ToImprove_Cybersecurity-Think like a Hacker - Tài liệu tham khảo | Đại học Hoa Sen

ToImprove_Cybersecurity-Think like a Hacker - Tài liệu tham khảo | Đại học Hoa Sen và thông tin bổ ích giúp sinh viên tham khảo, ôn luyện và phục vụ nhu cầu học tập của mình cụ thể là có định hướng, ôn tập, nắm vững kiến thức môn học và làm bài tốt trong những bài kiểm tra, bài tiểu luận, bài tập kết thúc học phần, từ đó học tập tốt và có kết quả

 

S P R I N G 2 0 1 7
I S S U E
José Esteves
Elisabete Ramalho
Guillermo de Haro
To Improve
Cybersecurity,
Think Like a
Hacker
Cyberattacks are an increasingly common and worrisome
threat. To combat the risk, companies need to understand
both hackers’ tactics and their mindsets.
Vol. 58, No. 3 Reprint #58314 http://mitsmr.com/2mXYJdD
PLEASE NOTE THAT GRAY AREAS REFLECT ARTWORK THAT HAS BEEN INTENTIONALLY REMOVED.
THE SUBSTANTIVE CONTENT OF THE ARTICLE APPEARS AS ORIGINALLY PUBLISHED.
SPRING 2017 MIT SLOAN MANAGEMENT REVIEW 71
IF YOU HAVE any doubts about the need for a new corporate cybersecurity mindset, the daily news
contains plenty of sobering evidence. Recently, Yahoo Inc., which was in the midst of a planned transac-
tion to sell its core businesses to Verizon, disclosed that it had been the target of two of the biggest data
breaches ever, with sensitive information stolen involving more than 1 billion user accounts in 2013 and
500 million in 2014.
1
In addition to highlighting Yahoo’s cybersecurity vulnerability, the attacks have
resulted both in a delay in the planned acquisition by Verizon and in a probe by the U.S. Securities and
Exchange Commission about the disclosure of the breaches.
2
The incident raises broad questions about
how cyberthreats affect mergers and acquisitions
deals, and it could have an impact on disclosure
guidelines and regulations.
In the past several years, the list of companies
whose internal systems have been hacked has
grown rapidly. In addition to hundreds of small
and medium-size companies, it now includes such
high-profile businesses as Target, JPMorgan Chase,
Home Depot, Sony Pictures, Ashley Madison, and
Yahoo. In many cases, cybersecurity breaches go
on for weeks or months before they’re discovered.
Cybersecurity breach response times can be a cru-
cial factor in the data breach scale, its mitigation,
the determination of its source, and also future
legal issues involving the disclosure period. Not
only have the attacks in the past few years been
costly for the companies, but they also shake the
confidence of customers, shareholders, and em-
ployees. And no industry appears to be safe from
attacks, regardless of the specific measures indi-
vidual companies use to defend themselves.
As a result, spending on cybersecurity is poised
to accelerate. Gartner Inc., the information tech-
nology (IT) research and advisory firm, has
estimated that global spending on information
To Improve Cybersecurity,
Think Like a Hacker
R I S K M A N A G E M E N T
Cyberattacks are an increasingly common and worrisome threat.
To combat the risk, companies need to understand both hackers
tactics and their mindsets.
BY JOSÉ ESTEVES, ELISABETE RAMALHO, AND GUILLERMO DE HARO
THE LEADING
QUESTION
What do
executives
need to
know about
improving
cybersecurity?
FINDINGS
Hackers will
patiently and thor-
oughly examine a
target companys
systems, looking
for vulnerabilities.
People often repre-
sent the weakest
link in an organiza-
tions cybersecurity.
Senior management
needs to stress the
importance of
cybersecurity.
72 SLOAN MANAGEMENT REVIEW MIT SPRING 2017 SLOANREVIEW.MIT.EDU
R I S K M A N A G E M E N T
security would reach $81 billion in 2016 and may
grow to $101 billion by 2018, with the highest
growth in security testing.
3
Unfortunately, invest-
ment in security measures is only part of the
answer; traditional methodologies can only do so
much. To be effective, executives in charge of cyber-
security need to adjust their mindsets and become
as open and adaptive as possible.
To help companies respond to new types of
threats, we have developed a framework that is
informed by our understanding of the process
hackers employ to attack an organization. We de-
signed this framework in collaboration with expert
hackers using the Delphi method, a structured
technique that draws on the knowledge and opin-
ions of experts.
4
We also relied on in-depth
interviews with more than 20 experienced hackers.
(See About the Research.”)
The Hacker Mindset
If organizations want to reduce the risk of external
hacking attacks, they need to understand the hacker
mindset.
5
In other words, companies need to com-
prehend the expertise of successful hackers to
anticipate and confront attacks. Companies such as
Facebook Inc. and Microsoft Corp., for example,
have even hired hackers.
6
To think like a hacker, you need to know the traits
that characterize a competent and sophisticated
hacker. Hackers tend to be highly skilled and intelli-
gent, and enjoy taking risks. They typically have
backgrounds in computer science and have been la-
beled geeks for many years. Many successful hackers
have good social and communication skills that en-
able them to manipulate people to release essential
information or to perform critical actions.
7
Many hackers are drawn to the possibility of
earning thousands or possibly millions of dollars.
They are accustomed to operating in the black
market and committing crimes far away from
where they live. They generally enjoy the adrenaline
rush they get from taking high-stakes risks. Indeed,
many hackers have nerves of steel not much
frightens them. Although it used to be common
for hackers to work independently, few of today’s
hackers operate alone. They are often part of an
organized hacking group, where they are members
of a team providing specialized illegal services such
as credit card or loan fraud, theft of intellectual
property or personally identifiable information,
identity theft, or counterfeiting documents.
8
Thinking Like a Hacker
Fully protecting a company’s data is no easy task.
Dan Chenok, a former chairman of the Informa-
tion Security and Privacy Advisory Board for the
U.S. National Institute of Standards and Technol-
ogy, has asserted: “The only way to 100% protect
yourself from attacks is to turn off your comput-
ers.
9
However, learning to think like a hacker can
help your organization anticipate what a hacker
might do and then take actions to reduce those
risks. So what is a hacking mindset, and how should
it influence the way organizations approach
cybersecurity?
We found that hackers actually have two differ-
ent mindsets during different stages in an attack:
explorative and exploitative. (See “How Hackers
Approach an Attack.”) In the initial stages of an at-
tack, hackers typically use an exploration mindset
that combines deliberate and intuitive thinking
and relies on intensive experimentation. For exam-
ple, an experienced hacker will not attack a new
system a company has just activated. He or she will
prefer to wait and continue to search for the weak-
est link (such as a vendor, a new employee, or a
situation that is not in compliance with the organi-
zation’s security standards). Once access to a system
is gained, hackers rely on an exploitation mindset to
meet their goals — for example, to gain as much
information for profitable resale as they can. This
ABOUT THE RESEARCH
We conducted a web-based study consisting of two rounds of surveys with 23 experi-
enced hackers through an anonymous consensus-building process. The hackers list
was obtained through a variety of methods: screening hackers offering their hacking
and cybersecurity services on the internet, people mentioned in the media, introduc-
tions from other hackers, recommendations from chief security officers who knew
hackers, and individuals whom the research team knew. We asked hackers to label
and prioritize the steps to perform a successful cyberattack. We subsequently con-
ducted 17 in-depth interviews with panel experts to get more detail on the different
phases of cyberattacks. The article is based on insights from our study, the interviews,
and our own experience in cybersecurity and digital and information technology. In
conducting our study, we used the Delphi method, which has been employed since
the 1950s to obtain real-world knowledge. The method is based on several iterative
rounds of questionnaires among experts to obtain data or test hypotheses. We used
this approach to uncover the policies followed by hackers and to define what an adap-
tive cybersecurity strategy should be.
