第14章サイバー資源の品質とサイバーコンピューティングのガバナンス

The most typical web/mobile application frameworks are web servers and web browsers. Other web/mobile application frameworks (e.g., application servers, business process management suites) operate using web browsers and extended web servers and use the same security mechanisms. This subsection will only focus on web servers and web browsers. Various types of attacks affect web information and interactions, including SQL injection, cross-site scripting (XSS), path (directory) traversal, cross-site request forgery, remote file inclusion (RFI), phishing, clickjacking, authentication/authorization attack, buffer errors, web browser attack, information leak/disclosure, and web server attack.

Here are several security risks we try to protect web servers (and web browsers) against:

• Risk 1: We want data stored on a web server to be protected from unauthorized access.

• Risk 2: We do not want malicious (or compromised) sites to be able to trash files/programs on user computers.

• Risk 3: We do not want a malicious site to be able to spy on or tamper with information or interactions with other websites.

The Federal Communications Commission has identified cybersecurity tips to help organizations protect against cyber threats when using the Internet. These include³⁸ :

• Ensure employees are trained regarding cybersecurity, including the organization’s security principles.

• Keep the system updated with the latest security software and frequently run antivirus software.

• Install and maintain a firewall, which is a collection of programs designed to prevent hackers and other unauthorized users from accessing a system.

• Ensure that mobile devices and laptops are included in the security plan and secure all such devices.

• Back up important files and data and store the backed-up information separately.

• Ensure all employees have passwords and other credentials required to access the system and provide access on an as-needed basis.

• Ensure that Wi-Fi networks are hidden and secured through encryption.

The following design and implementation guidelines can be accessed online through a browser search:

• OMG cybersecurity initiatives (and related standards, guidelines, best practices, and other resources)

38 Federal Communications Commission. No Date. “Cybersecurity for Small Businesses.” https://www.fcc.gov/communications-business-opportunities/cybersecurity-small-businesses#:.

• NIST cybersecurity standards (in particular NIST SP 800-53, SP 800-171, CSF, SP 1800 Series)

• Other global IT security frameworks and standards: ISO 27000 Series, COBIT, CIS Controls, HITRUST Common Security Framework, GDPR, COSO

• Industry IT security standards: PCI, HIPAA, PCI DSS, Sarbanes-Oxley (SOX), GLBA

• CyBok

• SAFECode

• Open Source Security Testing Methodology Manual (OSSTMM)

• Open Web Application Security Project (OWASP)

• Web Application Security Consortium Threat Classification (WASC-TC)

• Penetration Testing Execution Standard (PTES)

• Information Systems Security Assessment Framework (ISSAF)

The need to reduce costs and make IT more responsive to business changes are driving more and more Internet solutions (e.g., web/mobile information systems) to various cloud platforms. There are numerous obstacles that make it difficult for end users/organizations to adopt the cloud from a TRM assurance standpoint. Providing security for cloud environments that matches the levels found in commercial internal data centers is essential to helping modern organizations compete, and to allowing cloud service providers (CSPs) to meet their end users’ needs.

Managing risk in the cloud requires that users fully consider exposure to threats and vulnerabilities, not only during procurement but also as an on-going process. Security in the cloud is a constant process and cloud users should continually monitor their cloud resources and work to improve their security posture. Threat actors in the cloud may target the same types of weaknesses as the ones found in traditional system architectures. However, when organizations use the cloud, they face additional cyber threats, including the following:

• Malicious CSP administrators: They can leverage privileged credentials or position to access, modify, or destroy information stored on the cloud platform. They can also leverage privileged credentials or positions to modify the cloud platform to gain access to networks connected to or consuming cloud resources.

• Cyber criminals and/or nation-state-sponsored actors: They can leverage a cloud architecture or configuration weakness to obtain sensitive data or consume cloud resources at the victim’s expense. They may exploit weak cloud-based authentication mechanisms to obtain user credentials (e.g., password spray attacks). They may leverage compromised credentials or incorrect access privileges to access cloud resources. They may gain privileged access to the cloud environment to compromise tenant resources. They may leverage the trust relationship between an end user or organization’s networks and cloud resources to pivot from clouds into protected networks or vice versa.

• Untrained or neglectful customer cloud administrators: They may expose sensitive data or cloud resources unintentionally.