SU+ @ Strathmore University Library Electronic Theses and Dissertations This work is availed for free and open access by Strathmore University Library. It has been accepted for digital distribution by an authorized administrator of SU+ @Strathmore University. For more information, please contact library@strathmore.edu 2021 A Blockchain-based prototype for cybersecurity threat intelligence sharing: a case of Kenyan banking and insurance financial institutions. Kibuci, Wanjohi Stephen Strathmore Institute of Computing and Engineering Sciences Strathmore University Recommended Citation Kibuci, W. S. (2021). A Blockchain-based prototype for cybersecurity threat intelligence sharing: A case of Kenyan banking and insurance financial institutions [Strathmore University]. http://hdl.handle.net/11071/13311 Follow this and additional works at: http://hdl.handle.net/11071/13311 https://su-plus.strathmore.edu/ https://su-plus.strathmore.edu/ http://hdl.handle.net/11071/2474 mailto:library@strathmore.edu https://su-plus.strathmore.edu/browse/author?value=Kibuci,%20Wanjohi%20Stephen http://hdl.handle.net/11071/13311 http://hdl.handle.net/11071/13311 A Blockchain-Based Prototype for Cybersecurity Threat Intelligence Sharing: A Case of Kenyan Banking and Insurance Financial Institutions ··.:-r·;···.-,., ! ; _.,. By Wanjohi Stephen Kibuci 124535 A Thesis Submitted to the School of Computing and Engineering Sciences in partial fulfillment of the requirements for the award of a Degree of Master of Science in Information Technology of Strathmore University Master of Science in Information Technology Strathmore University May 2021 Abstract Cybersecurity threats to financial institutions have become more sophisticated and challenging to deal with. The growing dependence of financial institutions on the cyberspace makes cybersecurity preparedness against threats important to achieve a financial institution's mission and vision. In this context, cybersecurity preparedness is the process in which a financial institution can protect against, prevent, mitigate, respond to and recover from cyber threats. Traditionally, most organizations share threat intelligence through ad hoc methods such as emails and phone calls but there is a need to automate threat intelligence sharing where possible to improve cybersecurity preparedness. To address this issue, enhance cybersecurity and trust, a blockchain-based approach can be employed to share threat intelligence. This study aims to leverage blockchain technology by developing a prototype to automate cybersecurity threat intelligence sharing in financial institutions. The study used a quantitative approach in data collection using structured online questionnaires with close-ended questions and open source datasets and data analysis using several analytic tools. The prototype has been developed using the Rapid Application Development software development methodology using open source Oracle Virtual Box that runs on Linux Operating System. p . ' . .: ! • . III Acknowledgments I am grateful to God for giving me the strength and wisdom to complete this study. I would like to express my gratitude and appreciation to my supervisor, Dr. Bernard Shibwabo for his timely guidance and constructive feedback from the start to the completion of this research. I would also like to acknowledge Dr. Vincent Omwenga for his input on the research through the thesis seminars. I would like to thank the respondents for their time and input to this study. v 2.2 Empirical Framework .. ...... ..... ... .... .............. .......... .. .... .. ..... .... ... ............. ... ..... ... ..... ......... . 6 2.3 Theoretical Framework ..................... ..... .... ... .. .. .. .... ... ... ........ .. .... ... ....... ...... .. .............. ..... 7 2.3 .I Cybersecurity Threats .. ..... ....... ....... ...................... .... .... .................. ....................... ... 7 2.3.1.1 Threat Modeling Approaches ...... ...... .. .............. ............... ...... ......... .................. 7 2.3.1.2 Threat Categorization and Classification .... .... .......... ...... ...... ..... .......... ........... .. 8 2.3 .1.3 Rating Threats ....... ... ..... ...... .... ... .. ................... .... .. .... ..... .. .... ....... ....... ... ..... .. ... ... 9 2.3.2 Cybersecurity Preparedness .. .. .. .... ... .......... ............... .......... ..... ... ... ............ ... ....... ..... 9 2.3 .3 Threat Intelligence ..... .. .. ..... ......... ........ .. ............ ... ..................... ...... ......................... 9 2.3.4 Blockchain Technology .............. ....... ........... ...................... ...... .... .. .... ... .............. ... 10 2.3.4.1 Blockchain Technology Standards ... .. ..... ... ... .. ... .. .. ................. .. .. ..... ............... 11 2.3.5 Laws and Regulations around Cybersecurity and Information Sharing in Kenya .. 12 2.3.5.1 Cyber Security and Protection Bill of2016 ........... ............ .............................. 12 2.3.5.2 Computer Misuse and Cybercrimes Act of2018 .... ................................ ... ..... 12 2.3.5 .3 Kenya Information and Communication Act (Amendment) Bill of2019 .... .. . 12 2.3 .5.4 Central Bank of Kenya Guidance Note on Cybersecurity of2017 ......... ....... . 13 2.3.5.5 Central Bank of Kenya Guidelines on Cybersecurity for Payment Service Providers of 2019 ......... ...... ............ ......... ...... ... ... ............................ ........ ... ... ..... .... ........... 13 2.3.5.6 Kenya National Cybersecurity Strategy (2014) ... ......... ........ ...... ...... .. ............. 13 2.4 Frameworks and Models .. ... .... ......... ...... ..... .................. .. ..... .. ............. ... ..... ... ........ .. .... .. 14 2.4.1 Cyber Prep Fra1nework ........... ....... .. ... .... ...... ...... .... ... .... ... ... ... .. .... ............. .. ... ........ 14 2.4.2 FFIEC Cybersecurity Assessment Tool.. ... .......... ................ ................................... 16 2.5 Blockchain Threat Intelligence Architectures and Designs .............. ... ......... .. .. ...... ....... 17 VII 3.3.2 User Design Phase .. ... ..... ... ............. ........ ... ..... .... ..... ... ..... .. .. .. ......... ...... ........ ... ....... 