SLOANREVIEW.MIT.EDU SPRING 2017 MIT SLOAN MANAGEMENT REVIEW 73
strategy of exploration followed by exploitation
typically involves four steps; the first two steps
focus on exploration, and the third and fourth em-
phasize exploitation.
STEP 1: Identifying Vulnerabilities Hackers are
patient, studious, and clever. If they think your
company is worth attacking, they will examine it
thoroughly for weaknesses, surveying the network
information, organizational information, and
security policies. This process of gathering infor-
mation is known among hackers as footprinting.
They may also study your suppliers and other con-
tractors that your company works with, as well as
your subsidiaries. Before launching a cyberattack,
hackers will map out the target network and sys-
tems and take note of all holes and vulnerabilities,
potential entry points, and any security mecha-
nisms that could be hurdles . At this stage,
information such as server names, IP addresses,
and user accounts can help them prepare the at-
tack. As noted earlier, hackers also attempt to
interact with company insiders who might have
critical information that would not be easily ob-
tained under normal circumstances and that could
help the hackers gain access to company systems.
At this stage, a hackers most important charac-
teristics are curiosity, patience, and communication
and social skills. Recognizing this, you need to turn
these characteristics to your company’s advantage:
Be curious about your systems and how they relate
to any vulnerability. In 2014, JPMorgan Chase &
Co., one of the biggest U.S.-based banks, was
reported to have suffered a cyberattack that com-
promised the data of 76 million households and
7 million small businesses. Although login infor-
mation, passwords, user IDs, birth dates, and Social
Security numbers were not compromised in
this attack, other information that can be used for
identity theft — names, email addresses, postal ad-
dresses, and phone numbers — was exposed. How
did this happen? Most big banks use two-factor
authentication, which combines static passwords
with codes dynamically generated by physical
devices. Unfortunately, JPMorgan’s IT security
team failed to update one of its network servers to
enforce two-factor authentication, leaving the bank
vulnerable.
10
Hackers used this weakness, together
with stolen credentials from a bank employee, to
gain access to some 90 servers inside the company.
Companies can help protect themselves by adopt-
ing an iterative and adaptive process and making a
point of conducting a high-level “footprint” of their
systems on a regular basis. In addition, they should
make sure that employees are well informed on poli-
cies regarding sharing of information and offer them
periodic reminders about the various ways hackers ob-
tain information. For example, if someone unknown
begins to interact with a bank employee in a friendly
way, maybe that persons purpose isn’t so friendly.
STEP 2: Scanning and Testing After a hacker has
broken into your network, weaknesses in the appli-
cations running on your systems could become
avenues for further unauthorized access. Hackers
often use scanning tools on applications running
on a company’s system once they enter. Cumula-
tively, small security vulnerabilities and design
weaknesses can add up to major security holes.
To protect your company, you should identify
potential weaknesses once you have created a
footprint of your systems. Examine every element
(hardware, software, and protocols) of the company’s
HOW HACKERS APPROACH AN ATTACK
To protect their organizations, companies need to understand how hackers go
about their work. Our research suggests that hackers’ attacks typically involve
four steps: identifying vulnerabilities; scanning and testing; gaining access; and
maintaining access. The first two steps primarily emphasize an exploration
mindset, and the third and fourth steps involve efficiently exploiting the access
the hackers have gained.
ATTACK
PHASES
Design of
Attack
Experimental Procedural
Role of
Knowledge
Gaining know-how Using know-how
Aim of
Action
Effectiveness Efficiency
Competencies
Required
Creativity
Tenacity
Persistence
Curiosity
Observation
Critical thinking
Problem-solving
Adaptability
Focus on results
Planning and organizing
Analysis
1.
Identifying
vulnerabilities
2.
Scanning
and testing
3.
Gaining
access
4.
Maintaining
access
EXPLORATION EXPLOITATION
74 SLOAN MANAGEMENT REVIEW MIT SPRING 2017 SLOANREVIEW.MIT.EDU
R I S K M A N A G E M E N T
network. In testing your network’s security, evalu-
ate cases of use and misuse from as many angles
as possible, and run penetration tests for your
applications as a “power user”or better yet, as a
hacker — as opposed to as an average user.
Failure to take such measures could expose
you to a cyberattack, which is what happened to
TalkTalk Telecom Group PLC, one of the largest
providers of broadband and phone service in the
United Kingdom, in October 2015. The data
breach exposed the records of more than 150,000
customers. In the wake of the incident, the com-
pany lost customers, and it was hit with a £400,000
fine by the U.K. government. The government
criticized TalkTalk’s failure to implement basic
cybersecurity measures such as software updates
and regular system monitoring, thereby making it
relatively easy for hackers to break in.
11
STEP 3: Gaining Access Among the factors that
influence a hackers chances of gaining unauthor-
ized access to a particular system are the system’s
architecture and configuration, the hacker’s skill
level, and the initial level of access the hacker is able
to obtain. For example, hackers often contact
organizations by telephone, a “phishing” email
campaign, a forged email message, or instant mes-
sages asking individuals for login and password
credentials, usually by pretending to be someone
with credibility (for example, a senior company of-
ficer or a help desk technician).
At Target Corp., a retailer based in Minneapolis,
Minnesota, hackers broke into the corporate net-
work using stolen credentials from a third-party
vendor who had provided air-conditioning ser-
vices. They then installed malicious software
(commonly called “malware”) to siphon customer
information from the company’s networks and
point-of-sale system in more than 1,800 brick-and-
mortar stores in the United States.
The malware the hackers of Target used is available
on cybercrime forums for about $2,000. The hackers
had explored a variety of ways to enter Target’s sys-
tem before identifying the entranceway through the
vendor. Once inside Target’s network, the hackers
gained access to cash registers in stores.
12
The tactics the hackers used against Target were
unusual. At Anthem Inc., one of the largest health
insurers in the United States, hackers used a stolen
login and password to steal up to 80 million records
of personal information pertaining to customers
and employees — even the company’s CEO — in
2015.
13
Once in the network, they obtained per-
sonal information such as names, Social Security
numbers, birthdays, addresses, email addresses,
and employment information (including income
data) — all of which can be quite valuable in the
black market for the purpose of identity theft.
To protect your company, you need to consider
how a hacker could gain access to your organiza-
tion’s systems, based on the information you have
collected in the first two steps. While those steps
were designed to identify security vulnerabilities,
this third step is geared toward exploiting them, or
what’s known in the hacker world as “owning the
system.
On Feb. 5, 2016, hackers sent emails with links to
malware to employees of Hollywood Presbyterian
Medical Center in Los Angeles. When an employee
clicked on one of the links, the system locked and
disabled the hospital’s electronic communication.
For more than a week, the hackers had unfettered
access to Hollywood Presbyterians data (although it
was reported that no data was actually taken). The
nightmare ended only after the hospital paid a ran-
som of 40 bitcoins, valued at the time at about
$17,000, at which point the hackers sent them a digi-
tal decryption key to unlock the system.
