Cyber forensics is studied as part of the digital forensic science subject. It pertains to the legal evidence lying in the digital storage media and the cyber space. Since the advent of digital age, the need to have cyber professionals has grown exponentially. It has basically resulted from the internet explosion in India that was witnessed recently owing to e-governance, e-banking, e-commerce and social media.

The demand for the course of B. Tech. Computer Science with Cyber Security and Forensics was triggered with continuous attacks on social media and its misuse. So, there was a cyber terrorism threat to the internet security of our country which it was not properly equipped to handle. After this threat started to impact the national security, the Indian government passed a resolution to have its cyber protection architecture in place at the national level.

Cyber Security Policy for Data Protection

The policy was proposed in 2011 seeking to protect the national assets from cyber-attacks and offering protection to the information of citizens. It was also directed at strengthening team dealing with Computer Emergency Response to audit, protect and spread awareness about the issue along with encouraging open standards. It is estimated that by the end of 2015, India may need about five lakh experts in to handle its cyber security to support the growing internet economy.

Opportunities with Different Sectors

The financial sector itself is going to hire about two lakh people including those working for oil and gas, power, utility, airlines, telcos and government. So, the government is looking forward to hiring such professionals for its e-governance and law and order departments. The massive hiring is expected as the Indian information security market continues to see an upward trend despite an economic slowdown.

Topics to be Covered

Therefore, a B. Tech. degree in computer science with specialisation in cyber security and forensics is soon to be introduced by many universities in India. As there was a need to have a curriculum for information protection, the head of departments introduced the course in their respective institutions to meet the talent demand. They started teaching subjects including environmental studies, introduction to open source software and open standards, HTML programming, mathematical logic, data structures using C and engineering graphics.

In addition, papers like computer systems architecture, information security fundamentals, design and analysis of algorithms, database management systems and data modelling with electronic devices and circuits were added. Also, subjects, such as microprocessors and embedded systems, storage technology foundation, philosophy of science and theory of automata and computation were taught as part of this discipline.

There were more topics added into this discipline as they were relevant in the modern day virtual world.

Data Science & Cybersecurity – what is big data analytics? Why is machine learning applications so important? Why did InfoSec Professionals require to learn about DS? What to know about “data bots” as a data science professional? Differences in data science vs machine learning? How to crack cybersecurity jobs with data science advantage?

DS is a multi-sided field that uses scientific techniques, methods, algorithms, and security practices to extract information and insights.

With the help of DS tools such as Machine Learning and Big Data Analytics, businesses can now get access to meaningful insights hidden within massive data-sets.

This is where DS can help create a significant and lasting impact.

DS and cybersecurity, two of the most popular career paths, are on a collision course. Very intelligent, seasoned, senior managers do not fully understand the importance, or the complexities, of DS and cybersecurity. “There’s a mad rush in the cyber security solutions space to use the terms machine learning, analytics, and DS in conjunction with security products. The CERT Data Science and Cybersecurity Symposium highlighted advances in DS, reviewed government use cases, and demonstrated related tools. Applied DS for Cyber Security. In today’s world, we are assailed by ever-increasing amounts of data and increasingly sophisticated attacks. The programme is designed to build students’ knowledge and develop their expertise in network security, cryptography, DS, and big data analytics. The NACE Center and BHEF conducted research into two skills likely to be important in the future economy: data analytics and cybersecurity skills. A data scientist is a professional with a blend of skills in computer science, mathematics and cybersecurity domain expertise. Cyber Security is a fast-growing field in an ever-interconnected world. Learn why it matters and what data science has to do with it. Data science, along with technologies such as machine learning and artificial intelligence, has found its way into countless security products. Leading experts in the fields of data science and cybersecurity discussing a range of topics related to the role -DS has in addressing the issues.

The section of knowledge will illustrate the inter-relationship between several data management, analytics and decision support techniques and methods commonly adopted in. With automation and AI able to pick up jobs that humans need them to, data analytics and cybersecurity might find it easier to hire skilled employees. Although machine learning tools are commonly used in numerous applications, the big boom of advanced analytics in cybersecurity is yet to come. And that will be interesting to see the future tools to cop up with. Fingers crossed.

CIOs are continuously innovating and improving their technology, but is cyber security their job?

In this day and age digital disruption is an ever-present occurrence in almost every sector, and it is this fact that earned some CIOs the title of Chief Innovation Officer’s. But with a massive focus on innovation some areas in business tend to suffer, and amongst the worst hit is cyber security.

“We can’t speak on innovation without touching on cyber security. It might be scary, but to move forward we should never get stuck in the gloom,” said Kendi Nderitu, Check Point, Country manager, Kenya, during the CIO IoT and AI Summit being held at the Crowne Plaza, Nairobi, Kenya.

According to a recent Harvey Nash/KPMG CIO Survey, 89pc of chief information officers said they were maintaining or increasing investment in innovation, yet only one in five claimed they were able to handle a cyber security attack “very well”.