26 3.3.3 Construction Phase .. ... .................. ..... ... ... ... .. ... ...... ... ... ......... ... ... .... ... ... ..... .............. 27 3.3.4 Cutover phase .......................... .............. ...... ........ ..... .. .. ... ........................................ 27 3.4 Location of the study ......... ..... ... ...... ..... ... ... ... ............................ ........... ...... .. ........ ...... .... 27 3.5 Sa1npling Population ... .. ..... .. .......... .......... .. ..................... ... ...... ... .............. .......... ........... 28 3.6 Smnpling ......... .. ........... .... .. .. .. .. ... .... .... .... .... ....... .. ............. ............. ..... ........ .... .. .... ... ... ... . 28 3.7 Data Collection ............................................. ....... .. .......................... ....... ... ... .. ...... ...... .... 28 3.8 Data Analysis ......... ................................ .............. .. .............. ... ........ ......... .... .... ... ..... .. .... 29 3.9 Research Quality .. .. ... ... ............. .. ....... .... .......................... .... ................. ... ......... ... ....... ... 29 3.9.1 Reliability ...... .... ................ .................... ... .... .... ............. ..... .. ........... .. .... ........ ........ .. 29 3.9.2 Validity ........ ................ ... ... ... ........... ............................. ... ..... ..... ...... .. ... ........ .... ...... 29 3 .I 0 Ethical Considerations .......... ............ ........ ...... .... ........ ...... .. .... ....... .. ................... .. ..... . 30 3.11 Dissemination of Research Results .................... .... ........................................... ....... .. 30 3.12 Utilization of Research Results ........ .. ...... .... .. ...... .. .. ........................................ ...... .... 30 Chapter 4: System Analysis, Design and Architecture .................................... ..................... ... 31 4.1 Introduction .. .... .. .................................. .......... ...... .... .............. ............ .............. .. ....... .... . 31 4.2 Data Analysis .......... .............. .. ....... ............... ...... .............. .................. ....... ........... ...... ... 31 4.2.1 Response Rate .. ............... .... ...... ......... ............................... ......... ............................ . 31 4.2.2 Financial Institution Context Results ...................... ....................... .. .. .... ................. 32 4.2.3 Cyber Threat Awareness and Training Results ..................................... ................. 33 4.2.4 Tools and Data Collection Results .. ................. .......... ............................ .... ......... .... 35 4.2.5 Internal Process and Collaboration Results ............... ... ....... ...... ........ ........ ............. 36 IX 5.3.1.4 View Cyber Threat Intelligence ...................................................................... 66 5.3.2 Non-Functional Testing ........................ ...... ... ... ... ...... ... ..... ....... .. ... .. ............. .......... 67 5.3.2.1 Compatibility Testing .. .......................................................... ........................ .. 67 5.3.2.2 Interactive Testing ..... .... ........ ... ............. ........ ..... ............ ......... ... ............ .... ..... 67 Chapter 6: Discussions ............................................. .................................................................. 69 6.1 Introduction .. ......... ............... ........ ........... .... ..... ............ .. ........ .......... ... ........ ......... .... .. ... . 69 6.2 Review of the Research Objectives ............................................................. ... ................ 69 6.3 Systetn Assesstnent ............................................ ............... ... .......................................... 70 6.3.1 Advantages of the Prototype ................................................................................... 70 6.3.2 Limitations ofthe Prototype .......... ........... ........................................ ...................... 71 Chapter 7: Conclusion, Recommendations and Future Work ............................................... 72 7.1 Conclusion ................................................... .. ................................................................ . 72 7.2 Recommendations ... ........ ....... ...... ......... .. ....................... ... ..................... .... .... ...... .... ... .. . 72 7.3 Future Work .................................................... .................... ...................... .. ................... 72 References .................................................................................................................................... 74 Appendices ................................................................................................................. ; ................. 83 Appendix A: Cyber Threat Intelligence Assessment Questionnaire .. ......... ................. .. .... 83 Appendix B: Strathmore Ethical Clearance Letter .............. ...... ......................................... 91 Appendix C: National Commission for Science and Technology Innovation (NACOSTI) Research Permit ............... ..... ... ... ... .... .. ..................... .......... .......... ... .................. .. ..... ........ .. .... 92 Appendix D: Ouriginal Similarity Index ............. .... ............................................................. 94 XI List of Figures Figure 2.1: TAX II Sharing Mechanism ... ........... .... ...................................... ... ... .......................... I I Figure 2.2: FFIEC Five Domains and Assessment Factors ........................................... ... .... ...... .. I 7 Figure 2.3: TITAN Architecture ...... ....... ... ...... .... .... ... .................. ............ .. .. .. .............................. I8 Figure 2.4: CTI Network Architecture and Design ..... .......... ............... .... .... ... ... ............... .. .. ... .... I 9 Figure 2.5: Overview of Threat Intelligence Analysis System ...... ...... ... ..... ... .. ... .... ..................... 23 Figure 2.6: Proposed Conceptual Framework .... .......... ................. .... ... ..... ... ...... .. ... ... ... ..... .... ...... 