ICT Security Policy: Challenges and Potential Remedies

Introduction

In many countries, computer networks are used to control, manage and operate system services. Transportation, banking, power system, radio and television, gas, water, health services and telecommunication are highly automated and computerized. These systems, in addition to defense, government, and education form part of a society’s critical information infrastructure. The vulnerability of critical infrastructure is constantly reinforced by regular media report. For instance, it was reported in (CSI, 2000a) that in October 2000, air traffic control radar systems failed for four hours, resulting in airports throughout the USA being gridlocked with grounded aircraft. In a similar report (CSI, 2000b), a hacker altered parameters on sewage pump stations causing raw sewage to overflow on the Australian Sunshine Cost in Queensland. More recently, in September 2008, online criminals compromised hundreds of pages on the BusinessWeek.com website with a SQLinjection attack (Cisco, 2008).

Since cyber crimes very critical these days and will continue to be for the foreseeable future. It is important to find means or actions to be taken in order to reduce the impact or level of any threat. To achieve this, first we need to understand what risks, threats, and vulnerabilities currently exist in our environment. Second, we need to learn as much as possible about the problems so that we can formulate a solid response. This implies that we must develop and implement a comprehensive protection and response plan or policy in order to prevent or minimize attacks. The policy should provide response guidelines that cover every phase of an attack in the fastest, most efficient manner. Finally, we need to intelligently deploy our selected countermeasures and safeguards to erect protections around our most mission-critical assets. While there is no silver bullet to eliminate all threats, vulnerabilities and breaches, organizations can focus on addressing attacks during the most dangerous time. The costs associated with each individual attack are directly proportional to the amount of time that it takes an organization to approach the attack. Thus, the better prepared an organization is to detect, protect, and take down attacks proactively, the more likely that the organization will be able to prevent and/or recover from attacks. By trying to nip the problem in the bud, an organization can greatly reduce the amount of time wasted and money lost due to protecting the impact of a potential attack. It was reported that the Code Red Worm had caused over $2 billion in damage in 2001 (CNN, 2001). In July 2009, a report by (NewsFactor, 2009) revealed that an Internet thieves had stolen more than 289,000 Hong Kong dollars (37,000 US dollars) From Honk Kong Bank accounts.

While it may be difficult to predict precisely how technology will evolve, studying the history of telephone to Internet, mainframe to personal computer, kilobyte to terabyte, it seems reasonable to note that in the not-too-distance future, interactive computing technology, in whatever form, will be an integral and invisible constituent of our lives. In the course of doing it, the computing technology will also most definitely raise problems in relation to the security frameworks that surrounds it. The following part of the chapter examines some security policy challenges associated with computer systems in general and attempts to highlights various methods of limiting their impact. The chapter also looks into the different aspect of attacks and the various types of attack tools. Reports of vulnerabilities and hacking incidents were also given. It also discusses the impacts of such activities by reporting the cost of damages caused by cyber attackers in recent years. Some countermeasures such as recovery planning and risk management were discussed.