Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CHAPTER III: INFORMATION AND COMMUNICATION TECHNOLOGY
These four key concepts are revisited throughout this report. Various ICT
standardization bodies have produced definitions that help to explain the
interrelationship between the concepts. The ITU-T Recommendation X.800 and
the IETF RFC 2828 defines the above concepts as in Table 1 (ITU-T 1991; Shirey
2000).
The relationship between the threat-related system concepts defined can be
illustrated using a simple sketch as shown in Figure 2. Simply put, a successful
attack is one that eludes or breaches security countermeasures, consequently
taking advantage of system vulnerability and resulting in particular threat
consequences or disruptions. Therefore, the success of an attack depends on the
strength of the attack, degree of vulnerability and effectiveness of the
countermeasures employed.
Figure III—2 Relationship between various threat-related concepts.
It is generally acknowledged that it is impossible to secure fully against all attacks
(Audestad 2005). This is because ICT systems are growing increasingly complex,
making the comprehensive analysis of all failure scenarios computationally
intractable. Existing security countermeasures (e.g. firewalls) are implemented
against known or predictable attacks and events. However, these measures are not
sufficient to protect against the infinitely large number of new, unpredictable
and/or unknown attacks that could have a similarly crippling effect on the system.
Moreover, the level of implementation of countermeasures and ability to reduce
vulnerabilities is constrained by the availability of requisite resources (e.g.,
sufficient budgets, skilled staff).
Therefore, each organization tries to find a compromise between the level of
risk and justifiable information security investment. This necessitates a trade-off
between security precautions taken and the tolerance to the remaining risk of
attack. Vulnerabilities may be tolerable when the level of difficulty of the attacks
needed to exploit the vulnerability is too high, or when the perceived benefit to
attacker is small even if the vulnerability is easily exploitable. Conversely, top
priority is given to the threat scenarios where the likelihood of attacks is high and
their outcomes extremely disruptive. These assumptions are particularly valid for
cases when the attacks are well understood and relatively easy to execute, or when
the vulnerable system is known to support large user numbers or mission critical
processes. All these are typical features that present the prerequisite incentives for
potential attackers.
NORDREGIO REPORT 2007:5 87