14
Hackers tend to play on both sophisticated tech-
nical knowledge and communication skills to breach
company security. If you are equally sophisticated in
your knowledge of common hacker tactics, you can
mount an effective defense. An awareness campaign
that alerts your employees, contractors, and third-
party users to common hacker strategies should be a
critical component of that defense.
STEP 4: Maintaining Access Hackers try to re-
tain their ownership of the system and access for
future attacks while remaining unnoticed. Some-
times they harden” the system from security
personnel (and even from other hackers) by secur-
ing exclusive access and uploading a piece of code
that’s known as a “backdoor.
Once hackers “own” a system, they can use it as
a base camp for launching new cyberattacks.
15
SLOANREVIEW.MIT.EDU SPRING 2017 MIT SLOAN MANAGEMENT REVIEW 75
An owned system is often referred to as a “zombie”
system. In the final stages of an attack, hackers often
cover their tracks to avoid detection by security
personnel and remove evidence of hacking, to
avoid legal consequences. Skilled hackers use to
their own advantage their technical knowledge of
how systems detect wrongful activity. Therefore, it
is critical for organizations to remain vigilant for
suspicious activity in system logs and to ensure that
monitoring systems are always up to date.
Putting the Hacker
Mindset to Work
Once companies are familiar with the basic re-
quirements, what should they do to protect the
organization from cyberattacks? We believe effec-
tive cybersecurity practices need to be implemented
both from the top down and from the bottom up.
In support of this approach, we have developed five
recommendations.
1. Get senior management on board. Sustained
support from senior management is crucial to ensur-
ing that action plans are in place to mitigate the risk
of cyberattacks. The message needs to come from the
top down that “we” as a company need to be more
secure so that staff is more likely to engage. No matter
how technically competent the IT department is, it
can’t change the vision of the company. Rather,
senior management needs to ask for complete buy-
in, hold periodic meetings with line managers, and
deliver the message from the top down.
In order to get executive-level decision makers
on board, it’s important to emphasize the role of
cybersecurity in addressing market, privacy, tech-
nology, and regulatory risks and demands. To do
this, top managers may need to explain how the
cybersecurity strategy enables business objectives
and initiatives, and highlight how effective security
governance can enhance the interests of all stake-
holders (customers, business units, employees, and
auditors) in a cost-effective manner.
It is also critical to demonstrate that the compa-
ny’s long-term profitability and resilience are
contingent upon security. Companies should cre-
ate a security communication plan for the whole
organization that includes content aimed directly
at executives and that gets updated on a regular
basis. The material should include guidelines and
processes on how to manage and communicate
about security breaches that may arise.
2. Design a security strategy. As we have noted,
technology alone is not enough. Companies must
address cybersecurity from both technological and
nontechnological perspectives. In many organiza-
tions, the people aspect of cybersecurity is one of
the weakest links. Security experts recommend
adopting a “threat-centric” and operational secu-
rity model that looks at security from a hackers
perspective. This requires looking at cybersecurity
from both inside out (to understand what employ-
ees, strategic business partners, and third-party
vendors are doing within their organizations and
how they are interacting with high-value assets
such as systems, facilities, and data) and outside
in (to consider what an enemy might see when
scoping out weaknesses from the outside). The lat-
ter is often referred to as “turning the map around,
and the goal is to ensure a comprehensive ap-
proach to mission planning and to help the
company prepare for actions an enemy may take in
the future.
16
Executives and information managers should
examine how their information systems are cur-
rently managed to assess their level of cybersecurity,
and they should determine how secure each asset
needs to be. They need to assess whether they have
the right competencies and whether they have the
right organizational design to anticipate and re-
spond to potential cybersecurity threats.
In developing strategies, companies need to
make choices: whether to build full-fledged in-
house security capabilities, rely on external experts,
The message needs to come from the top down thatwe
as a company need to be more secure so that staff is more
likely to engage. No matter how technically competent the
IT department is, it can’t change the vision of the company.
76 SLOAN MANAGEMENT REVIEW MIT SPRING 2017 SLOANREVIEW.MIT.EDU
R I S K M A N A G E M E N T
or adopt a hybrid approach. According to Stephan
Somogyi, security and privacy product manager at
Google Inc., “no company can do everything well.
For many companies, he recommends hiring exter-
nal contractors so that the companies can “focus on
their core competencies while taking advantage of
the scale and skills of those that specialize in infor-
mation security.
17
3. Build security awareness. Effective security
awareness training is essential. Raising cybersecurity
awareness is critical, and every part of the organiza-
tion should become familiar with cybersecurity best
practices. All employees who have access to confi-
dential information, whether they are in sales,
marketing, human resources, finance, or senior
management even temporary staff should
receive cybersecurity awareness training.
Companies should encourage behaviors and
processes that integrate information security into
daily routines, and they should be sure to explain
why it’s important. Some companies are approach-
ing cybersecurity training in ways that are similar
to training for ethics and regulatory compliance. A
few, such as Salesforce.com, are attempting to im-
prove security-related behavior with gamification
programs. According to Patrick Heim, the compa-
ny’s chief trust officer, employees who participated
in its security-related gamification program “were
50% less likely to click on a phishing link and 82%
more likely to report a phishing email.
18
4. Create alliances. Recent data breaches show
that skillful hackers can replicate successful attacks.
Once hackers identify one security threat and ex-
ploit it, oftentimes they reuse the methodology to
attack another target. Given this possibility, its im-
portant for IT security staff to coordinate and share
information within their organization, within their
industry, and even with their competitors. Thus, it’s
important to create alliances with other companies
and with government agencies.
The private and public sectors need to come to-
gether to address the cybersecurity challenge. The
North Atlantic Treaty Organization (NATO) has
called on members to build alliances to combat
cybercrime.
19
By joining together, private busi-
nesses will be able to develop more comprehensive
cybersecurity strategies more economically.
5. Keep abreast of and follow best practices.
Many recent data breaches show that security pol-
icies are meaningless unless companies have a
rigorous, continual way of monitoring compli-
ance. Cybersecurity threats are constantly shifting
as new security vulnerabilities are identified and
new types of malware are created. Sometimes,
even older threats that were thought to be under
control rear their heads with a vengeance. The
only way to confront modern cybersecurity
threats is to keep defensive processes up to date,
continually train personnel, stay current on the state
of information security, and use control-enabled
tools to proactively detect, analyze, and respond
to incidents.
Although hackers are always looking for new
ways to break in, organizations are also getting bet-
ter all the time at “knowing their enemies.Some go
so far as to invite hackers to identify vulnerabilities.
In March 2016, for example, the U.S. Department
of Defense launched a four-week bug bounty pro-
gram in which participants were asked to use their
hacking skills to break into selected U.S. Depart-
ment of Defense public web pages in exchange for
prizes and recognition. More than 250 participants
submitted at least one vulnerability report, and
more than half of the vulnerabilities were “legiti-
mate, unique, and eligible for a bounty,said
then-Secretary of Defense Ashton B. Carter.
20
(Mission-facing systems were not included in the
program.) Other organizations, including MIT,
also use bug bounties
21
along with more traditional
approaches to cybersecurity.
It’s important to create alliances with other companies and
with government agencies. The private and public sectors
need to come together to address the cybersecurity challenge.