As CIOs come to grips with these harsh realities. The question then shift to, is security the Chief Information Security Officer’s (CISOs) job? By dictionary definition, a CISO is the senior-level executive within an organisation responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected.

The CISO directs staff in identifying, developing, implementing, and maintaining processes across the enterprise to reduce information and IT risks. They respond to incidents, establish appropriate standards and controls, manage cyber security technologies, and direct the establishment and implementation of policies and procedures. The CISO is also usually responsible for information-related compliance.

The CISOs role is becoming more important in the connected world. During the Summit Michael Michie, CISO, M-Orient Bank, said that securing the smart infrastructure is becoming a necessity for businesses, especially businesses that have millions of sensors and thus have many potential points of attack.

“The role of the CISOs is becoming extremely complicated because the skills that CISOs have now is part of a private network which have specific connections to a larger network. But right now, the world we are getting to, everything needs to be connected for things to be cheaper, faster and more reliable they all need to be connected. Essentially you are told to protect the whole world but you work for one organisation only,” he added.

“The role of security in this age of connectivity thus falls to everyone.” Michie concluded.

The increased growth and adoption of web 2.0 technologies, the platforms that enable the publishing of user generated contents has led to the creation of another dimension in which human existence called the cyberspace. In the cyberspace, people interact just as they do in the physical space. They socialize, conduct businesses, study, share and store materials, and even entrust highly valued assets (in terms of information) for easy access, availability, and safe keeping.

Cyber security is essential to govern the conducts and manners of interacting with the computer systems and other user in the cyber security. Without a sense of security, various activities like e-commerce, care-free socializing, business networking and the like would not be possible and hence set a hurdle in this mobile and information era.

Cyber security vs Computer/Information/Network security:-

Though these terms are sometimes used interchangeably, they are indeed different. Computer security, network security and information security all target solely on the safeguarding of computer systems components and the data/information created, stored or transmitted on or through the systems. Cyber security goes a step further to take care of the possibility where a user can be a victim of a cybercrime. There are crimes such as Intellectual property rights violations in which the system components are not victims, they are mere media used to facilitate the crime and the rights owner is the victim.

Cyber security from the legal angle:-

Different countries have different laws enforcing cyber security. Taking the United Republic of Tanzania as an example, The Cybercrimes Act 2015 governs the conducts and liability of parties in the cyberspace. For all the examples given above and many more, the law clearly guides what is to be done. It also provides legal guides on how users are to interact in the cyberspace, utilize devices and systems, as well as responsibility of all involved parties in any interaction in the cyberspace.

Cyber and the Healthcare Industry:-

The Healthcare industry has featured in the top 5 industries attacked by cyber criminals for a number of years now. The WannaCry ransomware attack earlier this year that affected many health trusts across England and Scotland brought the health impact of the cyber threat to the forefront of media and political debate in the run up to the 2017 General Election. So why would anyone want to attack healthcare and what are the threats?

The day-to-day activities of the modern world is largely influenced by the internet and not a single day can pass without computers and the internet. As the World Wide Web opens up new space for communication and connectivity, it becomes the responsibility of the internet users to ensure cyber security. Cyber crimes are increasingly becoming common and unless you take preventive measures, you can easily fall prey to these cyber crimes. The month of October is proclaimed as national cyber security awareness month and experts urge internet users to realize the importance of cyber security.

The internet is a collection of computers and thus, everyone participating is responsible for enhancing security on the internet. Hackers are always interested in gaining unauthorized access to computers on the internet and if your computer is not protected, then you can’t stop hackers from installing malicious programs remotely. You can prevent these attacks by installing appropriate security software, but the need for staying anonymous on the internet is growing rapidly. When technically smart people gain access to your IP address and other personally identifiable information, they can manipulate the information in any way they want, making you a victim of cyber crime that you have never even heard of.

Experts urge internet users to stop sharing their personal and sensitive information. Despite the care you take to avoid giving away your personal information on social media websites and other websites, the cyber safety laws won’t protect your privacy. The internet service providers always collect personally identifiable information and this information can be shared with third parties without notifying you. In the month of October, in which the importance of cyber security is emphasized, you should take measures to spread awareness about staying anonymous on the internet to protect privacy.

In order to connect to internet, you have to compromise security if you connect directly to your ISP. The VPN service providers are ready to help you to protect your privacy and safety while connected to internet. Rather than using unsecure ISP connection, you will be using secure and fast VPN network server connection to share personal information. The VPN servers will strip network data from all personal information and then let you connect to your ISPs as usual. From the ISPs point of view, you will be available as just another internet user, but your computer IP address and other personal information will remain masked.

With VPN service, you can truly understand the need for declaring a whole month as cyber security awareness month. When you can prevent third parties from knowing your personal information, you can ensure safety and security. The VPN service providers won’t store any logs and potentially, your identifiable information is not known to anyone else. This will ensure maximum privacy and you can stay worry free connected to internet as long as you know that you can’t be traced back. VPN service is fast, safe and secure and no one can pose any restrictions on you about internet usage and you will get much more than what you have paid for.