24 Figure 3.1: Rapid Application Development Methodology ..... ... .... ... .... .. .......... ... ....................... 26 Figure 4. I: Respondent Response Rate ..... ... ....... ..... .. ............ .............................. ..... ...... ......... .... 31 Figure 4.2: Groups That Pose Potential Threats ... .... .. .......... .. ..... ......... .. .. ....... ...... ..... ....... ... ...... .. 32 Figure 4.3: Primary Cyber Threat Concerns .. .... .... ..... .. ....................... ............. .................. .......... 33 Figure 4.4: User Knowledge on Intrusion Attempts ..... .. ......... .. .. ...... .................... ... ....... ........... .. 34 Figure 4.5: Frequency of User Training on Cybersecurity Awareness ........................................ 34 Figure 4.6: Cybersecurity Tools and Sensors ........................ .......... .... .......... ........ .. .... .. .. ............. 35 Figure 4.7: Tracked ICT Assets ........ .. .. .. ... ... ...... ... .. ... .. ... .... ; .................... ...... ..... ......................... 36 Figure 4.8: Group Communication with Cybersecurity/ICT Team .... ... ............ .... ... .................... 37 Figure 4.9: Cybersecurity Functions of Financial Institution ........................... ...... .................. .. .. 37 Figure 4.10: Level of Communication and Cooperation between Cybersecurity Functions ... ... .. 38 Figure 4. I I : Trackers for Cyber Threat Indicators .................. .. .... ... ... ... .. ........... ........ .... ..... ... ..... 39 Figure 4.12: Details Collected on Cyber Threat Indicators ........ ... ........ ...... ... .............. ................ 39 Figure 4.13: Cyber Incident Data Collected by Financial Institution ............. ... ...... .... ... .............. 40 Figure 4.14: Sources of Potential Cyber Threats .... .................................. .. .. .... .... ... .... ................. 4I XIII Figure 5.12: Email Alert .... .. ...... ......... ..... ....... .. .. ..... ..... ....... .. .. ... ... ..... ... .. ... ... .. .... .. .. ...... .......... .. ... 66 Figure 5.13: Published Cyber Threat Incidents ... ... .. ..... .... ... ... ...... .. ......... ... ...... .......... .. .......... ..... 66 Figure 5.14: Unpublished Cyber Threat Incidents ...... .............................. ...... .......... .............. ...... 66 Figure 5.15: Hyper! edger Playground Page .. .. .. ..... ... .. ........ ............. .......... .. ... ..................... ....... .. 67 Figure 5.16: Interactive Test Page .. .. ....... .. ...... ...... .... ....... ........ ... ........ .. ... ....... ... ....... .... .... ... ........ 68 XV Definition of Terms Cyberattack - Any malicious attempt by a person, a group of people or even an institution to trespass the information systems of another person or institution. The adversary or attacker usually benefits from disrupting the victim's system or network in a monetary manner (Cisco, 2020). Cybersecurity - A best practice of the protection of information systems, networks and applications from cyberattacks that aimed at accessing, modifying or deleting sensitive information, interrupting normal business processes or extortion of money (Cisco, 2020). Cybersecurity Preparedness - The process that an institution or government ensures has it has developed, tested and verified its own ability to prevent, mitigate and recover from cybersecurity incidents (Lukin, 20 19). Cyber resilience - The ability of how apt an organization or financial institution can manage cyberattacks despite hostile cyber events (Bjorck et al., 2015). Threat Intelligence - The information of cyberattacks that have been received in computer systems and shared experiences in cyber security within organizations as a means to counter these threats (Wu et al., 2019). XVII issues . These financial institutions need establish cybersecurity best practices to protect their systems and infrastructure and redesign their information security approaches. Numerous organizations invest heavily in technology controls and defenses to prevent cyber risk but fail in assessment, transferring risk, planning for proper cyber response and other risk management areas that strengthen cybersecurity preparedness (Marsh and Microsoft, 20 19). According to the 2019 Global Cyber Risk Perception Survey (Marsh and Microsoft, 20 19), it was found that there was a significant decrease in confidence of companies and organizations in three critical areas of cybersecurity resilience. Survey participants that stated they had 'no confidence ' increased from 9% to 18% for cyber risk assessment, from I 2% to 19% for cyber threat prevention and from 15% to 22% for cyber event response and recovery. Using blockchain technology has been recently advocated by research communities and gained momentum in the financial services industry. Blockchain technology has the potential to bring technological breakthroughs in the financial industry in four areas in particular: infrastructure, platform, channel and scenario (Choi & Huang, 202 I). Blockchain provides infrastructure for sharing information in a secure way, automating registration processes and detecting fraudulent facilities. The cross interoperability of blockchain is imp011ant for facilitating it as a medium for exchange in the financial sector (Choi & Huang, 2021). Sharing of threat intelligence within organizations is being encouraged to have a broad perspective of the current cybersecurity posture and this in turn, increases and improves the levels of cyber preparedness and situational awareness (Wu eta!., 2019). 1.2 Problem Statement Financial institutions are dependent on the internet for their services and this dependence exposes new vulnerabilities in financial systems and malicious attempts to exploit vulnerabilities from attackers (Healey eta!. , 20I8). Healey's paper continues to state that cyber criminals, who target core financial infrastructure, can potentially spark a financial crisis if the financial systems are already fragile. Traditionally, sharing of threat information occurred through ad hoc methods such as email exchange, instant messaging clients, ticketing systems and phone calls where employees use these 2 1. To investigate the challenges in sharing cybersecurity information by financial institutions. 