SLOANREVIEW.MIT.EDU SPRING 2017 MIT SLOAN MANAGEMENT REVIEW 77
New approaches to cybersecurity — and new
threats — will undoubtedly continue to evolve. Cy-
bersecurity is a game of cat and mouse in which the
cat always makes the first move. But the more you
can think like a hacker, the better able you will be to
protect your organization.
José Esteves is an associate professor of informa-
tion systems and digital innovation at IE Business
School in Madrid. is head of pro-Elisabete Ramalho
grammatic client strategy for Europe, the Middle
East, and Africa at Google Inc. is Guillermo de Haro
an associate professor of applied economics at King
Juan Carlos University in Madrid. Comment on this
article at http://sloanreview.mit.edu/x/58314, or con-
tact the authors at smrfeedback@mit.edu.
REFERENCES
1. V. Goel and N. Perlroth, “Yahoo Says 1 Billion User
Accounts Were Hacked,” New York Times, Dec. 14,
2016, www.nytimes.com; S. Fiegerman, “Yahoo
Says 500 Million Accounts Stolen,” Sept. 23, 2016,
http://money.cnn.com; and D. Shepardson, “Verizon
Says Hack ‘Material,’ Could Affect the Deal,” Oct. 13,
2016, www.reuters.com.
2. H. Kuchler, “Yahoo Data Breach Will Delay $4.8bn Verizon
Deal,” Financial Times, Jan. 23, 2017, www.ft.com; and
“Yahoo Says the SEC Is Investigating Its Recent Data
Breaches,” Fortune.com, Jan. 23, 2017, http://fortune.com.
3. R. Contu, C. Canales, S. Deshpande, and L. Pingree,
“Forecast: Information Security, Worldwide, 2014-2020,
2Q16 Update,” Aug. 25, 2016, www.gartner.com.
4. N. Dalkey and O. Helmer, “An Experimental Application
of the Delphi Method to the Use of Experts,”
Management Science 9, no. 3 (April 1963): 458-467.
5. C.S. Dweck, “Mindset: The New Psychology of
Success” (New York: Random House, 2006).
6. J. O’Dell, “How 7 Black Hat Hackers Landed Legit
Jobs,” June 2, 2011, http://mashable.com.
7. R.J. Anderson, https://en.wikipedia.org/wiki/Ross_J._
Anderson, “Security Engineering: A Guide to Building
Dependable Distributed Systems,” 2nd ed. (Indianapolis,
Indiana: Wiley, 2008).
8. “Underground Hacker Marketplace Report” (see
https://www.secureworks.com/resources/rp-2016-
underground-hacker-marketplace-report) April 2016,
www.secureworks.com; V. Goel and N. Perlroth,
“Hacked Yahoo Data Is for Sale on Dark Web,”
New York Times, Dec. 15, 2016, www.nytimes.com;
and D.L. Leger, “How Stolen Credit Cards Are Fenced
on the Dark Web,” USA Today, Sept. 3, 2014,
www.usatoday.com.
9. A. Jeng, “Minimizing Damage From J.P. Morgan’s
Data Breach,” SANS Institute, March 15, 2015, p. 3;
and “Senior Managers Account for Greatest Information
Security Risks: Survey,” Jan. 7, 2014, www.security-
week.com.
10. T.S. Bernard, Ways to Protect Yourself After the
JPMorgan Hacking,” New York Times, Oct. 3, 2014;
D. Rushe, “JP Morgan Chase Reveals Massive Data
Breach Affecting 76m Households,” Guardian, Oct. 3,
2014; M. Goldstein, N. Perlroth, and M. Corkery,
“Neglected Server Provided Entry for JPMorgan Hackers,
New York Times, Dec. 22, 2014; and E. Glazer, “J.P. Morgan
CEO: Cybersecurity Spending to Double,Wall Street
Journal, Oct.10, 2014.
11. “TalkTalk Gets Record £400,000 Fine for Failing
to Prevent October 2015 Attack,” Oct. 5, 2016,
http://ico.org.uk; and P. Sandle, “TalkTalk Lost More
Than 100,000 Customers After Cyber Attack,” Reuters,
Feb. 2, 2016, www.uk.reuters.com.
12. P. Ziobro, “Target Breach Began With Contractor’s
Electronic Billing Link,” Wall Street Journal, Feb. 6, 2014;
and B. Krebs, “Non-US Cards Used at Target Fetch
Premium,” Dec. 13, 2013, krebsonsecurity.com.
13. “Letter From Anthem President & CEO, Joseph
Swedish,” Feb. 6, 2015, www.myrha.org; D. Walker,
“Exclusive: Mandiant Speaks on Anthem Attack, Custom
Backdoors Used,” Feb. 5, 2015, www.scmagazine.com;
and C. Terhune, “Anthem Data Breach Poses a Big
Test for Its CEO,” Los Angeles Times, Feb. 12, 2015,
www.latimes.com.
14. K. Zetter, “Why Hospitals Are the Perfect Targets for
Ransomware,” March 30, 2016, www.wired.com; and B.
Barrett, “Hack Brief: Hackers Are Holding an LA Hospital’s
Computers Hostage,Feb. 16, 2016, www.wired.com.
15. K. Graves, “CEH: Official Certified Ethical Hacker
Review Guide: Exam 312-50” (Indianapolis, Indiana:
Wiley Publishing, 2007).
16. Based on the military concept of a “kill chain”
(a systematic process to target and engage an adver-
sary), Lockheed Martin Corp. developed the “cyber kill
chain” model that details each step of a cybercriminal’s
operation from reconnaissance to actions on objectives.
Many companies have adapted the cyber kill chain model
to address their own risks. See E. Hutchins, M. Cloppert,
and R. Amin, “Intelligence-Driven Computer Network
Defense Informed by Analysis of Adversary Campaigns
and Intrusion Kill Chains,” Leading Issues in Information
Warfare and Security Research, vol. 1 (Reading, U.K.:
Academic Publishing International Limited, 2011), 80-106.
17. S. Somogyi, interview with authors, Feb. 2, 2016.
18. L. Wood, “Boost Your Security Training
With Gamification Really!,” July 16, 2014,
www.computerworld.com.
19. L. Thompson, “Cyber Alliances: Collective Defense
Becomes Central to Securing Networks, Data,” Sept. 19,
2014, www.forbes.com.
20. L. Ferdinando, “Carter Announces ‘Hack the Pentagon’
Program Results,June 17, 2016, www.defense.gov.
21. The MIT Security Bug Bounty Program is a student-
founded project, run with the schools Information
Systems and Technology department. It can be found
at https://bounty.mit.edu.
Reprint 58314.
Copyright © Massachusetts Institute of Technology, 2017.
All rights reserved.
PDFs Reprints Permission to Copy Back Issues
Articles published in MIT Sloan Management Review are copyrighted by the
Massachusetts Institute of Technology unless otherwise speci昀椀ed at the end of an
article.
MIT Sloan Management Review articles, permissions, and back issues can be
purchased on our Web site: sloanreview.mit.edu or you may order through our
Business Service Center (9 a.m.-5 p.m. ET) at the phone numbers listed below.
Paper reprints are available in quantities of 250 or more.
To reproduce or transmit one or more MIT Sloan Management Review articles by
electronic or mechanical means (including photocopying or archiving in any
information storage or retrieval system) requires written permission.
To request permission, use our Web site: sloanreview.mit.edu
or
E-mail: smr-help@mit.edu
Call (US and International):617-253-7170 Fax: 617-258-9739
Posting of full-text SMR articles on publicly accessible Internet sites is
prohibited.To obtain permission to post articles on secure and/or password-
protected intranet sites, e-mail your request to smr-help@mit.edu.