If it’s not your job to take care of the cyber security matters, then why should you care? You must do because you still need to play your part in this system. If something goes wrong and you were found at fault, you will be held responsible.

If you want to stay secure, below are a few tips for cyber security tips at work.

Avoid writing password on paper

No matter how much work you have to do at work, make sure you keep your passwords secure. It won’t be a good idea to write down your passwords on a piece of paper like a sticky note and then put it somewhere where everyone can see it. This approach will compromise your personal data quickly than you can imagine. Try a password manager instead.

Avoid Using Public Wi-Fi

Irrespective of the type of industry you are in, probably you have to do some work when you are away from your office in the market. Today, everyone needs to stay connected to the Internet through WiFi at all times, but public WiFi can’t be a safe choice here.

If you are going to use a public WiFi, make sure you use the VPN offered by your company before making an important financial transaction.

Avoid Using Unknown USB drives

People drop things, especially things that are small in size. You may have come across something lying on the ground, such as a USB drive. What would you do to it? Like most people, you will be tempted to make use of it.

Unfortunately, according to research studies, most people who come across USB drivers connect them to their computers to see what’s on them, which is a big mistake. You don’t know what is stored on them. It could be a virus or malware that may damage your office computer or steal your sensitive data. Therefore, it’s better to avoid using such devices.

Avoid phishing traps

Often criminals access corporate networks through a phishing trap. It’s important to keep in mind that no company whether small or large is immune to these frauds. It can happen to any of us.

You may think you are safe, but know that your data may be stolen. Criminals are always on the lookout of an opportunity to achieve their purpose. They may steal your data and sell it on the dark web.

So, the question is, how can you avoid a phishing fraud? It’s simple. You shouldn’t click on just any link that looks quite similar to the website you frequently visit.

Back up Your data

Make sure you back up your data. Ranswomware have caused billions of dollars of loss to people, especially businesses. When people are unable to access their important files, they agree to pay the ransom amount demanded by the cyber attackers. Often, they target companies because they can pay huge amounts in ransom to save their data.

So, what is the way out? You just need to backup your data, which will keep you safe when you refuse to pay the ransom and the hacker deletes your data.

So, these are a few cyber security tips that you may want to follow to stay safe at work.

Keeping business data safe is the number one concern of business nowadays. Due to the rising security breaches on several companies, data security against unwanted intrusion is on everyone’s mind. No matter big or small, IT security is the biggest challenges organizations face. When it comes to small or medium enterprise the impact of security threat is even more severe. Cyber criminals love to target small business largely due to the fact that SMBs cannot afford to implement strong security protocols. Nothing can be hundred percentage safe, but at the same time SMEs can advance the protection environment by acquiring a strong understanding of their external web presence and ensuring it is secure by undertaking penetration testing and minimizing exposure by taking action such as regularly updating security patches.

What is Data breach and how it happens?

Data breach is an incident in which sensitive, protected or confidential data has potentially been viewed, stolen or used by an individual unauthorized to do so. The most common concept of a data breach is an attacker hacking into a network to steal sensitive data. A number of industry guidelines and government compliance regulations mandate strict governance of sensitive or personal data to avoid data breaches. It is a scenario where your company or organizations’ data is stolen. When we check into the company folder and find all information is gone, client files, logs, billing information have all been compromised. Then it is clear that your business is becoming a victim of a data breach cyber-attack.

Most common causes of data breaches

Protecting sensitive data is critical to the lifeline of an enterprise. What can be the most common causes of data breaches?

• Physical loss or theft of devices is one of the most common causes of data breaches: This is arguably the most straightforward of the common causes of data breaches. However, there are many different ways that this can occur. It could be that anyone of your laptop, external hard drive, or flash drive has been damaged, stolen, or misplaced.

• Internal threats like accidental breach (employee error) or intentional breach (employee misuse): This can occur when employees handling delicate data not clearly understanding security protocols and procedures. Data breach can also occur from a mental error, when an employee sends documents to a wrong recipient.

• Weak security controls are often top concerns for protecting an organization’s data: Incorrectly managing access to applications and different types of data can result in employees being able to view and transport information they don’t need to do their jobs. Weak or stolen password has been yet another main concern. When devices such as laptops, tablets, cell phones, computers and email systems are protected with weak passwords, hackers can easily break into the system. This exposes subscription information, personal and financial information, as well as sensitive business data.

• Operating system and application vulnerabilities: Having outdated software or web browsers is a serious security concern.

Tips to prevent Cyber threat

Amid the chaos and the hype, it can be difficult to get clear, accurate information about what’s really going on when a data breach occurs. While data breaches are certainly a complex issue, equipping yourself with basic knowledge of them can help you to navigate the news, to handle the aftermath, and to secure your data as best as you can. The increasing frequency and magnitude of data breaches is a clear sign that organizations need to prioritize the security of personal data.