11. To analyze frameworks and approaches used for cybersecurity preparedness in financial institutions 111. To review existing platforms used for threat intelligence sharing IV. To develop a blockchain-based prototype for sharing threat intelligence m financial institutions v. To test the functionality of the developed prototype 1.4 Research Questions The research questions of the study are: 1. What are the challenges in sharing cybersecurity information in financial institutions? 11. What are the frameworks and approaches used for cybersecurity preparedness in financial institutions? 111. What are the existing platforms used for threat intelligence sharing? IV. How can a blockchain-based prototype for sharing threat intelligence in financial institutions be developed? v. How can the functionality of the prototype be tested? 1.5 Justification Financial institutions are generally reluctant when it comes to information sharing and avert sharing any information that is beyond their compliance with regulations. A decentralized approach can provide solutions in addressing this issue with the use of blockchain technology to be specific. Blockchain technology enables these institutions with information sharing through a shared distributed ledger in a secure manner thus providing distributed trust. Where two or more financial institutions have a memorandum of understanding to share threat intelligence amongst themselves, anonymity property of blockchain can deployed where the sender and receiver identities are unknown. 4 Chapter 2: Literature Review 2.1 Overview This chapter focuses on understanding the cyber threats that financial institutions face, how cybersecurity preparedness takes place and how threat intelligence works. It discusses different frameworks currently used for cybersecurity preparedness and how blockchain technology works. It focuses on identifying existing blockchain-based architectures and designs that will form basis to the development of a prototype for improving cybersecurity preparedness within a financial institution. 2.2 Empirical Framework The Communication Authority of Kenya (CAK) is responsible for sharing the latest statistics on the national cyber threat landscape. According to the Sector Statistics Report for the Financial Year 2020/21 (April-June 2021 ), there were 38,776,699 cyber threat attempts that were detected by the Kenya Computer Incident Response Team (KE-CIRT/CC). The cyber threats that are focused on are system vulnerabilities, different malware events, phishing attacks, botnets and web application attacks (Communication Authority of Kenya, 2021 ). There has been a 37.27% increase in the number of cyber threats detected from the previous period, January to March 2021 because cyber threats are continuously evolving at a faster speed than the development of cyber defenses. The KE-CIRT/CC has put in place initiatives and best practices that are aimed at ensuring financial institutions have enhanced cybersecurity preparedness and cyber resilience to ensure sustainability in the financial sector. Table 2.1 summarizes the detected cyber threats (Communication Authority of Kenya, 2021 ). Table 2.1: KE-CIRT/CC Cyber Threats Detected in Financial Year of2020/2021 Cyber Threat Apr- Jun 21 Jan- Mar 21 Variation(%) Mal ware 23053190 21559181 6.92 DDOS/Botnet 2564173 2890847 -11.30 Web App Attacks 11272402 3767588 199.19 System vulnerabilities 1886934 30203 6147.51 Total 38776699 28247819 37.27 6 understood before considering exposure of the system to cyber threats (Nweke & Wolthusen, 2020; Shostack, 2014; Stewart eta!., 2018). 2.3.1.2 Threat Categorization and Classification The STRIDE model, created by Microsoft, was developed with the aim of assisting information security engineers understand and classify all possible threats (Khan et a!., 20 17; Shevchenko et a!., 20 18; Stewart eta!., 20 18) STRIDE is an abbreviation for the following threats: 1. Spoofing- This is a cyberattack where successfully gaining access to a system is the main goal using false identity. It can be used against logical identification such as usernames, email addresses, IP and MAC addresses. ii. Tampering - This is any action that results to data manipulation or unauthorized changes, whether data is in transit or at rest. Tampering can alter static information or manipulate communications. These attacks violate data integrity and data availability. m. Repudiation- This is a situation where a user denies that they have performed systems actions or activities. Attackers can use attacks in repudiation to avoid taking responsibility for their actions and the attacks affect innocent users of the system who are blamed for security violations. tv. Information disclosure - This means distributing, revealing or disclosing of private/confidential data such as health information, employee identity information to external third parties or unauthorized entities. Information disclosure also includes privacy breaches and data leaks. v. Denial of service (DoS) - A cyberattack that involves the attacker or perpetrator exploits a vulnerability of the system to disrupt the authorized access to a resource, such as a website, temporarily or indefinitely. This can be done through traffic flooding or connection overloading. vt. Elevation of privilege- This is a cyberattack where an employee's account that has limited permissions and access rights becomes an account with a higher level of privilege and access. This can be achieved by exploiting or stealing the credentials of an account with more privileges such as an administrator account or application developer account. 8 Effective management of threat information had led to the creation and enhancement of threat intelligence platforms (TIPs). TIPs are cyber threat repositories that enable institutions to aggregate, assess and interpret intelligence from external sources. A TIP's ultimate objective is to disseminate threat intelligence that will be fixed into the organization for better decision making (ENISA, 20 19). 