MITMIT SLSLOOAN MANAAN MANAGEMENGEMENT REVIEWT REVIEW
DIGITDIGITALAL
Copyright © Massachusetts Institute of Technology, 2017. All rights reserved. Reprint #58314 http://mitsmr.com/2mXYJdD
| 1/9

Preview text:

To Improve Cybersecurity, Think Like a Hacker S P R I N G 2 0 1 7 I S S U E
Cyberattacks are an increasingly common and worrisome
threat. To combat the risk, companies need to understand
both hackers’ tactics and their mindsets. José Esteves Elisabete Ramalho Guillermo de Haro Vol. 58, No. 3 Reprint #58314 http://mitsmr.com/2mXYJdD
R I S K M A N A G E M E N T To Improve Cybersecurity, Think Like a Hacker THE LEADING QUESTION What do
Cyberattacks are an increasingly common and worrisome threat. executives
To combat the risk, companies need to understand both hackers’ need to know about tactics and their mindsets. improving
BY JOSÉ ESTEVES, ELISABETE RAMALHO, AND GUILLERMO DE HARO cybersecurity? FINDINGS Hackers will patiently and thor- oughly examine a target company’s
IF YOU HAVE any doubts about the need for a new corporate cybersecurity mindset, the daily news systems, looking for vulnerabilities.
contains plenty of sobering evidence. Recently, Yahoo Inc., which was in the midst of a planned transac- People often repre-
tion to sell its core businesses to Verizon, disclosed that it had been the target of two of the biggest data sent the weakest link in an organiza-
breaches ever, with sensitive information stolen involving more than 1 billion user accounts in 2013 and tion’s cybersecurity.
500 million in 2014.1 In addition to highlighting Yahoo’s cybersecurity vulnerability, the attacks have Senior management
resulted both in a delay in the planned acquisition by Verizon and in a probe by the U.S. Securities and needs to stress the importance of
Exchange Commission about the disclosure of the breaches.2 The incident raises broad questions about cybersecurity.
how cyberthreats affect mergers and acquisitions
deals, and it could have an impact on disclosure guidelines and regulations.
In the past several years, the list of companies
whose internal systems have been hacked has
grown rapidly. In addition to hundreds of small
and medium-size companies, it now includes such
high-profile businesses as Target, JPMorgan Chase,
Home Depot, Sony Pictures, Ashley Madison, and
Yahoo. In many cases, cybersecurity breaches go
on for weeks or months before they’re discovered.
Cybersecurity breach response times can be a cru-
cial factor in the data breach scale, its mitigation,
the determination of its source, and also future
legal issues involving the disclosure period. Not
only have the attacks in the past few years been
costly for the companies, but they also shake the
confidence of customers, shareholders, and em-
ployees. And no industry appears to be safe from
attacks, regardless of the specific measures indi-
vidual companies use to defend themselves.
As a result, spending on cybersecurity is poised
to accelerate. Gartner Inc., the information tech-
nology (IT) research and advisory firm, has
estimated that global spending on information
PLEASE NOTE THAT GRAY AREAS REFLECT ARTWORK THAT HAS BEEN INTENTIONALLY REMOVED.
SPRING 2017 MIT SLOAN MANAGEMENT REVIEW 71
THE SUBSTANTIVE CONTENT OF THE ARTICLE APPEARS AS ORIGINALLY PUBLISHED.
R I S K M A N A G E M E N T
security would reach $81 billion in 2016 and may
have good social and communication skills that en-
grow to $101 billion by 2018, with the highest able them to manipulate people to release essential
growth in security testing.3 Unfortunately, invest-
information or to perform critical actions.7
ment in security measures is only part of the
Many hackers are drawn to the possibility of
answer; traditional methodologies can only do so
earning thousands or possibly millions of dollars.
much. To be effective, executives in charge of cyber-
They are accustomed to operating in the black
security need to adjust their mindsets and become
market and committing crimes far away from
as open and adaptive as possible.
where they live. They generally enjoy the adrenaline
To help companies respond to new types of
rush they get from taking high-stakes risks. Indeed,
threats, we have developed a framework that is
many hackers have nerves of steel — not much
informed by our understanding of the process
frightens them. Although it used to be common
hackers employ to attack an organization. We de-
for hackers to work independently, few of today’s
signed this framework in collaboration with expert
hackers operate alone. They are often part of an
hackers using the Delphi method, a structured
organized hacking group, where they are members
technique that draws on the knowledge and opin-
of a team providing specialized illegal services such
ions of experts.4 We also relied on in-depth
as credit card or loan fraud, theft of intellectual
interviews with more than 20 experienced hackers.
property or personally identifiable information,
(See “About the Research.”)
identity theft, or counterfeiting documents.8 The Hacker Mindset Thinking Like a Hacker
If organizations want to reduce the risk of external
Fully protecting a company’s data is no easy task.
hacking attacks, they need to understand the hacker
Dan Chenok, a former chairman of the Informa-
mindset.5 In other words, companies need to com-
tion Security and Privacy Advisory Board for the
prehend the expertise of successful hackers to
U.S. National Institute of Standards and Technol-
anticipate and confront attacks. Companies such as
ogy, has asserted: “The only way to 100% protect
Facebook Inc. and Microsoft Corp., for example,
yourself from attacks is to turn off your comput- have even hired hackers.6
ers.”9 However, learning to think like a hacker can
To think like a hacker, you need to know the traits
help your organization anticipate what a hacker
that characterize a competent and sophisticated
might do and then take actions to reduce those
hacker. Hackers tend to be highly skilled and intelli-
risks. So what is a hacking mindset, and how should
gent, and enjoy taking risks. They typically have it influence the way organizations approach
backgrounds in computer science and have been la- cybersecurity?
beled geeks for many years. Many successful hackers
We found that hackers actually have two differ-
ent mindsets during different stages in an attack:
explorative and exploitative. (See “How Hackers ABOUT THE RESEARCH
Approach an Attack.”) In the initial stages of an at-
We conducted a web-based study consisting of two rounds of surveys with 23 experi-
tack, hackers typically use an exploration mindset
enced hackers through an anonymous consensus-building process. The hackers list
that combines deliberate and intuitive thinking
was obtained through a variety of methods: screening hackers offering their hacking
and cybersecurity services on the internet, people mentioned in the media, introduc-
and relies on intensive experimentation. For exam-
tions from other hackers, recommendations from chief security officers who knew
ple, an experienced hacker will not attack a new
hackers, and individuals whom the research team knew. We asked hackers to label
system a company has just activated. He or she will
and prioritize the steps to perform a successful cyberattack. We subsequently con-
prefer to wait and continue to search for the weak-
ducted 17 in-depth interviews with panel experts to get more detail on the different
phases of cyberattacks. The article is based on insights from our study, the interviews,
est link (such as a vendor, a new employee, or a
and our own experience in cybersecurity and digital and information technology. In
situation that is not in compliance with the organi-
conducting our study, we used the Delphi method, which has been employed since
zation’s security standards). Once access to a system
the 1950s to obtain real-world knowledge. The method is based on several iterative
is gained, hackers rely on an exploitation mindset to
rounds of questionnaires among experts to obtain data or test hypotheses. We used
this approach to uncover the policies followed by hackers and to define what an adap-
meet their goals — for example, to gain as much
tive cybersecurity strategy should be.