Latest developments like embracing cloud, deploying BYOD etc. enhances the risk of cyber threat. Employee ignorance is also one of the major concerns. Hackers are well aware of these vulnerabilities and are organizing themselves to exploit. There is no need to panic, especially if you are a small business, but it is imperative to take a decision. Make yourself difficult to target and keep your business secure with these top 5 tips.

Here are the top 5 tips to prevent the cyber threat.

1. Encrypt your data: Data encryption is a great preventive control mechanism. If you encrypt a database or a file, you can’t decrypt it unless you have or guess the right keys, and guessing the right keys can take a long time. Managing encryption keys requires the same effort as managing other preventive controls in the digital world, like access control lists, for example. Someone needs to regularly review who has access to what data, and revoke access for those who no longer require it.

2. Choose a security that fits your business: Cracking even the most secure companies with elaborate schemes is now far greater than ever. So adopt a managed security service provider that can deliver a flexible solution cost effectively and provide a seamless upgrade path.

3. Educate employees: Educate employees about appropriate handling and protection of sensitive data. Keep employees informed about threats through brief e-mails or at periodic meetings led by IT expert.

4. Deploy security management strategy: Nowadays cyber-attacks are highly organized so organizations need to establish a strategic approach so that your entire environment works as an integrated defense, detecting, preventing and responding to attacks seamlessly and instantly.

5. Install anti-virus software: Anti-virus software can secure your systems from attacks. Anti-virus protection scans your computer and your incoming email for viruses, and then deletes them. You must keep your anti-virus software updated to cope with the latest “bugs” circulating the Internet. Most anti-virus software includes a feature to download updates automatically when you are online. In addition, make sure that the software is continually running and checking your system for viruses, especially if you are downloading files from the Web or checking your email.

Actions or measures that can be taken if any, malicious attack suspected in your network

• If when an unknown file is downloaded, the first step is to delete the file. Disconnect the computer from the network and have IT run a complete system sweep to ensure no traces are left.

• Whenever a key logger is detected on a computer, IT should immediately reset password on all related accounts.

• Businesses should have central administration capabilities on their local and cloud server. Controlling which users have access to what files/folders on the server ensures that essential business data is only accessible by authorized individuals.

• Have all business files backed up in a remote cloud server. If disaster recovery is necessary, all files backed up in the cloud can be imported back to the local server to prevent complete data loss.

Perfect Cyber Security involves:

• Determining what assets need to be secured

• Identifying the threats and risks that could affect those assets or the whole business

• Identifying what safeguards need to be in place to deal with threats and secure assets

• Monitoring safeguards and assets to prevent or manage security breaches

• Responding to cyber security issues as they occur

• Updating and adjusting to safeguards as needed

Every day businesses are under attack on multiple fronts, and realizing that data breaches can stem from several different source allows for a more comprehensive protection and response plan. Never assume that your data is safe because you have the best electronic protection, or because you don’t use POS terminals. Criminals want your data, and they will try anything to get it.

It seems that almost everything now relies in internet and computers – entertainment, communication, transportation medicine, shopping, etc. How much of your life is dependent on internet? How much of your information is stored on your or someone else’s computer? With such a high dependency on computers, neglecting the increase in Cyber crime is extremely harmful.

Cyber security actually protects your personal information by responding, detecting and preventing the attacks. Cyber security is actually introduced to decrease cyber crimes. All banking institutions and businesses today run their business online. Hackers can hack your computer system and misuse your personal information and pictures. Various other dangers associated with cyber crimes are entry of virus into your system, altering your files, change of passwords, stealing credit card information and make unauthorized purchases. 

Today, there are several universities and colleges that are offering Cyber  degrees. In associated degree program you can learn about cyber forensics, data encryption, network security, etc. In the associate degree program a student is taught to use the recent technology and ensure that digital information communication is carried in an appropriate manner that is secured from surveillance or attack by expert hackers and malevolent computer users. Organizations and businesses will have ascending requirement for cyber professionals in future to protect their company’s records and private information.

A degree in this field will provide you with an opportunity to work as a computer support technician, systems administrator, network administrator or similar position. People with associate security degrees may enjoy following career opportunities and annual incomes:

Network Administrator: $58,190

Support Specialist: $40,430

Systems Administrator: $58,190

The career opportunities for cyber security profession is expected to increase in the coming few years. The demand for systems administrators and network administrators will grow at a rapid rate.

The typical coursework for the Associate Cyber Security Degree includes Cyber forensics, Computer hardware, Cyber security, working with Computers and Internet,  applied mathematics and software support. In the degree course program a student is expected to learn about antivirus software, encryptions, firewalls, and other similar techniques to ensure the safety of data communications as per your company’s guidelines.

If you manage a computer network for your business, you should be familiar with the term cyber security. In this article, we are going to talk about the importance of cyber security. The information given in this article will help you secure your computer systems against online threats. Read on to find out more.

1. Keep yourself Informed

Today, the importance of cyber security cannot be denied. If you click on suspicious links and don’t secure your passwords, your sensitive information will be at risk. If you are business information goes into the wrong hands, your business will be at risk. Therefore, you may want to keep yourself informed for the sake of your business.

