat/risk is just a bad calculation. Doing risk management wrong is more worse than doing nothing at all!
10. ROSI - Return on Security Investments to clearly measure the return on investment in cyber security initiatives within organisation. It is difficult to quantify the benefits derived from the security initiatives for an organisation directly in monetary values. The measures will be in such type of the count of incidents prevented, attacks defended/blocked by the tools implemented, number of vulnerabilities patched, number of malwares removed or quarantined, Reduction in the number of risks over the time period, penalties and regulatory fines avoided, repetitional damage covered, response times, ability to minimise the loss/impact ad such. 

A glimpse into Cyber Security Risk Management

 

The increasing frequency, creativity and variety of cyberattacks all enterprises are bound to grab attention into the cyber security risk management.

The Definition:

The process of Risk Management  can better identify, assess, communicate, and manage their cybersecurity risks in the context of their stated mission and business objectives using language and constructs already familiar to senior leaders.

The Approach:

The Risk Management Framework (RMF) offers a methodical and adaptable strategy to handle the risk associated with integrating systems into the organization's mission and business processes. A good risk management framework should comprise of:

• Standards and Guidelines to support implementation of risk management programs 
• Meet the requirements of the abiding law and regulatory requirements
• Control Selection to baseline and provide adequate protection
• Control Implementation to make the framework functional
• Control Testing to determine if controls are implemented correctly, operating as intended and producing desired outcomes. 
• Risk Assessment to identify, analyse, evaluate and treat the risks 
• Continuous Monitoring for early threat detection, faster incident response and continuous compliance with regulatory requirements.

Top Risk Management Frameworks:

1. ISO 27001 & ISO 27002.
2. Cybersecurity Maturity Model Certification (CMMC)
3. NIST 800-53 & NIST CFS.
4. AICIPA, SOC 2.
5. EBIOS.

An Example - NIST RMF:

For more information on each RMF Step, including Resources for Implementers and Supporting NIST Publications, select the Step below.

Prepare	Essential activities to prepare the organization to manage security and privacy risks
Categorize	Categorize the system and information processed, stored, and transmitted based on an impact analysis
Select	Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)
Implement	Implement the controls and document how controls are deployed
Assess	Assess to determine if the controls are in place, operating as intended, and producing the desired results
Authorize	Senior official makes a risk-based decision to authorize the system (to operate)
Monitor	Continuously monitor control implementation and risks to the system

This process will be executed with the chain of experts from cybersecurity team like Chief Information Security Officer, Chief Risk Officer, Risk Manager, Risk Advisor, Risk Management Co-Ordinator and so. However, it is ultimately the responsibility of the Business management team including Chief Executive Officer, Chief Technology Officer, Project Manager, Business owner, Application owner, Business Information Security Officer and so on to ensure risk management is completed effectively. 

In-house risk management teams will be a standard capability within the information technology sector. In contrast, major industries such as manufacturings, healthcare, finance, energy, transportation, pharmaceuticals, retail, real estates, and others will rely on cyber security risk consulting firms, including prominent entities like the Big 4 and other leading consulting companies. 

API Integrations - Learning and early adaptations - An approach defined from gartner

 API integrations, or Application Programming Interface integrations, involve connecting different software systems or applications to allow them to communicate and share data with each other. This enables the creation of more robust and feature-rich applications by leveraging the functionality of existing services and platforms. Here are some key points to consider when working with API integrations:

1. Types of APIs:

   • RESTful APIs: Representational State Transfer APIs use HTTP requests to perform CRUD (Create, Read, Update, Delete) operations on resources, making them one of the most common types of APIs.
   • SOAP APIs: Simple Object Access Protocol APIs are protocol-based and use XML for communication. They are often used in enterprise-level integrations.
   • GraphQL APIs: This query language for APIs allows clients to request exactly the data they need, potentially reducing over-fetching or under-fetching of data.
   • Third-Party APIs: These are APIs provided by external services, such as social media platforms, payment gateways, or mapping services.

2. Authentication and Authorization:

   • Most APIs require authentication to ensure that only authorized users or applications can access the data or services.
   • Common authentication methods include API keys, OAuth, and JWT (JSON Web Tokens).

3. Rate Limiting:

   • Many APIs implement rate limiting to prevent abuse and ensure fair usage. Be aware of rate limits and handle rate-limiting errors gracefully in your integrations.

4. Error Handling:

   • APIs can return errors for various reasons. It's important to have robust error-handling mechanisms in place to handle and log errors gracefully.

5. Data Format:

   • APIs often use JSON or XML for data interchange. Ensure that your integration can parse and format data in the required format.

6. Documentation:

   • Thoroughly read and understand the API documentation provided by the service you're integrating with. It provides information on endpoints, request and response formats, and usage guidelines.

7. Testing:

   • Test your API integration thoroughly in a development or staging environment before deploying it in a production setting.

8. Security:

   • Implement security best practices, such as data encryption, to protect data exchanged through the API.

9. Monitoring and Logging:

   • Set up monitoring and logging to track the performance and behavior of your API integrations. This helps in identifying issues and ensuring smooth operations.

10. Versioning:

    • APIs can evolve over time. It's a good practice to specify the API version in your integration to prevent compatibility issues when the API provider releases updates.