information for profitable resale as they can. This
72 MIT SLOAN MANAGEMENT REVIEW SPRING 2017 SLOANREVIEW.MIT.EDU
strategy of exploration followed by exploitation HOW HACKERS APPROACH AN ATTACK
typically involves four steps; the first two steps
To protect their organizations, companies need to understand how hackers go
focus on exploration, and the third and fourth em-
about their work. Our research suggests that hackers’ attacks typically involve
four steps: identifying vulnerabilities; scanning and testing; gaining access; and phasize exploitation.
maintaining access. The first two steps primarily emphasize an exploration
mindset, and the third and fourth steps involve efficiently exploiting the access
STEP 1: Identifying Vulnerabilities Hackers are the hackers have gained.
patient, studious, and clever. If they think your EXPLORATION EXPLOITATION
company is worth attacking, they will examine it
thoroughly for weaknesses, surveying the network 1. 2. 3. 4. Identifying Scanning Gaining Maintaining
information, organizational information, and ATTACK vulnerabilities access access PHASES and testing
security policies. This process of gathering infor-
mation is known among hackers as footprinting. Design of • Experimental • Procedural
They may also study your suppliers and other con- Attack
tractors that your company works with, as well as Role of • Gaining know-how • Using know-how
your subsidiaries. Before launching a cyberattack, Knowledge
hackers will map out the target network and sys- Aim of • Effectiveness • Efficiency Action
tems and take note of all holes and vulnerabilities, Competencies
potential entry points, and any security mecha- • Creativity • Problem-solving Required • Tenacity • Adaptability
nisms that could be hurdles . At t his stag e, • Persistence • Focus on results
information such as server names, IP addresses, • Curiosity • Planning and organizing
and user accounts can help them prepare the at- • Observation • Analysis
tack. As noted earlier, hackers also attempt to • Critical thinking
interact with company insiders who might have
critical information that would not be easily ob-
with stolen credentials from a bank employee, to
tained under normal circumstances and that could
gain access to some 90 servers inside the company.
help the hackers gain access to company systems.
Companies can help protect themselves by adopt-
At this stage, a hacker’s most important charac-
ing an iterative and adaptive process and making a
teristics are curiosity, patience, and communication
point of conducting a high-level “footprint” of their
and social skills. Recognizing this, you need to turn
systems on a regular basis. In addition, they should
these characteristics to your company’s advantage:
make sure that employees are well informed on poli-
Be curious about your systems and how they relate
cies regarding sharing of information and offer them
to any vulnerability. In 2014, JPMorgan Chase & periodic reminders about the various ways hackers ob-
Co., one of the biggest U.S.-based banks, was tain information. For example, if someone unknown
reported to have suffered a cyberattack that com-
begins to interact with a bank employee in a friendly
promised the data of 76 million households and
way, maybe that person’s purpose isn’t so friendly.
7 million small businesses. Although login infor-
mation, passwords, user IDs, birth dates, and Social
STEP 2: Scanning and Testing After a hacker has
Security numbers were not compromised in
broken into your network, weaknesses in the appli-
this attack, other information that can be used for
cations running on your systems could become
identity theft — names, email addresses, postal ad-
avenues for further unauthorized access. Hackers
dresses, and phone numbers — was exposed. How
often use scanning tools on applications running
did this happen? Most big banks use two-factor
on a company’s system once they enter. Cumula-
authentication, which combines static passwords
tively, small security vulnerabilities and design
with codes dynamically generated by physical weaknesses can add up to major security holes.
devices. Unfortunately, JPMorgan’s IT security
To protect your company, you should identify
team failed to update one of its network servers to
potential weaknesses once you have created a
enforce two-factor authentication, leaving the bank
footprint of your systems. Examine every element
vulnerable.10 Hackers used this weakness, together
(hardware, software, and protocols) of the company’s SLOANREVIEW.MIT.EDU
SPRING 2017 MIT SLOAN MANAGEMENT REVIEW 73
R I S K M A N A G E M E N T
network. In testing your network’s security, evalu-
insurers in the United States, hackers used a stolen
ate cases of use and misuse from as many angles login and password to steal up to 80 million records
as possible, and run penetration tests for your
of personal information pertaining to customers
applications as a “power user” — or better yet, as a
and employees — even the company’s CEO — in
hacker — as opposed to as an average user.
2015.13 Once in the network, they obtained per-
Failure to take such measures could expose
sonal information such as names, Social Security
you to a cyberattack, which is what happened to
numbers, birthdays, addresses, email addresses,
TalkTalk Telecom Group PLC, one of the largest
and employment information (including income
providers of broadband and phone service in the
data) — all of which can be quite valuable in the
United Kingdom, in October 2015. The data
black market for the purpose of identity theft.
breach exposed the records of more than 150,000
To protect your company, you need to consider
customers. In the wake of the incident, the com-
how a hacker could gain access to your organiza-
pany lost customers, and it was hit with a £400,000
tion’s systems, based on the information you have
fine by the U.K. government. The government
collected in the first two steps. While those steps
criticized TalkTalk’s failure to implement basic were designed to identify security vulnerabilities,
cybersecurity measures such as software updates
this third step is geared toward exploiting them, or
and regular system monitoring, thereby making it
what’s known in the hacker world as “owning the
relatively easy for hackers to break in.11 system.”
On Feb. 5, 2016, hackers sent emails with links to
STEP 3: Gaining Access Among the factors that
malware to employees of Hollywood Presbyterian
influence a hacker’s chances of gaining unauthor-
Medical Center in Los Angeles. When an employee
ized access to a particular system are the system’s clicked on one of the links, the system locked and
architecture and configuration, the hacker’s skill
disabled the hospital’s electronic communication.
level, and the initial level of access the hacker is able For more than a week, the hackers had unfettered
to obtain. For example, hackers often contact
access to Hollywood Presbyterian’s data (although it
organizations by telephone, a “phishing” email
was reported that no data was actually taken). The
campaign, a forged email message, or instant mes-
nightmare ended only after the hospital paid a ran-
sages asking individuals for login and password
som of 40 bitcoins, valued at the time at about
credentials, usually by pretending to be someone
$17,000, at which point the hackers sent them a digi-
with credibility (for example, a senior company of-
tal decryption key to unlock the system.14
ficer or a help desk technician).
Hackers tend to play on both sophisticated tech-
At Target Corp., a retailer based in Minneapolis,
nical knowledge and communication skills to breach
Minnesota, hackers broke into the corporate net-
company security. If you are equally sophisticated in
work using stolen credentials from a third-party
your knowledge of common hacker tactics, you can
vendor who had provided air-conditioning ser-
mount an effective defense. An awareness campaign
vices. They then installed malicious software that alerts your employees, contractors, and third-
(commonly called “malware”) to siphon customer
party users to common hacker strategies should be a
information from the company’s networks and
critical component of that defense.
point-of-sale system in more than 1,800 brick-and-
mortar stores in the United States.
STEP 4: Maintaining Access Hackers try to re-
The malware the hackers of Target used is available tain their ownership of the system and access for
on cybercrime forums for about $2,000. The hackers
future attacks while remaining unnoticed. Some-
had explored a variety of ways to enter Target’s sys-
times they “harden” the system from security
tem before identifying the entranceway through the
personnel (and even from other hackers) by secur-
vendor. Once inside Target’s network, the hackers
ing exclusive access and uploading a piece of code
gained access to cash registers in stores.12
that’s known as a “backdoor.”
