Introduction

What is cyber security? Is it complicated and impossible to understand? Or is it something that is achieved by following a few simple steps? In truth it is somewhere in the middle. This module, and in particular, this section, we will aim to understand what is meant by the term cyber security. We will explore the need for it and its relevance to the systems that we use. By describing what it is, and by dissecting some of the concepts we use to define it, we will aim to demystify the area, and enable us to better understand how to protect the systems we use.

The video below will introduce us to this module, and in particular why we should care about cyber security. As can be seen within the Maritime: An IT Context module, IT systems are present through vessels and maritime operations more broadly. A cyber attack has the potential to have a broad range of effects upon a vessel, from a minor inconvenience through to something which could be harmful to the vessel or the crew. Crew safety is paramount, and as such cyber security is becoming a key area of shipboard safety that can not be overlooked.

What is Cyber Security?

We generally understand Cyber Security to be protecting our computing devices from bad things occuring. That some unseen person, or known foe, attacks our system to steal our data or to take control of the system to harm it. And this is generally true, but such a definition doesn't particularly help to understand what they could do, or in the case that it's too late, have already done, to our systems. Cybersecurity is a continuously changing field, with the development of technologies that open up new avenues for cyberattacks, so gaining a foundational understanding of how attacks work enables us to adapt and foresee what future attacks may look like.

The field of Computer Security (the less marketing friendly name to cyber security, which has been used for longer and is a bit broader than just the digital elements of the system, they will be used interchangeably within this course) has traditionally been defined as the need for Confidentiality, Integrity and Availability by almost every author who has written on the topic. The addition of the requirement for Authentication is because both Confidentiality and Integrity and to some extent, Availability, depend upon the reliable identification of whom is accessing the data. These four goals are the cornerstone of our understanding the threats against and the protection measures for any given system.

These goals have different meanings and emphasis in different application environments and we need to look at the balance of these in the Maritime environment. This is always going to be tricky as in the face of operational requirements, highly complex and interconnected systems and possibly changing network connectivity within a journey which will all inevitably result in trade offs having to be made. This isn't a unique situation to maritime. In all fields there is complexity and use cases that need to be considered, that result in differing trade offs being made. Good computer security is about making informed decisions around those tradeoffs that still result in a secure computer system. This course is not aiming to make you all into computer security experts, but to enable you to understand the questions and issues that need to be raised, so that you can understand the trade offs that are being made (which makes it easier to follow security guidelines), or to provide feedback on systems which may be correctly balancing those tradeoffs.

Watch this video to see an introduction to the four goals mentioned above, and we follow with more in depth description of each.

assets of a computing system are accessible only by authorised parties.

This definition (Pfleeger, Pfleeger & Margulies, 2015, p4) talks about 'assets' which reminds us that information systems consist of hardware, software and data and that confidentiality can be lost via physical theft as well as unauthorised electronic access. It also reminds us that the data is there because it is useful to one, a few or many people and that it is to be made available to them. What this definition demands is that only those who are authorised to have access to the data are allowed to do so. This is of course means that we need techniques to identify and authenticate users of the system.

The terms 'parties' reminds us that in fact people do not stare at the digital data unaided; it is delivered to them via the operating system and a variety of software written and managed by people.

This means that in order to be sure of maintaining the goal of confidentiality for our data we have to trust many other people; the people who write the operating system code and application software, the people who install and maintain this and also our hardware and the authorised people who are provided with the authentication details that allows them to access the data.

You may note that the definition says nothing about controlling what the authorised parties do with the data. However there are some systems that attempt to control and monitor that the confidential status of data is preserved, but these are usually only found in very special environments. It is obviously no use restricting access to data if an authorised user can then write it to an unrestricted file. A common example of this is copying such data into an email. Unfortunately this is hard to restrict in a way that does not produce user frustration.

A final note, is that once confidentiality has been lost it cannot be retrieved. This is not necessarily the same for all our goals.

Every piece of data is as the last authorized modifier left it.

The thing that this definition (Schneier, 1999) does NOT say is that the data is accurate. Computer security techniques have no ability to control the accuracy of data as it is created or modified. However they can try to ensure that only those who have the authority to do so, can create, modify or even delete data. Often the actor making the changes is not a person at all but a piece of software or program. As with confidentiality this again relies on the ability to properly authenticate who the actual user is and to maintain accurate and sufficiently protected tables of what each authorised user is allowed to do with the data managed by that information system.

An interesting concept in this context is that of the granularity of control. This refers to the ability to dissect authorisation to something such as a 'write' privilege which allows creation and changing of data or the more finely dissected ability to just change data.

an attacker can’t prevent legitimate users from having reasonable access to their systems.