2. Install Antivirus

If you manage and a computer network system, you may want to consider the importance of antivirus programs. Technical teams are in need of a variety of tools, solutions, and resources. They cost a good deal of money. However, you may lose a lot of money if your sensitive information goes into the hands of hackers.

3. Get Insured

Over the past few years, the cyber security insurance market has expanded. This insurance is there to protect businesses against financial risk. For example, if you face a data breach, the insurance provider can help you manage your loss.

4. Take it Seriously

If you think cyber security is just a technology issue, you need to think again. You may face a data breach because of a member of your staff. So, the person behind the data breach is not important. The important thing is to take security measures in order to secure your systems.

The General Data Protection Regulation in Europe has compelled a lot of companies to take cyber security very seriously. So, now they are looking for ways to process and store their sensitive company data. As a matter of fact, these companies take cyber security as an opportunity to use company data in a safe manner. It is a source stroke of genius to fix weak spots that may cause a breach.

5. Think about Backup and Recovery

According to statistics, at least two companies get hit by ransom ware in one minute across the globe. The good thing is that you don’t have to pay ransom provided you have a backup and data recovery system in place. There is no doubt that this type of breach can cause disruption. However, if you have a backup in place, you don’t need to worry about hackers.

This is a quite simple point. However, statistics tell us that most companies ignore this basic point. Almost half of US companies that get hit by ransom ware end up paying hundreds of thousands of dollars to hackers. Based on these statistics, we can say that companies don’t take proper measures in order to secure their systems against cyber threats.

Hopefully, now you understand the importance of cyber security in the world of the internet. Therefore, you may want to take proper security measures in order to ensure you don’t have to pay ransom money.

[*]1. Introduction

[*]Computers and the Internet have become indispensable for homes and organisations alike. The dependence on them increases by the day, be it for household users, in mission critical space control, power grid management, medical applications or for corporate finance systems. But also in parallel are the challenges related to the continued and reliable delivery of service which is becoming a bigger concern for organisations. Cyber security is at the forefront of all threats that the organizations face, with a majority rating it higher than the threat of terrorism or a natural disaster.

[*]In spite of all the focus Cyber security has had, it has been a challenging journey so far. The global spend on IT Security is expected to hit $120 Billion by 2017 [4], and that is one area where the IT budget for most companies either stayed flat or slightly increased even in the recent financial crises [5]. But that has not substantially reduced the number of vulnerabilities in software or attacks by criminal groups.

[*]The US Government has been preparing for a “Cyber Pearl Harbour” [18] style all-out attack that might paralyze essential services, and even cause physical destruction of property and lives. It is expected to be orchestrated from the criminal underbelly of countries like China, Russia or North Korea.

[*]The economic impact of Cyber crime is $100B annual in the United states alone [4].

[*]There is a need to fundamentally rethink our approach to securing our IT systems. Our approach to security is siloed and focuses on point solutions so far for specific threats like anti viruses, spam filters, intrusion detections and firewalls [6]. But we are at a stage where Cyber systems are much more than just tin-and-wire and software. They involve systemic issues with a social, economic and political component. The interconnectedness of systems, intertwined with a people element makes IT systems un-isolable from the human element. Complex Cyber systems today almost have a life of their own; Cyber systems are complex adaptive systems that we have tried to understand and tackle using more traditional theories.

[*]2. Complex Systems – an Introduction

[*]Before getting into the motivations of treating a Cyber system as a Complex system, here is a brief of what a Complex system is. Note that the term “system” could be any combination of people, process or technology that fulfils a certain purpose. The wrist watch you are wearing, the sub-oceanic reefs, or the economy of a country – are all examples of a “system”.

[*]In very simple terms, a Complex system is any system in which the parts of the system and their interactions together represent a specific behaviour, such that an analysis of all its constituent parts cannot explain the behaviour. In such systems the cause and effect can not necessarily be related and the relationships are non-linear – a small change could have a disproportionate impact. In other words, as Aristotle said “the whole is greater than the sum of its parts”. One of the most popular examples used in this context is of an urban traffic system and emergence of traffic jams; analysis of individual cars and car drivers cannot help explain the patterns and emergence of traffic jams.

[*]While a Complex Adaptive system (CAS) also has characteristics of self-learning, emergence and evolution among the participants of the complex system. The participants or agents in a CAS show heterogeneous behaviour. Their behaviour and interactions with other agents continuously evolving. The key characteristics for a system to be characterised as Complex Adaptive are:

[*]

• The behaviour or output cannot be predicted simply by analysing the parts and inputs of the system
• The behaviour of the system is emergent and changes with time. The same input and environmental conditions do not always guarantee the same output.
• The participants or agents of a system (human agents in this case) are self-learning and change their behaviour based on the outcome of the previous experience

[*]Complex processes are often confused with “complicated” processes. A complex process is something that has an unpredictable output, however simple the steps might seem. A complicated process is something with lots of intricate steps and difficult to achieve pre-conditions but with a predictable outcome. An often used example is: making tea is Complex (at least for me… I can never get a cup that tastes the same as the previous one), building a car is Complicated. David Snowden’s Cynefin framework gives a more formal description of the terms [7].