2.3.4 Blockchain Technology Blockchain technology is often referred to as a combination of technologies used in decentralized networks with the aim of achieving transparent, security and consistency by maintaining a digital ledger which consists of a series of transactions. Blockchain technology has a wide range of applications across different domains including information sharing (Ayoade et al., 20 18). According to Ayoade's study (2018), the following are blockchain characteristics: 1. Immutability: This is the ability of the digital ledger to remain unchangeable because the ledger records every transaction and subsequent blocks protect the transactions due to the nature of hash algorithms. u. Decentralization: Blockchain has consistent public digital ledger that replaces the central server. Blockchain uses distributed consensus algorithms and mechanisms to deliver a consensus view of the digital ledger among the users. HI. Anonymity: Users remain anonymous using generated addresses as they interact with the blockchain. The advantages of these addresses is that they are indirectly connected to identities of the real world and users can avoid exposing their identities by possessing many different generated addresses. IV. Transparency: Each transaction on the ledger is traceable to prior transactions thus the high level of transparency as the ledger becomes tamper proof during data storage. The first blockchain technology implementation that captured people's attention was Bitcoin (Nakamoto, 2008). Examples of popular blockchain technologies are Ethereum, which is a blockchain platform that allows creation of smart contracts on blockchain (Buterin, 2013), and Hyper! edger (20 18) created to advance cross-industry blockchain technologies. 10 All clients receive updated threat intelligence from the T AXIl server as long as they are subscribed to the server. These clients shift into servers, delivering their threat information to the TAXII server for threat intelligence sharing. This mechanism runs on the cloud. 2.3.5 Laws and Regulations around Cybersecurity and Information Sharing in Kenya 2.3.5.1 Cyber Security and Protection Bill of2016 The Cyber Security and Protection Bill was published in July 2016. The bill proposes to reinforce the law on cybercrimes and to establish the National Cyber Security Response Unit, a Kenyan governmental agency that has the authority to investigate cyberattack incidents and prosecute cyber criminals. There are specific cybercrime acts such as such as phishing and cybersquatting that the Bill legislates. In addition, the Bill creates an obligation on all computer and information system users to report all incidents of cyberattacks and intrusions to the Unit (Kenyan Gazette, 2016). 2.3.5.2 Computer Misuse and Cybercrimes Act of2018 The Computer Misuse and Cybercrimes Act was enacted in May 2018 and aims to protect the confidentiality, integrity and availability of computer systems, applications and data as well as facilitate the prevention, detection, investigation, prosecution and punishment of cybercrimes. Some of the cybercrimes that the Act has established including unauthorized interference or interception of computer systems, cybersquatting, identity theft, computer forgery, fraud and unauthorized disclosure of passwords (Kenya Gazette, 20 18). 2.3.5.3 Kenya Information and Communication Act (Amendment) Bill of 2019 The Kenya Information and Communication Act (KICA) is a law that was first passed in 1998, amended in 2013 and amended again in 2019. The Communications Authority of Kenya (CAK) is responsible for licensing and regulation of information and communication services in accordance to the provisions of KICA. According to the Act, some of the functions of CAK are to develop frameworks for investing and prosecuting cybercrimes, facilitate and promote cybersecurity practices in electronic transactions by ensuring reliability in those electronic records (Kenya Gazette, 20 19). 12 2.4 Frameworks and Models 2.4.1 Cyber Prep Framework Badeau et a!. (20 I 0) developed a cybersecurity preparedness framework called Cyber Prep that uses a structured approach that addresses an organization's threats by facilitating cyber security strategic planning and determining the cyber preparedness levels necessary to ensure the success ofthe organization. The five levels in the framework for organizational preparedness that are labelled as per the cyberattack's nature and rigidity or as per the attacker, plus possible strategies for cyber preparedness that can counter against such threats. Cyber Prep levels are categorized in terms of the organization's view to the cyber threats it faces, the strategy of the organization for countering the cyber threats and how the organization approaches governance of information security. Table 2.1 summarizes the cyber threats and their preparedness levels (Badeau et a!., 201 0) Table 2.2: Cyber Threat and Preparedness Levels (Badeau et al., 201 0) Level Cyber Threat Level Cyber Preparedness Level 1 Cyber Vandalism Perimeter Defense 2 Cyber Theft or Cyber Crime Critical Information Protection 3 Cyber Incursion or Cyber Surveillance Responsive Awareness 4 Cyber Sabotage or Espionage Architectural Resilience 5 Cyber Conflict or Warfare Pervasive Agility Each Cyber Prep level has its own descriptions and its characteristics that it is associated with such as adversaries or attackers, defensive schemes and the techniques as summarized in Table 2.2. It is very crucial for senior management and the board of directors to understand the issues of cybersecurity preparedness and they need to be committed to improving the posture of cybersecurity ofthe organization because the progress from one level ofCyber Prep framework to the next will be inconsistent and incomplete. 14 2.4.2 FFIEC Cybersecurity Assessment Tool The Federal Financial Institutions Examination Council (FFIEC) is a United States of America governmental body that consists of five banking regulators. FFIEC promote uniformity in principles and standards in the supervision of financial institutions. The FFIEC developed a diagnostic Cybersecurity Assessment Tool (CAT) that assists companies and financial institutions to identify their risk levels using risk profiles and assess the levels of their cybersecurity maturity (FFIEC, 20 17). The FFIEC's tool uses practices and processes to measure risk levels across several categories that include factors such as the institution's characteristics. The FFIEC tool allows senior management to make strategic decisions that are risk driven by using standard and selected risk assessment criteria through regular cybersecurity assessments (FFIEC, 2017). The FFIEC' s Cybersecurity Assessment Tool (20 17) has two pm1s: 1. Inherent Risk Profile - Performed to determine an organization's current cybersecurity risk posture by identifying activities and services ofthe organization. 