Bank Heist Analogy for Cybersecurity
Key Points
- Modern criminals target digital assets “online” rather than physical cash, shifting the focus of security from bank vaults to IT systems.
- A threat is any action that can disrupt normal operations, with the threat actor being the robber in a bank scenario or the malware creator/distributor in a cyber context.
- Vulnerabilities are system weaknesses—such as glass windows in banks or software bugs in computers—that can be exploited through various methods like breaking the glass or deploying malicious code.
- Exploits leverage these vulnerabilities (e.g., a rock or crowbar for a window, malware for a software flaw), and assessing the associated risk helps quantify potential damage and guide protective measures.
Sections
Full Transcript
# Bank Heist Analogy for Cybersecurity **Source:** [https://www.youtube.com/watch?v=8zSoyAmHHc4](https://www.youtube.com/watch?v=8zSoyAmHHc4) **Duration:** 00:05:39 ## Summary - Modern criminals target digital assets “online” rather than physical cash, shifting the focus of security from bank vaults to IT systems. - A threat is any action that can disrupt normal operations, with the threat actor being the robber in a bank scenario or the malware creator/distributor in a cyber context. - Vulnerabilities are system weaknesses—such as glass windows in banks or software bugs in computers—that can be exploited through various methods like breaking the glass or deploying malicious code. - Exploits leverage these vulnerabilities (e.g., a rock or crowbar for a window, malware for a software flaw), and assessing the associated risk helps quantify potential damage and guide protective measures. ## Sections - [00:00:00](https://www.youtube.com/watch?v=8zSoyAmHHc4&t=0s) **Untitled Section** - - [00:03:09](https://www.youtube.com/watch?v=8zSoyAmHHc4&t=189s) **Risk Assessment and Security Controls** - The speaker explains how risk is evaluated by considering likelihood, cost, and frequency, and outlines technical, administrative, and procedural controls used in banking and IT environments to mitigate threats. ## Full Transcript
The story goes that the infamous bank robber, Willie [Sutton], was once asked, "Why do you rob banks?"
And he responded, "Because that's where the money is."
Makes a lot of sense, right?
Well, but that's not really where the money is these days.
Your local branch might have some money, for sure.
But where's the big money?
It's not in the bank.
It's online.
It's in their IT systems.
It's digitized.
It's ones and zeros.
So, if we're going to look at security, let's take a look at an analogy
that begins with a bank and the threats that we see there.
And let's take a look at what its similar IT component would be.
So what do we face in each of these?
Well, it starts off with this notion of threats.
So what is a threat?
Well, a threat is anything that is an action that could undo the operation of the system.
It threatens the operation-- normal operation --of the system; gives an adverse effect.
So we could have threats that, in the case of a bank, well, it might be a robbery.
And in an IT system, it could be a break in.
Or, it could be, let's say it's a malware campaign.
So that's the overall overarching threat, there's an analogy here.
Now, the next thing we have to think about is the threat actor.
In the case of the bank, that's the robber.
In the case of the IT example with a malware campaign,
it's the person who wrote the malware or who is distributing the malware.
Next thing to consider: vulnerabilities.
So vulnerabilities are anything that are weaknesses in the system.
What's a weakness in the system of a bank?
Well, banks have windows, and windows are made of glass, and glass is weak.
We'll talk about how that can be exploited coming up.
But that's the vulnerability, is the glass.
How about the tellers themselves?
They could be threatened to give over the money.
Other things could be procedures, like when the money truck arrives.
Do we have the path from the truck into the vault and vice versa well secured?
If the procedures are not right, then we could be vulnerable.
So what would be the IT example in this case?
Well, if we're talking about a malware campaign, it's probably taking advantage of some bug in the software.
So there's some vulnerability that has been introduced in the software itself.
So next thing to consider is an exploit.
So what would an exploit be?
In the case of a window, you could throw a rock through it.
Well, you can also throw brick through it.
Or you could throw a crowbar through it.
Those are three different exploits exploiting the same underlying vulnerability that glass is breakable.
Now we have the same kind of thing that can happen on IT systems.
But the exploit in the case of a malware attack is going to be some code-- the malware itself
--that leverages the underlying vulnerability in, say, the operating system, or in an application.
So it's going to do some kind of nefarious activity, overriding memory or something like that.
So that's our exploit.
Then we've got a consideration of risk.
Risk is basically quantifying and looking at what is the issue here.
What's the likelihood that this thing will happen?
What's the cost if it in fact does happen?
What's the probability?
What's the frequency?
Those are the things that we consider in risk.
And we have that both in the bank example and we have that in the IT example.
And then ultimately we look at things like controls; or sometimes we call these countermeasures in security.
Now in the bank, we're going to look at certain types of controls that are specific to that environment.
Like we're going to put alarms on the bank, we're going to put cameras, we're going to put guards in the bank.
What are we going to do in the IT system?
Well, there's different kinds of controls that we can put in cases here.
So, in fact, these controls are of three different types.
One is a technical control.
An administrative control.
And a procedural control.
So a technical control would be examples of things like we say, we're going to patch all of our software.
We're going to put anti-virus on all of our systems.
We're going to use an endpoint detection and response system as well, or in lieu of antivirus.
We're going to put something like a backup system so that we can recover data if it's been compromised.
We're going to have things like user training so that users know not to click on links
and fall for phishing attacks and things like that and end up in fact infecting their systems.
We could have other things like a SIEM-- security information event management system.
--or an XDR-- extended detection response system --that's essentially like the alarm system
that's looking and allowing us to do investigation across the IT environment.
And then we would have something for incident response.
What are we going to do once we have the problem?
How do we respond to it?
And that's what we call a SOAR, in the IT example-- a security orchestration and automation and response platform
--that allows us to bring all of these things together.
So these are the things we have to consider, if we were securing a bank, or if we're securing an IT system.
And now that the money is not so much in the bank, it's in the IT system.
This is what we have to focus our efforts on.
Thanks for watching.
Please remember to like this video and subscribe to this channel so we can continue to bring you content that matters to you.