It is important to notice that this definition (Schneier, 1999) is about ensuring that those who have the right, can use the system when it is usual for them to do so. It does not say that a user can use a system whenever they feel like it. Indeed many systems try to enhance their security by restricting when users can have access, for example to during their normal working hours. This is made easier by putting users into classes or groups, all of whom have the same access privileges or rights. This also makes it easier to change rights for a group when and if circumstances change.

The other nuance with this definition is that perhaps the access may from time to time be restricted to a narrower range of options than normal. It is common for large information systems to have some kind of parallel system running beside the live system, mirroring the essential data changes. This backup system can be used to provide the 'reasonable' access described in this definition.

The common thread through all the definitions above is that they rely on the ability to authenticate the identity of the person using the system. The classic cartoon below sums up the dilemma.

dog cartoon

In order to authenticate a user of an system or a person in the real world, two things have to happen. Firstly we have to identify the person then we have to confirm that we have made the correct identification. Once this has happened we then work out what we are going to allow them to do or not do. I am sure that you have in your life mis-identified people and hopefully that has not led to too great an embarrassment. In other words we should not be too surprised when information systems find accurate identification and authentication equally hard to do.

I am sure that you are all used to systems that asked you to identify yourself via a user name known to the system and then authenticate yourself with something you know, such as a password or pin. There are some well established characteristics for means of authentication for the data that we use that has legal validity. We need to establish the following characteristics:

That the data is genuinely from the purported source

One problem with emails is that it is so so easy to create emails that look like they come from someone else.

That the creator or sender cannot successfully claim not to have done so (cannot be successfully refuted)

This means we need some way of proving that only the purported identity could have created or sent the document or message. We need the help of cryptography to achieve this.

That the creator or sender cannot disassociate themselves from the data (Non repudiation)

We need policies and user education to achieve this goal. Technology can help by automatically closing sensitive sessions when they are left idle, but it is user behaviour that will keep authentication details confidential to each. In the end all security relies on the trusted behaviour of individuals. What we are aiming for is the ability to say the equivalent of: 'if someone was able to pretend to be you then your behaviour enabled them to do so'. Predictable passwords (such as being based on our birthdate) is an example of this.

That the data cannot be re-used

Conversely, this is a characteristic that can be provided for by technology. We can stop a demand for payment or an electronic prescription being re-used by placing unique identifiers in the data that allow for once only use.

That it is not possible to forge any of the above characteristics

This is achieved by a combination of trusted user behaviour, a sound policy and education environment and technological solutions. As you progress with the study of computer security you will learn that each technical solution has varying costs and abilities. None of the possible solutions alas, provide a perfect cost effective solution for all circumstances. There are always trade offs, and that is where understanding the use case for the security tool is vitally important.

This ends the overview of the primary goals that we are cerned with in computer security. We will see these goals reappear multiple times throughout this module. They are key to understanding not only how attacks often function, but also our defensive measures.

What Knowledge do we need?

It is all well and good to define security goals. But can we can't just apply them blindly. So much of the security of a system is about how fit for purpose it is. How well suited is the software or technical solution to the scenario that it is being applied to. Extremely strong security which results in a system no longer being able to function as was designed may result in it no longer being functional. Users are a vital link in the security of any system, and understanding their needs is a vital step in protecting the systems that they use.

This video below will explore what kinds of knowledge that we need to enable us to protect a system.

If you would like to get a deeper understanding of the topics discussed above complete the following reading:

Schneier B (2000) Secrets and Lies: Digital Security in a Networked World. Wiley, Chichester

Conclusion

This section has introduced you to the four main goals that are discussed within cyber security. It is through the lens of these goals that most problems are examined. Breaching these concepts is the goal the the attacker, and protecting them is the goal of the security professional. To do this successfully we need a broad set of knowledge and skills. The MariMOOC is designed to try and encompass some of these areas to enable you to understand how they interrelate. Obviously Cyber security knowledge is vital, but in addition to this the MOOC contains modules of Information Technology, Maritime Technology and Human Factors.

The remainder of the cybersecurity module will introduce you to the kinds of threats that are facing our systems, and how we can respond to them, to limit their effectiveness.

References

Pfleeger, Pfleeger, Margulies, Security in Computing (5th Edition), Prentice Hall (2015) http://ptgmedia.pearsoncmg.com/images/9780134085043/samplepages/9780134085043.pdf

Schneier, Attack Trees, Dr. Dobb's Journal, December 1999. https://www.schneier.com/academic/archives/1999/12/attack_trees.html

Peter Steiner, "On the Internet, nobody knows you're a dog" , The New Yorker, July 5, 1993