[*]Complexity as a field of study isn’t new, its roots could be traced back to the work on Metaphysics by Aristotle [8]. Complexity theory is largely inspired by biological systems and has been used in social science, epidemiology and natural science study for some time now. It has been used in the study of economic systems and free markets alike and gaining acceptance for financial risk analysis as well (Refer my paper on Complexity in Financial risk analysis here [19]). It is not something that has been very popular in the Cyber security so far, but there is growing acceptance of complexity thinking in applied sciences and computing.

[*]3. Motivation for using Complexity in Cyber Security

[*]IT systems today are all designed and built by us (as in the human community of IT workers in an organisation plus suppliers) and we collectively have all the knowledge there is to have regarding these systems. Why then do we see new attacks on IT systems every day that we had never expected, attacking vulnerabilities that we never knew existed? One of the reasons is the fact that any IT system is designed by thousands of individuals across the whole technology stack from the business application down to the underlying network components and hardware it sits on. That introduces a strong human element in the design of Cyber systems and opportunities become ubiquitous for the introduction of flaws that could become vulnerabilities [9].

[*]Most organisations have multiple layers of defence for their critical systems (layers of firewalls, IDS, hardened O/S, strong authentication etc), but attacks still happen. More often than not, computer break-ins are a collision of circumstances rather than a standalone vulnerability being exploited for a cyber-attack to succeed. In other words, it’s the “whole” of the circumstances and actions of the attackers that cause the damage.

[*]3.1 Reductionism vs Holisim approach

[*]Reductionism and Holism are two contradictory philosophical approaches for the analysis and design of any object or system. The Reductionists argue that any system can be reduced to its parts and analysed by “reducing” it to the constituent elements; while the Holists argue that the whole is greater than the sum so a system cannot be analysed merely by understanding its parts [10].

[*]Reductionists argue that all systems and machines can be understood by looking at its constituent parts. Most of the modern sciences and analysis methods are based on the reductionist approach, and to be fair they have served us quite well so far. By understanding what each part does you really can analyse what a wrist watch would do, by designing each part separately you really can make a car behave the way you want to, or by analysing the position of the celestial objects we can accurately predict the next Solar eclipse. Reductionism has a strong focus on causality – there is a cause to an affect.

[*]But that is the extent to which the reductionist view point can help explain the behaviour of a system. When it comes to emergent systems like the human behaviour, Socio-economic systems, Biological systems or Socio-cyber systems, the reductionist approach has its limitations. Simple examples like the human body, the response of a mob to a political stimulus, the reaction of the financial market to the news of a merger, or even a traffic jam – cannot be predicted even when studied in detail the behaviour of the constituent members of all these ‘systems’.

[*]We have traditionally looked at Cyber security with a Reductionist lens with specific point solutions for individual problems and tried to anticipate the attacks a cyber-criminal might do against known vulnerabilities. It’s time we start looking at Cyber security with an alternate Holism approach as well.

[*]3.2 Computer Break-ins are like pathogen infections

[*]Computer break-ins are more like viral or bacterial infections than a home or car break-in [9]. A burglar breaking into a house can’t really use that as a launch pad to break into the neighbours. Neither can the vulnerability in one lock system for a car be exploited for a million others across the globe simultaneously. They are more akin to microbial infections to the human body, they can propagate the infection as humans do; they are likely to impact large portions of the population of a species as long as they are “connected” to each other and in case of severe infections the systems are generally ‘isolated’; as are people put in ‘quarantine’ to reduce further spread [9]. Even the lexicon of Cyber systems uses biological metaphors – Virus, Worms, infections etc. It has many parallels in epidemiology, but the design principles often employed in Cyber systems are not aligned to the natural selection principles. Cyber systems rely a lot on uniformity of processes and technology components as against diversity of genes in organisms of a species that make the species more resilient to epidemic attacks [11].

[*]The Flu pandemic of 1918 killed ~50M people, more than the Great War itself. Almost all of humanity was infected, but why did it impact the 20-40yr olds more than others? Perhaps a difference in the body structure, causing different reaction to an attack?

[*]Complexity theory has gained great traction and proven quite useful in epidemiology, understanding the patterns of spread of infections and ways of controlling them. Researchers are now turning towards using their learnings from natural sciences to Cyber systems.

[*]4. Approach to Mitigating security threats

[*]Traditionally there have been two different and complimentary approaches to mitigate security threats to Cyber systems that are in use today in most practical systems [11]:

[*]4.1 Formal validation and testing

[*]This approach primarily relies on the testing team of any IT system to discover any faults in the system that could expose a vulnerability and can be exploited by attackers. This could be functional testing to validate the system gives the correct answer as it is expected, penetration testing to validate its resilience to specific attacks, and availability/ resilience testing. The scope of this testing is generally the system itself, not the frontline defences that are deployed around it.