The tactics the hackers used against Target were
Once hackers “own” a system, they can use it as
unusual. At Anthem Inc., one of the largest health
a base camp for launching new cyberattacks.15
74 MIT SLOAN MANAGEMENT REVIEW SPRING 2017 SLOANREVIEW.MIT.EDU
The message needs to come from the top down that ‘we’
as a company need to be more secure so that staff is more
likely to engage. No matter how technically competent the
IT department is, it can’t change the vision of the company.
An owned system is often referred to as a “zombie”
It is also critical to demonstrate that the compa-
system. In the final stages of an attack, hackers often ny’s long-term profitability and resilience are
cover their tracks to avoid detection by security
contingent upon security. Companies should cre-
personnel and remove evidence of hacking, to
ate a security communication plan for the whole
avoid legal consequences. Skilled hackers use to organization that includes content aimed directly
their own advantage their technical knowledge of
at executives and that gets updated on a regular
how systems detect wrongful activity. Therefore, it
basis. The material should include guidelines and
is critical for organizations to remain vigilant for
processes on how to manage and communicate
suspicious activity in system logs and to ensure that
about security breaches that may arise.
monitoring systems are always up to date.
2. Design a security strategy. As we have noted,
technology alone is not enough. Companies must Putting the Hacker
address cybersecurity from both technological and Mindset to Work
nontechnological perspectives. In many organiza-
Once companies are familiar with the basic re-
tions, the people aspect of cybersecurity is one of
quirements, what should they do to protect the
the weakest links. Security experts recommend
organization from cyberattacks? We believe effec-
adopting a “threat-centric” and operational secu-
tive cybersecurity practices need to be implemented
rity model that looks at security from a hacker’s
both from the top down and from the bottom up.
perspective. This requires looking at cybersecurity
In support of this approach, we have developed five
from both inside out (to understand what employ- recommendations.
ees, strategic business partners, and third-party
1. Get senior management on board. Sustained
vendors are doing within their organizations and
support from senior management is crucial to ensur-
how they are interacting with high-value assets
ing that action plans are in place to mitigate the risk
such as systems, facilities, and data) and outside
of cyberattacks. The message needs to come from the
in (to consider what an enemy might see when
top down that “we” as a company need to be more
scoping out weaknesses from the outside). The lat-
secure so that staff is more likely to engage. No matter ter is often referred to as “turning the map around,”
how technically competent the IT department is, it
and the goal is to ensure a comprehensive ap-
can’t change the vision of the company. Rather,
proach to mission planning and to help the
senior management needs to ask for complete buy-
company prepare for actions an enemy may take in
in, hold periodic meetings with line managers, and the future.16
deliver the message from the top down.
Executives and information managers should
In order to get executive-level decision makers
examine how their information systems are cur-
on board, it’s important to emphasize the role of
rently managed to assess their level of cybersecurity,
cybersecurity in addressing market, privacy, tech-
and they should determine how secure each asset
nology, and regulatory risks and demands. To do
needs to be. They need to assess whether they have
this, top managers may need to explain how the
the right competencies and whether they have the
cybersecurity strategy enables business objectives right organizational design to anticipate and re-
and initiatives, and highlight how effective security
spond to potential cybersecurity threats.
governance can enhance the interests of all stake-
In developing strategies, companies need to
holders (customers, business units, employees, and
make choices: whether to build full-fledged in-
auditors) in a cost-effective manner.
house security capabilities, rely on external experts, SLOANREVIEW.MIT.EDU
SPRING 2017 MIT SLOAN MANAGEMENT REVIEW 75
R I S K M A N A G E M E N T
or adopt a hybrid approach. According to Stephan
The private and public sectors need to come to-
Somogyi, security and privacy product manager at
gether to address the cybersecurity challenge. The
Google Inc., “no company can do everything well.”
North Atlantic Treaty Organization (NATO) has
For many companies, he recommends hiring exter-
called on members to build alliances to combat
nal contractors so that the companies can “focus on
cybercrime.19 By joining together, private busi-
their core competencies while taking advantage of
nesses will be able to develop more comprehensive
the scale and skills of those that specialize in infor-
cybersecurity strategies more economically. mation security.”17
5. Keep abreast of and follow best practices.
3. Build security awareness. Effective security
Many recent data breaches show that security pol-
awareness training is essential. Raising cybersecurity icies are meaningless unless companies have a
awareness is critical, and every part of the organiza-
rigorous, continual way of monitoring compli-
tion should become familiar with cybersecurity best
ance. Cybersecurity threats are constantly shifting
practices. All employees who have access to confi-
as new security vulnerabilities are identified and
dential information, whether they are in sales,
new types of malware are created. Sometimes,
marketing, human resources, finance, or senior
even older threats that were thought to be under
management — even temporary staff — should
control rear their heads with a vengeance. The
receive cybersecurity awareness training.
only way to confront modern cybersecurit y
Companies should encourage behaviors and
threats is to keep defensive processes up to date,
processes that integrate information security into
continually train personnel, stay current on the state
daily routines, and they should be sure to explain
of information security, and use control-enabled
why it’s important. Some companies are approach-
tools to proactively detect, analyze, and respond
ing cybersecurity training in ways that are similar to incidents.
to training for ethics and regulatory compliance. A
Although hackers are always looking for new
few, such as Salesforce.com, are attempting to im-
ways to break in, organizations are also getting bet-
prove security-related behavior with gamification
ter all the time at “knowing their enemies.” Some go
programs. According to Patrick Heim, the compa-
so far as to invite hackers to identify vulnerabilities.
ny’s chief trust officer, employees who participated In March 2016, for example, the U.S. Department
in its security-related gamification program “were
of Defense launched a four-week bug bounty pro-
50% less likely to click on a phishing link and 82% gram in which participants were asked to use their
more likely to report a phishing email.”18
hacking skills to break into selected U.S. Depart-
4. Create alliances. Recent data breaches show
ment of Defense public web pages in exchange for
that skillful hackers can replicate successful attacks. prizes and recognition. More than 250 participants
Once hackers identify one security threat and ex-
submitted at least one vulnerability report, and
ploit it, oftentimes they reuse the methodology to
more than half of the vulnerabilities were “legiti-
attack another target. Given this possibility, it’s im-
mate, unique, and eligible for a bounty,” said
portant for IT security staff to coordinate and share
then-Secretary of Defense Ashton B. Carter.20
information within their organization, within their
(Mission-facing systems were not included in the
industry, and even with their competitors. Thus, it’s
program.) Other organizations, including MIT,
important to create alliances with other companies
also use bug bounties21 along with more traditional and with government agencies. approaches to cybersecurity.
It’s important to create al iances with other companies and
with government agencies. The private and public sectors
need to come together to address the cybersecurity challenge.
76 MIT SLOAN MANAGEMENT REVIEW SPRING 2017 SLOANREVIEW.MIT.EDU
New approaches to cybersecurity — and new
10. T.S. Bernard, “Ways to Protect Yourself After the
threats — will undoubtedly continue to evolve. Cy-
JPMorgan Hacking,” New York Times, Oct. 3, 2014;
D. Rushe, “JP Morgan Chase Reveals Massive Data
bersecurity is a game of cat and mouse in which the
Breach Affecting 76m Households,” Guardian, Oct. 3,
cat always makes the first move. But the more you 2014; M. Goldstein, N. Perlroth, and M. Corkery,
can think like a hacker, the better able you will be to
“Neglected Server Provided Entry for JPMorgan Hackers,”
New York Times, Dec. 22, 2014; and E. Glazer, “J.P. Morgan protect your organization.