11. Cybersecurity Maturity Assessment Level - After the inherent risk profile, the maturity level identifies the cybersecurity preparedness level of an organization by reviewing each domain and their assessment factors. The five domains are explained below and illustrated on Figure 2.2: a) Cyber Risk Management and Oversight: This domain addresses oversight on the board of directors in reference to strategies, policies and procedures, organization culture and training. b) Threat Intelligence and Collaboration: This domain involves the management team grading the institution in reference to threat intelligence, analysis and relevant stakeholders that promote the sharing of cyber threat information. c) Cybersecurity Controls : This domain involves the assessment of detective, preventive and corrective controls. d) External Dependency Management: This domain delves into establishing programs to oversee and manage third parties and other external connections that have organizational access to technology assets and information. 16 Tl Sharing g:---1 Layer . .o.n-r--L_l{f;"--! ~[=I ~-:J . ~--, . '-~ -~t--·-~ 11.:.::.J Lk· -- il Repulalion Layer Reputation Tl Oualily Syslem Assessment ~5 Trusled Trusted Execut1on Bloc.t') 28.57% Figure 4.2: Groups That Pose Potential Threats 32 85.71% 85.71% 85.71% Q16 Most users are knowledgeable about detecting intrusion attempts. f·lot Sure Stronglr dingree Di!lagr ee I·Jeucra{ Agre e Strongl;· agre 14.29% 42.86% 28.57% 14.29% Figure 4.4: User Knowledge on Intrusion Attempts Figure 4.5 shows that 42.86% of the respondents provide continuous and ongoing training on cybersecurity awareness while 28.57% provide training in response to specific cyber threats occurring. Another 28.57% of respondents offer training at least once annually. Q17 How often does the financial institution provide any user training on cybersecurity awareness? Training ic never provided Training l!l offered at ... Train ingi:~ required at ... 28.57% 28.57% 42.86% Figure 4.5: Frequency of User Training on Cybersecurity Awareness 34 Q23 In terms of ICT asset management, what ICT assets are tracked? (Check all that apply) Limited I~~~ a!:~et trackln~~i.! End·u~e aoocts ({apt. r>-oo......., _ _........, __ """"......,-""'--"'....._.. r·.~obite de'.'iCe !l (mobile phon ... Busine~:: Commo 42.86% 71.43% infra~tructu . ..._ ______________ __. Oth er (p l ea~e .specify) Figure 4.7: Tracked ICT Assets 4.2.5 Internal Process and Collaboration Results 85.71%1 95.71% Figure 4.8 illustrates that all the respondents stated that there is regular communication between the cybersecurity/ICT team and the senior management on cybersecurity while 85.71% of the respondents stated cybersecurity/ICT team have departmental communication. 57.14% of respondents stated that it takes 1 to 4 hours for the cybersecurity or ICT team to alert the financial institution to a significant threat. 36 In terms of level of communication and cooperation, 57.14% of the respondents stated that cyber threat intelligence and cyber tool tuning are well integrated in their institutions as illustrated in Figure 4.1 0. Q33 Please state the level of communication and cooperation between each pair of cybersecurity functions. "Low" indicates they do not interact; "Medium" means there is ad hoc communication meaning occasionally; "High" means the cybersecurity functions are well integrated. IOClb ?1 .43% 71 .43 % 57.14% G0\0 42.86% 4 2.86% 28.571'/o 28.57% 28 .57.% 14.29%14.29% 20~0 C=\·:, C~· bersec u ri t ~· Incident f··~a l ware l•~alware C~·b er Threat team and ICT Res ponse an d Anal ~· s is and Analysis and In te ll igence Team Tuning and Tu ning ar1 d C~· b er Threat and Tun ing Cunr omi:::at. .. Customiz:ac ... Intelligence and ... Hlgl1 Nor Applicable Figure 4.10: Level of Communication and Cooperation between Cybersecurity Functions 4.2.6 Tracking and Analysis Results In tracking of the cyber threats, 57.14% of the respondents use databases to track their cyber threat indicators. Another 28.57% use spreadsheets and 14.17% use an internet portal as shown in Figure 4.11. The types of indicators collected include domain names which I 00% of the respondents collect and email addresses and Uniform Resource Locators (URLs) which 85.71% of respondents collect. Figure 4.12 illustrates the incidental details that are collected by the indicators and 100% of respondents collect the date the cyber incident was added . Other cyber threat indicators include sources of the cyber threats and actions taken to those threats where 85.71% of respondents track them. 38 Figure 4.13 shows the cyberattack or incident data that is collected. The most collected data are affected assets and how the attack was stopped if it was prevented. Data also collected was number of cyber threat incidents . Q42 What cyberattacklincident data does the financial institution collect? (Check all that apply) Number of~~~~'fT:~~~'r:0~~~~ inc idents r:.;,;~-""""........,"""""""'""'='~""'*""""""""""....,.=:..:1 How attack v:a :; t opped, if .. ,_ _ _.........,._.........._=""........, ...... -. ....... _ ...... ___ __, Det ect ion metho d Whethe ~Vhethe r user(s) cl ic ... Ot her (pleaoe apeci fi') 42.86% 57.14% 85.71 % 85.71% o:~,:, 10% 20~'o 30% 40~0 SO% GO % 70',() 80% 90% 1C O% Figure 4.13 : Cyber Incident Data Collected by Financial Institution 4.2.7 External Engagement Results The main sources of potential cyber threats are the internet and the users who report on suspicious activity with 100% of respondents selecting them as seen in Figure 4.14. Other sources of information on cyber threats include social media with 85.71%, government and law enforcement, vendor reports and threat sharing peers with 71.43%. Only 57.14% ofthe respondents stated that the information comes from the regulator, either CBK or IRA. Figure 4.15 shows the mechanisms used to share threat intelligence. All the respondents use private communications to share threats and 71.43% of the respondents also use email distribution lists and face-to-face meetings. 