[*]This is a useful approach for fairly simple self-contained systems where the possible user journeys are fairly straightforward. For most other interconnected systems, formal validation alone is not sufficient as it’s never possible to ‘test it all’.

[*]Test automation is a popular approach to reduce the human dependency of the validation processes, but as Turing’s Halting problem of Undecideability[*] proves – it’s impossible to build a machine that tests another one in all cases. Testing is only anecdotal evidence that the system works in the scenarios it has been tested for, and automation helps get that anecdotal evidence quicker.

[*]4.2 Encapsulation and boundaries of defence

[*]For systems that cannot be fully validated through formal testing processes, we deploy additional layers of defences in the form of Firewalls or network segregation or encapsulate them into virtual machines with limited visibility of the rest of the network etc. Other common techniques of additional defence mechanism are Intrusion Prevention systems, Anti-virus etc.

[*]This approach is ubiquitous in most organisations as a defence from the unknown attacks as it’s virtually impossible to formally ensure that a piece of software is free from any vulnerability and will remain so.

[*]Approaches using Complexity sciences could prove quite useful complementary to the more traditional ways. The versatility of computer systems make them unpredictable, or capable of emergent behaviour that cannot be predicted without “running it” [11]. Also running it in isolation in a test environment is not the same as running a system in the real environment that it is supposed to be in, as it’s the collision of multiple events that causes the apparent emergent behaviour (recalling holism!).

[*]4.3 Diversity over Uniformity

[*]Robustness to disturbances is a key emergent behaviour in biological systems. Imagine a species with all organisms in it having the exact same genetic structure, same body configuration, similar antibodies and immune system – the outbreak of a viral infection would have wiped out complete community. But that does not happen because we are all formed differently and all of us have different resistance to infections.

[*]Similarly some mission critical Cyber systems especially in the Aerospace and Medical industry implement “diversity implementations” of the same functionality and centralised ‘voting’ function decides the response to the requester if the results from the diverse implementations do not match.

[*]It’s fairly common to have redundant copies of mission critical systems in organisations, but they are homogenous implementations rather than diverse – making them equally susceptible to all the faults and vulnerabilities as the primary ones. If the implementation of the redundant systems is made different from the primary – a different O/S, different application container or database versions – the two variants would have different level of resilience to certain attacks. Even a change in the sequence of memory stack access could vary the response to a buffer overflow attack on the variants [12] – highlighting the central ‘voting’ system that there is something wrong somewhere. As long as the input data and the business function of the implementation are the same, any deviations in the response of the implementations is a sign of potential attack. If a true service-based architecture is implemented, every ‘service’ could have multiple (but a small number of) heterogeneous implementations and the overall business function could randomly select which implementation of a service it uses for every new user request. A fairly large number of different execution paths could be achieved using this approach, increasing the resilience of the system [13].

[*]Multi variant Execution Environments (MVEE) have been developed, where applications with slight difference in implementation are executed in lockstep and their response to a request are monitored [12]. These have proven quite useful in intrusion detection trying to change the behaviour of the code, or even identifying existing flaws where the variants respond differently to a request.

[*]On similar lines, using the N-version programming concept [14]; an N-version antivirus was developed at the University of Michigan that had heterogeneous implementations looking at any new files for corresponding virus signatures. The result was a more resilient anti-virus system, less prone to attacks on itself and 35% better detection coverage across the estate [15].

[*]4.4 Agent Based Modelling (ABM)

[*]One of the key areas of study in Complexity science is Agent Based Modelling, a simulation modelling technique.

[*]Agent Based Modelling is a simulation modelling technique used to understand and analyse the behaviour of Complex systems, specifically Complex adaptive systems. The individuals or groups interacting with each other in the Complex system are represented by artificial ‘agents’ and act by predefined set of rules. The Agents could evolve their behaviour and adapt as per the circumstances. Contrary to Deductive reasoning[†] that has been most popularly used to explain the behaviour of social and economic systems, Simulation does not try to generalise the system and agents’ behaviour.

[*]ABMs have been quite popular to study things like crowd management behaviour in case of a fire evacuation, spread of epidemics, to explain market behaviour and recently financial risk analysis. It is a bottom-up modelling technique wherein the behaviour of each agent is programmed separately, and can be different from all other agents. The evolutionary and self-learning behaviour of agents could be implemented using various techniques, Genetic Algorithm implementation being one of the popular ones [16].

[*]Cyber systems are interconnections between software modules, wiring of logical circuits, microchips, the Internet and a number of users (system users or end users). These interactions and actors can be implemented in a simulation model in order to do what-if analysis, predict the impact of changing parameters and interactions between the actors of the model. Simulation models have been used for analysing the performance characteristics based on application characteristics and user behaviour for a long time now – some of the popular Capacity & performance management tools use the technique. Similar techniques can be applied to analyse the response of Cyber systems to threats, designing a fault-tolerant architecture and analysing the extent of emergent robustness due to diversity of implementation.

