Imagine you’re attending a training conference at a company whose campus is so vast and sprawling that a map is required to get from one end to the other — whether by car or foot. The physical security on this campus is sparse, and Wi-Fi access is in every building. There are a handful of badge readers on the doors, but also underground tunnels, offices without door locks and a lack of security checkpoints.

You also spy agile design spaces with intellectual property scribbled on the walls, as well as hundreds of people during lunch hour. It seems as though just about anyone could walk onto this open campus, grab a coffee — and get in a little afternoon social engineering or, at the very least, eavesdropping.

While this open campus scene is not uncommon, it’s also where threat modeling (i.e., risk identification and prioritization) comes in to play.

Creative Threat Modeling Tips

With such a massive campus, how would a team of cybersecurity professionals secure it? Chief information security officers (CISOs) shouldn’t be afraid of an open campus. Threat modeling allows internal security teams to tailor security to areas that present the greatest security risk. Sometimes, all you need is a little creative thinking to improve your cybersecurity efforts.

• Revamp Wi-Fi: Segment Wi-Fi based on the individual buildings or by quadrant of the campus, and deploy identity and access management (IAM) in each building and for all mobile infrastructure. Provide guest Wi-Fi that runs on a set of private cloud-based servers — rather than on-premise or within the same data center server cluster on-premise.

• Smarten up entry and exit points: Implement a facial recognition and voice recognition software in all entry and exit points. This strategy does not mean the ultimate goal is to stop every employee as they go about their workday — or the delivery man who is always dropping off packages. A better solution would be to stop visitors or individuals who are rarely seen on campus.

• Rethink threat modeling: Perform threat modeling with a twist. Ask a team of security professionals from a security services company to walk around the campus for a week with a Raspberry Pi, a high-gain antenna or Metasploit running on a smartphone — or any of their other favorite hacker toys to see what the team finds. Use the results to build threat models for individual buildings and areas. This strategy allows internal security teams to tailor security to the areas of the campus that present the most significant security risk.
• Employ drones: Large, sprawling campuses that take up several acres or square miles could employ drones to patrol the perimeter. Of course, the drones and associated software will have to be properly secured before use to prevent them from being hacked. A solid alternative for any company not comfortable with this scenario is to use helicopter patrols or small low-altitude remote-controlled kit airplanes.

Incorporate AI to Perform Fluid Threat Modeling

Cybersecurity threats are changing continuously. So, security responses and practices should be fluid, dynamic and adaptive — not static and rigid as they have been for last two decades.

If companies have the money to spend (and want to be exceptionally forward-thinking), their research and development team could teach artificial intelligence (AI) the concept of fluid threat modeling. Any AI would have to be trained on a wide variety of scenarios by professionals who have experience with threat modeling scenarios, such as active shooters, hostage situations, hijacking, bomb threats and the like.

Facial recognition, for example, could be incorporated into daily physical security through the use of artificially intelligent robots that greet visitors, walk the halls and engage in short conversations with employees, patrol the parking decks, escort individuals walking alone at night and so forth.

This is not to suggest that robots should replace humans outright, only that they could augment security teams that are short-staffed, overwhelmed and cannot be everywhere at once. With the growing shortage of cybersecurity professionals, there may come a day when AI is the only viable alternative to no security at all.

All of this is highly theoretical and many years away, but it could help to grab a cup of coffee and start thinking about it now — especially as security professionals, scientists and mathematicians are making history and setting technology precedence in the field of AI and autonomous systems and neural networks.