Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CHAPTER III: INFORMATION AND COMMUNICATION TECHNOLOGY
A concept map originating from the concept of threats on a CII would be rather
large and cumbersome to depict with sufficient clarity on a single integrated map.
Therefore, a high-level concept map representing only the major concepts (the
nominal ‘view from 50,000 feet’) can be seen in Figure 3. The map is derived from
an extensive survey of standardization documents (ITU-T X.800 and RFC 2828),
technical notes from industry (Gordon 2003; Albert et al 2003), general scientific
literature (Stallings 2003, Rozenblit 2000, Vacca 2006, Yoo 2005) and a multitude
of online material. It is clear from Figure 3 that threats to CII are attributed to a
range of factors that exploit system vulnerabilities and if realized will result in any
of a possible set of consequences to the system. Further explanation of these initial
observations is provided in the subsequent subsections with the aid of detailed
low-level concept maps.
Consequences of Threats
The successful realization of a threat on a CII would result in at least one of the
following outcomes:
• The destruction of information, system assets or resources.
• The corruption or modification of information.
• The theft, removal or loss of information, system assets or resources.
• The undesired or unauthorized disclosure of information.
• The interruption of service delivery.
The methods or action leading to each threat consequence may vary, as illustrated
in Figure 4. Destruction, removal or interruption could potentially lead to the
partial or complete failure of the system to function and provide intended services.
This, for example, could be the result of the physical destruction of a main
switching centre that weakens the ability to exchange information between
geographically distant areas, or a prolonged denial-of-service (DoS) attack that
illegally consumes limited system resources and makes an asset (e.g., website,
server etc.) unavailable. Distributed DoS (DDoS) attacks are even more intense, as
they use multiple compromised systems or zombies to launch simultaneous attacks
on a target system.
On the contrary, corruption, disclosure or removal of information may not
directly lead to system failure, but may enable unauthorized access to system data
that could be used to launch more severe attacks on the system, comprise
operations of organizations relying on the system (e.g. leakage of information
from a military network revealing troops positioning), or even as part of a more
sinister plot. For example, it is believed that the bombers behind the 2004 attack
on the Madrid commuter train had planned their attack using fraudulent telephone
calls made by hacking in to a telephone exchange (a practice commonly known as
‘phreaking’) belonging to a bank in France (Pollard 2005).
NORDREGIO REPORT 2007:5 89