40 Figure 4.16 shows the reasons why these financial institutions participate in threat sharing. The main reason was to protect their customers with 1 00% of the respondents stating so. Other reasons include improving the institution's cybersecurity posture and learn the best cybersecurity practices with 85.71% of the respondents of the selection. Q51 Wllat are/would be your financial institution's reasons for participating in threat sharing groups? (Check all that apply) pr:tcti ceo Share and pool Training ~~~~~~~~~ Other (plea!;e opecify) B5.?P/c 85.71 1%, 57.14 % 57.14% o~k 10% 20% 3m·o 4C ~ o s o~;, so% 7m .. ~ BC% 90% 10m·o Figure 4.16: Reasons for Participating in Cyber Threat Sharing When asked what factors limit the respondents from sharing threat intelligence with other institutions, 85.71% of them stated level of trust while 71.43% stated competition and lack of sharing agreements as illustrated in Figure 4.17. 42 4.3.2 Functional Requirements Functional requirements are those that the prototype must be able to accomplish in terms of input fed to it (Cossentino et al., 2014). The functional requirements for blockchain prototype include: 1. Allow the blockchain network administrator to register, edit and delete users of the prototype. 11. Allow the blockchain network administrator to grant, deny or revoke user access and permissions to the prototype. 111. Registered users should be able to log into the prototype. IV. The prototype should allow users to input cyber threat data from the user interface after a cyber threat incident. v. Allow authorized users to share threat intelligence to the other authorized users. VI. The prototype should be able to send alerts on cyber threats via email. VII. Allow authorized users to view all cyber threat intelligence in the system. 4.3.3 Non-Functional Requirements Non-functional requirements are those global constraints offered by a system and do not directly affect how the system works successfully (Cossentino et al., 2014). The non-functional requirements for blockchain prototype include: 1. Performance - The prototype should have a fast response time that is desirable to the users n. Reliability - The prototype should be available to users and maintain zero to minimal downtime 111. Security- Due to the nature of threat information being shared by the financial institution, only authorized users should have access to maintain confidentiality and integrity IV. Usability- The prototype should be easy to use for users v. Scalability- The prototype should be designed that more modules can be added easily vi. Compatibility - The prototype should be accessed through many different operating systems 44 b. Peers: Two peers, one of them anchor, are deployed for each organization in the network. Anchor peers are discoverable by Orderer and peers in different organizations through gossip data dissemination protocol. They receive updates and broadcast them to the other peers in their organization. In the setup, anchor peers are also endorsing peers which execute transaction proposals. c. Certificate Authorities (CA): They carry out the task of distributing the certificates to network participants. Then these certificates are used to authenticate members. A Fabric CA server instance is being run by each organization in the blockchain network. Each CA server issue certificates with previously generated cryptographic materials. Fabric has also the ability to interoperate with real certificate authorities in real-world deployments. d. CouchDBs: In order to store ledger state, there are two options: Leve!DB and CouchDB. In the blockchain network, the CouchDB is used as state database and a CouchDB instance is running for every peer. e. Chaincode: After the instantiation of installed chaincodes, these components are activated and chaincode runs in this isolated environment. f. API: Available Fabric SDKs allow client applications to connect with the blockchain network. SDK developed for Node.js is used in the prototype. g. Channel: The channel maintains the confidentiality and privacy of the chaincode and the ledger by giving authorization only to the authentic channel participants. A peer connected to one channel cannot access to the ledger and the chaincode of another channel of which peer is not a participant. v. Client: The client application is utilized to interact with the blockchain network by using RESTful APis which provide the CTI sharing service to the organizational user. VI. HTTP Server: HTTP server receives request from organizational entities. As a first step, the HTTP server needs to be connected to the CA server for admin identity enrollment and for user registration using the admin identity. Second, the registered user specifies the unique channel name and smart contract name using Fabric Node.js SDK and initiates the particular smart contract on the desired channel. 46 4.5.1 Use Case Diagram Use case diagrams are created during early phases of software development. They are important for validating and documenting the system behavior and act as a contract between the developer and the system users (Sabharwal et a!., 20 17). The use case diagram is shown on Figure 4.19. Blockchain N~to~.u rk A dmini~ r.Jt o r us~ r BLOCK CHAIN CYBER THREAT INTELLIGENCE SHARING SYSTEM .e ', .. ~ « Include» • << Incl ude>>· ,~ ~ Figure 4.19: Use Case Diagram CiSO or He>d ofiCT The descriptions of the main use cases are summarized and explained in Table 4.1. Table 4.1: Prototype Use Case Descriptions Use Case Name login Description The actors log into the system 48 Post condition Access is granted to the users to input, view or share cyber threat intelligence Main Success Scenario For granting user access I. Blockchain Network Administrator v1ews access request from user ii. Blockchain Network Administrator grants the user access to view or share the cyber threat intelligence iii. System sends user a message that access has been successfully granted Use Case Name inputCTI Description Users input cyber threat intelligence into the system Primary Actor User Precondition The user has to be granted permission to input the data Post condition Data has been posted successfully in the system Main Success Scenario Data has been recorded and stored in the database Use Case Name