CEO: Cybersecurity Spending to Double,” Wall Street Journal, Oct.10, 2014.
José Esteves is an associate professor of informa-
11. “TalkTalk Gets Record £400,000 Fine for Failing
tion systems and digital innovation at IE Business
to Prevent October 2015 Attack,” Oct. 5, 2016,
School in Madrid. Elisabete Ramalho is head of pro-
http://ico.org.uk; and P. Sandle, “TalkTalk Lost More
grammatic client strategy for Europe, the Middle
Than 100,000 Customers After Cyber Attack,” Reuters,
East, and Africa at Google Inc. Guillermo de Haro is
Feb. 2, 2016, www.uk.reuters.com.
an associate professor of applied economics at King 12.
Juan Carlos University in Madrid. Comment on this
P. Ziobro, “Target Breach Began With Contractor’s
article at http://sloanreview.mit.edu/x/58314, or con-
Electronic Billing Link,” Wall Street Journal, Feb. 6, 2014;
tact the authors at smrfeedback@mit.edu.
and B. Krebs, “Non-US Cards Used at Target Fetch
Premium,” Dec. 13, 2013, krebsonsecurity.com.
13. “Letter From Anthem President & CEO, Joseph REFERENCES
Swedish,” Feb. 6, 2015, www.myrha.org; D. Walker,
“Exclusive: Mandiant Speaks on Anthem Attack, Custom
1. V. Goel and N. Perlroth, “Yahoo Says 1 Billion User
Backdoors Used,” Feb. 5, 2015, www.scmagazine.com;
Accounts Were Hacked,” New York Times, Dec. 14,
and C. Terhune, “Anthem Data Breach Poses a Big
2016, www.nytimes.com; S. Fiegerman, “Yahoo
Test for Its CEO,” Los Angeles Times, Feb. 12, 2015,
Says 500 Million Accounts Stolen,” Sept. 23, 2016, www.latimes.com.
http://money.cnn.com; and D. Shepardson, “Verizon
14. K. Zetter, “Why Hospitals Are the Perfect Targets for
Says Hack ‘Material,’ Could Affect the Deal,” Oct. 13,
Ransomware,” March 30, 2016, www.wired.com; and B. 2016, www.reuters.com.
Barrett, “Hack Brief: Hackers Are Holding an LA Hospital’s
2. H. Kuchler, “Yahoo Data Breach Wil Delay $4.8bn Verizon
Computers Hostage,” Feb. 16, 2016, www.wired.com.
Deal,” Financial Times, Jan. 23, 2017, www.ft.com; and
15. K. Graves, “CEH: Official Certified Ethical Hacker
“Yahoo Says the SEC Is Investigating Its Recent Data
Review Guide: Exam 312-50” (Indianapolis, Indiana:
Breaches,” Fortune.com, Jan. 23, 2017, http://fortune.com. Wiley Publishing, 2007).
3. R. Contu, C. Canales, S. Deshpande, and L. Pingree,
16. Based on the military concept of a “kill chain”
“Forecast: Information Security, Worldwide, 2014-2020,
(a systematic process to target and engage an adver-
2Q16 Update,” Aug. 25, 2016, www.gartner.com.
sary), Lockheed Martin Corp. developed the “cyber kill
4. N. Dalkey and O. Helmer, “An Experimental Application
chain” model that details each step of a cybercriminal’s
of the Delphi Method to the Use of Experts,”
operation from reconnaissance to actions on objectives.
Management Science 9, no. 3 (April 1963): 458-467.
Many companies have adapted the cyber kil chain model
to address their own risks. See E. Hutchins, M. Cloppert,
5. C.S. Dweck, “Mindset: The New Psychology of
and R. Amin, “Intelligence-Driven Computer Network
Success” (New York: Random House, 2006).
Defense Informed by Analysis of Adversary Campaigns
6. J. O’Dell, “How 7 Black Hat Hackers Landed Legit
and Intrusion Kill Chains,” Leading Issues in Information
Jobs,” June 2, 2011, http://mashable.com.
Warfare and Security Research, vol. 1 (Reading, U.K.:
Academic Publishing International Limited, 2011), 80-106.
7. R.J. Anderson, https://en.wikipedia.org/wiki/Ross_J._
17. S. Somogyi, interview with authors, Feb. 2, 2016.
Anderson, “Security Engineering: A Guide to Building
Dependable Distributed Systems,” 2nd ed. (Indianapolis,
18. L. Wood, “Boost Your Security Training Indiana: Wiley, 2008).
With Gamification – Really!,” July 16, 2014, 8. www.computerworld.com.
“Underground Hacker Marketplace Report” (see
https://www.secureworks.com/resources/rp-2016-
19. L. Thompson, “Cyber Al iances: Collective Defense
underground-hacker-marketplace-report) April 2016,
Becomes Central to Securing Networks, Data,” Sept. 19,
www.secureworks.com; V. Goel and N. Perlroth, 2014, www.forbes.com.
“Hacked Yahoo Data Is for Sale on Dark Web,”
20. L. Ferdinando, “Carter Announces ‘Hack the Pentagon’
New York Times, Dec. 15, 2016, www.nytimes.com;
Program Results,” June 17, 2016, www.defense.gov.
and D.L. Leger, “How Stolen Credit Cards Are Fenced
21. The MIT Security Bug Bounty Program is a student-
on the Dark Web,” USA Today, Sept. 3, 2014,
founded project, run with the school’s Information www.usatoday.com.
Systems and Technology department. It can be found
9. A. Jeng, “Minimizing Damage From J.P. Morgan’s at https://bounty.mit.edu.
Data Breach,” SANS Institute, March 15, 2015, p. 3;
and “Senior Managers Account for Greatest Information Reprint 58314.
Security Risks: Survey,” Jan. 7, 2014, www.security-
Copyright © Massachusetts Institute of Technology, 2017. week.com. All rights reserved. SLOANREVIEW.MIT.EDU
SPRING 2017 MIT SLOAN MANAGEMENT REVIEW 77 MIT SLOAN MANAGEMENT REVIEW T DIGITAL PDFs Reprints Permission to Copy Back Issues
Articles published in MIT Sloan Management Review are copyrighted by the
Massachusetts Institute of Technology unless otherwise speci昀椀ed at the end of an article.
MIT Sloan Management Review articles, permissions, and back issues can be
purchased on our Web site: sloanreview.mit.edu or you may order through our
Business Service Center (9 a.m.-5 p.m. ET) at the phone numbers listed below.
Paper reprints are available in quantities of 250 or more.
To reproduce or transmit one or more MIT Sloan Management Review articles by
electronic or mechanical means (including photocopying or archiving in any
information storage or retrieval system) requires written permission.
To request permission, use our Web site: sloanreview.mit.edu or E-mail: smr-help@mit.edu
Call (US and International):617-253-7170 Fax: 617-258-9739
Posting of full-text SMR articles on publicly accessible Internet sites is
prohibited.To obtain permission to post articles on secure and/or password-
protected intranet sites, e-mail your request to smr-help@mit.edu.
Copyright © Massachusetts Institute of Technology, 2017. All rights reserved. Reprint #58314 http://mitsmr.com/2mXYJdD