网络安全 Awareness Month: 雅各便雅悯

想象一下. A group of six outsiders equipped with 22 pounds of TNT explosive and automatic weapons are outside your building. They have comprehensive knowledge of the facility and are willing to kill or be killed.

现在, imagine if you could take that threat, quantify it and place it in an algorithm that would not only provide precise defense actions but give further insight into how the enemy might react based on past events.

That was the topic of spring 2020 工程学院 doctoral graduate 雅各便雅悯 dissertation – but for cyber attacks.

Liken a cyber attack to an earthquake, and Benjamin’s dissertation goes something like this: Say, 每100年有一个6.0 earthquake in a given region. 利用这些信息, city planners know infrastructure needs to withstand at least that level of a quake. That information is what's called a design basis threat and is used as the requirement for seismic protection systems. A stronger earthquake is beyond design basis, and officials would need to prepare for the possibility that the building may collapse.

From a cybersecurity standpoint, that information is just now starting to exist as more cyber attacks occur and adversary techniques are increasingly analyzed and documented. Benjamin’s current employer, the industrial cybersecurity firm Dragos, Inc., actively tracks industrial threat activity groups. One of the most dangerous groups, 磷钇矿, is focused on intentionally compromising and disrupting industrial safety instrumented systems, which can lead to scenarios involving loss of life and environmental damage.

“If the government says right now 磷钇矿 is attacking, right now a nuclear power plant wouldn’t know how to respond,他说.

Benjamin said companies like Dragos are working to create a design basis threat for cyber a reality for professionals defending critical infrastructure, combining threat intelligence and consequence-driven methodologies.

Benjamin said he always had an interest in cybersecurity, even as an undergraduate in the early 2000s, but very few options to obtain an undergraduate degree existed. The U of I’s bachelor’s in cybersecurity, 它于2020年秋季推出, is one of the only programs in the Northwest and one of the few nationwide.

“With cybersecurity, it’s the unbounded threat that’s the most intimidating,他说. “This idea that regulation and policy don’t bind it in any quantifiable way. 一分钟, we could be trying to keep anonymous, low-skill hackers out of the way, 下一个, we might have to respond to the whole might of Russia and China.”