11. Compliance and Regulations:

    • Be aware of any legal or regulatory requirements related to data handling and privacy, especially when dealing with sensitive data.

API integrations are a powerful way to extend the functionality of your applications, but they also come with responsibilities. Proper planning, testing, and ongoing maintenance are essential to ensure the reliability and security of your integrations.

Digital Trust

 

What is Digital Trust?

• Digital trust is the confidence users have in the ability of people, technology and processes to create a secure digital world. 
• Digital trust is given to companies who have shown their users they can provide safety, privacy, security, reliability, and data ethics with their online programs or devices.

Today's Problem

• Digitisation is constantly evolving and changing yet not implemented to fullest
• Some transactions involve a mixture of conventional and digital methods
• Control is lost when data is online
• Fear of frauds, hacks, loss, breach, and so on
• Uncertainty due to lack of awareness 
• Solution? 

Need of Digital Trust

• Legal dependence on email or other digital documents
• Make payments online, integrating bank accounts
• Have a reliable and auditable digital systems
• Trust online presence of unknown companies (remote working), restaurants, hotels for online bookings. 
• Negotiate contracts online

Concepts of Digital Trust:

Technical Requirements

• Unique Identity access management
• Public Key Infrastructure (PKI) for digital certificates
• Federated trust between organisations 
• Trusted time-stamping service for digital signatures
• e-assurance service provider
• Archiving

Privacy 

• Encryption 
• Data collection justification - Ex.: "Not for marketing email", "Do not pass to 3rd parties", "For credit reference only', etc.
• Data Retention & Disposal - Expiration date, deletion & purging
• Digital signature by the original data issuer
• Data Tagging - Define purposes to be marked in the record 
• Consent and Disclaimers

DRM

• With latest technology and application to be able to facilitate a way to digitally manage and implement Digital trust
• Reasonable prevention of printing, copying, forwarding etc. Ex: Aadhar Validation
• Convergence of the technologies used for signing with DRM. Ex: Docusign 

Legislative Requirements

• Governmental, Judicial and Law enforcement support
• Framework for recognition of digital assurance services 
• Pass laws and standards 
• Monitor and Regulate

Building Digital Trust

Attributes of Digital Trust - An Example

Building Digital Trust

• System Rules, which govern the interactions between members 
• A Legal Structure, which identifies the rights, responsibilities, and liabilities associated with participation in the federation, 
• A way of Establishing Conformance across its members, and 
• A way of Recognising that Conformance.

System Rules 

• A fundamental purpose for building trust frameworks is to define the identity management operations and technical requirements needed to support the identity federation and to clearly assign responsibility for performing those operations. 
• Since federation members expect and need to trust those identity management operations, the identity management operations of the federation are typically presented as requirements or rules. 
• The federation members responsible for performing specific operations are expected to demonstrate conformance with the rule set specific to their role.

Legal Structure 

• Trust frameworks present the operational and technical requirements for federated Identity management, and must also provide the legal basis to bind those requirements to federation members. Identity federation members voluntarily agree to participate in the federation and follow the trust framework rules. 
• While there are varying means to bind members to federation rules, the most straightforward and common method is through contract or agreement. 
• Members become legally bound to the trust framework rules through signed agreements to comply with the operational and technical rules as well as the legal rules, rights, and obligations of federation members. 
• Therefore, trust frameworks and associated member agreements form a contract-based legal structure which applies to all federation members. This legal obligation is critical for providing the assurance and trust for the federated identity system.

Establishing Conformance 

• Establishing and enforcing conformance amongst its members to its set of agreements and operating rules is vital to an identity federation’s functioning. Conformance is the degree to which a federation member has implemented, and is adhering to, the rules of the federation. 
• The amount of rigor, and therefore burden, an identity federation requires of its participants in demonstrating conformance to its trust framework should be commensurate with the degree of risk it is designed to address. 
• Frameworks that accommodate different kinds of transactions, with differing amounts of risk, may choose to offer multiple levels of conformance based on a graduated set of rules and requirements. It provides options a Federation Administrator may consider when defining how they will establish conformance amongst its members.

Recognising Conformance 

• Conformance recognition is the process by which identity federations enable their participants to communicate alignment with the technical rules and legal stipulations of the framework. 
• It is done only after completion of the selected conformance testing process. It is not enough for federation participants to simply establish their conformance; they must also be able to communicate that conformance to other federation members. 
• In addition to establishing cross-boundary trust, enabling discovery of approved services and entities, and—in some cases—promoting a competitive service market, trust frameworks must also be able to support mechanisms for the communication and recognition of conformance. 
• There are many ways this can be achieved, ranging in complexity from a simple registry or listing service, to trust marks and digital certificates. There are even emerging approaches that seek to express federation conformance through dynamic and machine readable mechanisms to allow for real time federation and inter-federation

Summary

Building Digital Trust in closed-context boundaries like within an organisation. 

Building Digital Trust in open-context to co-exist with your system like inter-organisational trust.

With the dynamic changing needs of modern digitisation of daily lives, trust becomes an important factor.

World has been evidencing many breaches of trust in today’s world. 

Understanding digital trust is a good step to become more trustworthy in digital world.