[*]One of the key areas of focus in Agent Based modelling is the “self-learning” process of agents. In the real world, the behaviour of an attacker would evolve with experience. This aspect of an agent’s behaviour is implemented by a learning process for agents, Genetic Algorithm’s being one of the most popular technique for that. Genetic Algorithms have been used for designing automobile and aeronautics engineering, optimising the performance of Formula one cars [17] and simulating the investor learning behaviour in simulated stock markets (implemented using Agent Based models).

[*]An interesting visualisation of Genetic Algorithm – or a self-learning process in action – is the demo of a simple 2D car design process that starts from scratch with a set of simple rules and end up with a workable car from a blob of different parts: http://rednuht.org/genetic_cars_2/

[*]The self-learning process of agents is based on “Mutations” and “Crossovers” – two basic operators in Genetic Algorithm implementation. They emulate the DNA crossover and mutations in biological evolution of life forms. Through crossovers and mutations, agents learn from their own experiences and mistakes. These could be used to simulate the learning behaviour of potential attackers, without the need to manually imagine all the use cases and user journeys that an attacker might try to break a Cyber system with.

[*]5. Conclusion

[*]Complexity in Cyber systems, especially the use of Agent Based modelling to assess the emergent behaviour of systems is a relatively new field of study with very little research done on it yet. There is still some way to go before using Agent Based Modelling becomes a commercial proposition for organisations. But given the focus on Cyber security and inadequacies in our current stance, Complexity science is certainly an avenue that practitioners and academia are increasing their focus on.

[*]Commercially available products or services using Complexity based techniques will however take a while till they enter the mainstream commercial organisations.

[*]References

[*][1] J. A. Lewis and S. Baker, “The Economic Impact of Cybercrime and Cyber Espionage,” 22 July 2013. [Online]

[*][2] L. Kugel, “Terrorism and the Global Economy,” E-Internatonal Relations Students, 31 Aug 2011. [Online].

[*][3] “Cybersecurity – Facts and Figures,” International Telecommunications Union, [Online].

[*][4] “Interesting Facts on Cybersecurity,” Florida Tech University Online, [Online].

[*][5] “Global security spending to hit $86B in 2016,” 14 Sep 2012. [Online].

[*][6] S. Forrest, S. Hofmeyr and B. Edwards, “The Complex Science of Cyber Defense,” 24 June 2013. [Online].

[*][7] “Cynefin Framework (David Snowden) – Wikipedia” [Online].

[*][8] “Metaphysics (Aristotle) – Wikipedia” [Online].

[*][9] R. Armstrong, “Motivation for the Study and Simulation of Cybersecurity as a Complex System,” 2008.

[*][10] S. A. McLeod, Reductionism and Holism, 2008.

[*][11] R. C. Armstrong, J. R. Mayo and F. Siebenlist, “Complexity Science Challenges in Cybersecurity,” March 2009.

[*][12] B. Salamat, T. Jackson, A. Gal and M. Franz, “Orchestra: Intrusion Detection Using Parallel Execution and Monitoring of Program Variants in User-Space,” Proceedings of the 4th ACM European conference on Computer systems, pp. 33-46, April 2009.

[*][13] R. C. Armstrong and J. R. Mayo, “Leveraging Complexity in Software for Cybersecurity (Abstract),” Association of Computing Machinery, pp. 978-1-60558-518-5, 2009.

[*][14] C. Liming and A. Avizienis, “N-VERSION PROGRAMMINC: A FAULT-TOLERANCE APPROACH TO RELlABlLlTY OF SOFTWARE OPERATlON,” Fault-Tolerant Computing, p. 113, Jun1995.

[*][15] J. Oberheide, E. Cooke and F. Jahanian, “CloudAV: N-Version Antivirus in the Network Cloud,” University of Michigan, Ann Arbor, MI 48109, 2008.

[*][16] J. H. Holland, Adaptation in natural and artificial systems: An introductory analysis with applications to biology, control, and artificial intelligence, Michigan: University of Michigan Press, 1975.

[*][17] K. &. B. P. J. Wloch, “Optimising the performance of a formula one car using a genetic algorithm,” Parallel Problem Solving from Nature-PPSN VIII, pp. 702-711, January 2004.

[*][18] P. E. (. o. D. Leon, “Press Transcript,” US Department of Defense, 11 Oct 2012. [Online].

[*][19] Gandhi, Gagan; “Financial Risk Analysis using Agent Based Modelling”, [Online]: http://www.researchgate.net/publication/262731281_Financial_Risk_Analysis_using_Agent_Based_Modelling

[*][*] Alan Turing – a mathematician who came to fame for his role in breaking the Enigma machines used to encrypt communication messages during the second world war – proved that a general algorithm whether or not a program would even terminate (or keep running forever) for all program-input pairs cannot exist.

[*][†] Deductive reasoning is a ‘top-down’ reasoning approach starting with a hypothesis and data points used to substantiate the claim. Inductive reasoning on the other hand is a ‘bottom-up’ approach that starts with specific observations which are then generalised to form a general theory.