shareCTI Description User shares cyber threat intelligence with other users Primary Actor User Precondition The user must be granted permission to share cyber threat intelligence with other users by the Blockchain Network Administrator Post condition Authorized users receive the cyber threat intelligence Main Success Scenario Cyber threat intelligence is shared to users Use Case Name viewCTI 50 Use Case Name recordDataRequests Description The Blockchain Network records all data requests in the prototype Primary Actor Blockchain Network Precondition None Post condition All data requests from the users will be recorded by the Blockchain Network Main Success Scenario The Blockchain Network will automatically record all data requests in a ledger Use Case Name recordAccessReq uests Description The Blockchain Network records all access requests in the system Primary Actor Blockchain Network Precondition None Post condition All access requests from the users will be recorded by the Blockchain Network Main Success Scenario The Blockchain Network will automatically record all data requests in a ledger Use Case Name storeCTI Description The database stores all previously shared cyber threat intelligence in the prototype Primary Actor Database Administrator Precondition None 52 * * w Blockchain NetiMlrk I Data 1 base I I Blocl :o..:.: r D~: r ro~: ric~: l lr:: :. r.: l r11 n.a<2 I'- Figure 5.8: Input CTI Details Once the CTI User inputs the CTI, the incident remains unpublished on Figure 5.9. During this time, the CTI Users can edit and confirm that the details are correct because once the CTI has been published, they cannot edit the details on the ledger. 9 ;_ ·;:~· .-. o.o.c.o ;·, ··· e o U\ CD u.,' - My Unpublished Cyber Tll renllncidenls LD o~t~ Ol l nc O:lr ~• sr~rut ! Thrur l~vcl ·.- .. . O;t.\rt OnS i o!"-\;joc!l\',"( t)f.('\tf •• · 1 t.'£ 0 1'J'.I Figure 5.9: Created and unpublished CTI 64 New submission- CTI EXternot Formspilrk NotificCJtlons ~not l f l cilllon s@ foJrn:;paJ:O. . io> \0/ll{' ... New submission: nome: "eli" l hu. message: '1n Description: DoS Attack on Web Server that was blocking pons 80 and 443
ln Threat level: MEDIUM
ln Critical Systems/Infrastructure Affected: Web Server, lnsilulion's Website ln Course Of Action: Use of replicated web server, Implemented an additional web application firewall ln Lessons Learnt: Defense-in-depth is essential for the institution's security
\n" email: "clialert@gmail.com" View in FormsP-ark Figure 5.12: Email Aleti 5.3.1.4 View Cyber Threat Intelligence CTI Users can view their published and unpublished cyber incidents by selecting the dropdown menu on the CTI Tab as demonstrated on Figures 5.13 and 5.14. <- + . ~· . ,' ) 1. • '• I • ~' • • . ,· .. . 8 , ... ',! ; Uq:~L :~11'\l C I I~ •·.: •,:(. ! : : r Thre11 1 Inciden ts 10 o~: .. Ol lnc i:Jrnl Cll 0.. !"1~ Act:onhh n ' leuon1 Lt'.Unl I rh ; ;;s:'t11 H·ltv N.! 1 L\;::; ,\ ~o\:.lo.f"1Wrt~ $t-, ..-. ~ .. ~; ~C~ t . l 0000 :.'.' tr~tl-:.\:4-.., <;~ ~'T'!"r.,_.., 1..\' -" ~" 1.:< p~ • ..::..; : •, Lr• r.:"Af1 ~t.'rc-r~:>' :e:; ' ~· /'~.:.11 ..-.. n:~v :-tr: :r.l b'~;: l.'b.:.!4': ~·!~ Figure 5.13: Published Cyber Threat Incidents ... s ;.":- My Unpublished Cyber Threat Incidents tO o, :~ Ollncict:fll CTIOct, lls 1.1.\y~~- X'21 5tlhll l Tt:r~ ;~! le ~cl ·· , .· OrtM1' ' t · .• I.'EDI'J'.! Figure 5.14: Unpublished Cyber Threat Incidents 66 "' [!) !:l•lu ~ t lhlnllenl P~iiLI::.I ti: O . , , , l.' i: Ott.:M .• I'UULI9 1[0 • ~ . • j::(,!l IJ\ (D . ~ " Q On the Hyperledger Playground page, the interactive testing can be done on the created business network which in this case is the 'cyberthreat-network ' . Figure 5.16 shows the Test page for the 'cyberthreat-network' where tests where done on creating a user, creating an asset and submitting a transaction. Table 5.3 summarizes the interactive test scenarios. Test ID 1 2 3 <- C' Gl Cylarlllru tln:ll!tm Table 5.3: Interactive Test Scenarios Interactive Test Expected Outcome Comment Creating a user CTIUser created successfully Pass Creating an asset CyberThreatlncident created Pass successfully Submitting a shareCTI was successful Pass transaction + :"- ' ~' ; -,,I ',. , ' ' ' ', <'t • • "" "-,, i¥,. 0 '"': ' <' 1 ' PJrtiC• fD rri ro::g• str'} ior ar~.ex .-. rnp !e cyber tlrrNI IJ('i\'IOri;,(TIUsr.or 10 'lthn · : · o•t: - • · ~·pt ~ . C)ht:~•u:r ... t~·=•~ .( t :t\H' . ·cr::d·:·:·. 'lt•H'.a·~· , 'loti', · tnt:n ~ .. -- ·uu•·, ·n.ll~-: '1-'\"f '""' ·';~· '11\ .o ~ · · : · ~ · ? -~ • .. ·pi t'. ttl • • l ~ o U" .;> lvJti i.': 0(JJ 1 owu:an·/!021 ; . . I • . , . I . I . I _ J. . · Ti1is iS lo C!crri'ry tlml Mr .. Sh:jilu:n Wotnjuhi 1jf Strnlhmorc Uni\·crsity.'lui.-.lu.:cn liCctiSl-d to cuniluct r<.;sl·arda in Nairuhi on I he .tf~lljc : r A IJifl'\}\clmin ~ll;r~c$1 Pro1!1typc: ror C~· lu;r-sccudly Thn•:ll lnlclli~cnc:,c SJ1arin~ inJ\en)':m Fi11:mJ:ialln!iililulions f{lr the . : . period cndinJ.! : O(JJ:uumQ'/2022. - J • • • l .. I tl ••. · ' •• • • •• •• - I .' . . 1. - . I I oi ·I :_: __ J. •• ! .. . I , j ' , ' . l , t !, I , j_ ' • I __ ,_, _) __ _ ' I . - ! : ' . . : . . ! - :_: __ )_,_ ! __ '• I r License: No: N.\COSTUP(!I/HJU-' , .J .• ·,\ppl it.::•••t J~,J..:ntifidtiOia 'Nut"aibcr I -- - -- - -- - - · _ __ 1. --'- '· ' ..' • • 1. - 1 .1 • .• . ' '· ··'--•-- '; '- · i __ , __ i __ I , [ 1 11 I I NOTI:: This i ~ :1 ClllliJllllcr !;COCf:llctl License. Tn vcrif}' the :unhcnticity nr this dnc: umc:: nt. ' ' 1 1 11 • • St.·an th..: QR CI..Kh.~ usin:;1QR sc:aui1~r :tpplil:ation. ' 1 1 ' I I ' I I ,j __ __ !_ 92 · · Dir\:cttir Gcw.!r.1l 1 NATION,\LCOM~IISSJON FOR , .SCIENCE.TECHNOLO\}Y &. INNOVATION . .. I . .... .... I Vcrific;lliun QR Cudc . I .I. Appendix D: Ouriginal Similarity Index 0 Document Information Analyzed document A Blocl 0 WARNINGS --· VIEW THE ENTIRE DOCUMENT • ' ·- l .r lm Jltctn.Jtivc :;curcc rs u source whctc we found u text match thiH is iclfmtica! to the included :::Olrrc~s However. we found the co,esponding matching text in more than one source and Wi! beli@ve it's LEARN MORE SIMILARITY 16% receivers" avcr<~gc 6% This document 94 SUBMISSION DETAILS suor.11n£n \ V a njohi. S I !!phcn@ st r a thrn or c .('d u mr: AB!ockchyjo- Oas"d proto!~~~~ J.!tl!illi~gACW'QfK,.n~9-il!l11 l.!:mlrunra'fi!Tmcja! lnstilr ltjom ru..!1 202J·l0·10Tl0:27:00 SU!l/.'.IS~IOIIID 115572616 \'/ORO'i 19737 1·\ESS/,G[