1-1/29 Copyright © 2006 M. E. Kabay. All rights reserved. 08:15-09:00 INFORMATION WARFARE Part 1:...

INFORMATION WARFARE

Part 1: Fundamentals

Advanced Course in Engineering2006 Cyber Security Boot Camp

Air Force Research Laboratory Information Directorate, Rome, NY

M. E. Kabay, PhD, CISSP-ISSMPAssoc. Prof. Information Assurance

Program Direction, MSIA & BSIA Division of Business & Management, Norwich University

Northfield, Vermont mailto:mkabay@norwich.edu V: 802.479.7937

Topics

08:00-08:15 Introductions & Overview08:15-09:00 Fundamental Concepts09:05-10:25 INFOWAR Theory10:35-11:55 Case Histories & Scenarios

Part 1: Fundamental Concepts

Fundamental Elements of INFOSECSources of Damage to ITRisk CategoriesTaxonomy for Computer Incidents

Fundamental Elements of INFOSEC:

Protect the 6 atomic elements of information security (not just 3):

ConfidentialityPossession or controlIntegrityAuthenticityAvailabilityUtility

Confidentiality

Restricting access to dataProtecting against unauthorized disclosure of

existence of dataE.g., allowing industrial spy to deduce

nature of clientele by looking at directory names

Protecting against unauthorized disclosure of details of dataE.g., allowing 13-yr old girl to examine

HIV+ records in Florida clinic

Possession

Control over informationPreventing physical contact with data

E.g., case of thief who recorded ATM PINs by radio (but never looked at them)

Preventing copying or unauthorized use of intellectual propertyE.g., violations by software pirates

Integrity

Internal consistency, validity, fitness for useAvoiding physical corruption

E.g., database pointers trashed or data garbled

Avoiding logical corruptionE.g., inconsistencies between order header

total sale & sum of costs of details

Authenticity

Correspondence to intended meaningAvoiding nonsense

E.g., part number field actually contains cost

Avoiding fraudE.g., sender’s name on e-mail is changed

to someone else’s

Availability

Timely access to dataAvoid delays

E.g., prevent system crashes & arrange for recovery plans

Avoid inconvenienceE.g., prevent mislabelling of files

Utility

Usefulness for specific purposesAvoid conversion to less useful form

E.g., replacing dollar amounts by foreign currency equivalent

Prevent impenetrable codingE.g., employee encrypts source code and

"forgets" decryption key

Rough Guesses About Sources of Damage to IT

See CSH4 (Computer Security Handbook, 4th ed): Ch 4, “Studies and Surveys of Computer Crime.”Also http://www2.norwich.edu/mkabay/methodology/crime_stats_methods.htm

Risk Categories*

Physical Attempts to gain control (physical intrusion)

Electronic Attempts to gain control (malicious hacking)

Execution of Arbitrary Code (viruses, trojans, Active-x, Java, ...)

Spoofing (lying about who you are -- users, sites, devices)

Eavesdropping (sniffing, wiretapping of data, passwords ...)

________

* ICSA Risk Framework

Risk Categories (Cont’d)

Lack of Knowledge / Awareness (admin., users, outside errors)

Lack of Trust, Confidence (IT, users, disgruntled… )

Denial of service (down time: electronic DOS, disasters, reliable)

Exploitation of User by Site (privacy, swindles….)

Exploitation the data subject (privacy, confidentiality, non-user)

Lack of Interoperability

Taxonomy for Computer Security Incidents What is a Common Descriptive Language? What is a Taxonomy? Why a Language/Taxonomy for Computer Crime? The Model as a Whole Actions Targets Events Vulnerability Tool Unauthorized Result Objectives Attackers

What is a Common Descriptive Language?

Set of terms that experts agree on in a fieldClear definitions to the extent possible

PreciseUnambiguousEasy to determine in the field

A common language does not necessarily imply a causal or structural model

Provides means of communication among experts

Supports analysis

What is a Taxonomy?

Structure relating terms in the common language

Permits classification of phenomenaExpresses (a) model(s) of the underlying

phenomenaSupports hypothesis-buildingSupports collection and analysis of statistical

information

Why a Language/Taxonomy for Computer Crime?Field of information assurance growing

More peopleLess common experienceGrowing variability in meaning of terms

What’s wrong with ambiguous terminology?Can cause confusion – talking at cross-

purposesCan mislead investigators and othersWastes time in clarification time after timeInterferes with data-gatheringMakes comparisons and tests difficult or

impossible

The Model as a Whole(See full-page printout at end)

Actions

Probe / scanFloodAuthenticate / Bypass / SpoofRead / Copy / StealModify / Delete

Targets

Analyze the following real cases and identify the target(s) in the events:

A criminal inserts a Trojan Horse into a production system; it logs keystrokes

A criminal hacker defaces a Web pageAn attacker launches millions of

spurious packets addressed to a particular e-commerce server

The Morris Worm of November 1988 takes down 9,000 computers on the Internet

Events

An event consists of an action taken against a target

Analyze the following events in these terms:An 8-year-old kid examines all

the ports on a Web server to see if any are unprotected

A dishonest employee makes copies on a Zip disk of secret formulas for a new product

A saboteur cuts the cables linking a company network to the Internet

Vulnerability

Vulnerability = a weaknessDistinguish among vulnerabilities

due toDesignImplementationConfiguration

See National Vulnerability Database Thousands of vulnerabilities Classified by platform and version

National Vulnerability DBhttp://nvd.nist.gov/

Means of exploiting a vulnerabilityWidely available on InternetExchanged at hacker meetings

2600L0pht (defunct)

Discussed and demonstrated at black-hat and gray-hat conferencesDEFCON – Las VegasHACTIC – Netherlands

Many exploits usable by script kiddies and other poorly-trained hackers

Unauthorized Result

Many possible results; e.g., consider results of these attacks:

Someone installs a Remote Access Trojan called BO2K on a target system

An e-mail-enabled worm (e.g., KLEZ) sends a copy of a confidential document to 592 strangers

The Stacheldraht DDoS tool completely interdicts access to an e-commerce site

A secret program installed by an employee uses all the “excess” CPU cycles in a corporate network for prime-number calculations

Objectives

Characteristics of the human beings involved in the attack

Different objectives and define different labelsCriminal hackingIndustrial espionageIndustrial sabotageInformation warfare

AttackersWide range of attributesSubject of chapter 6 in CSH4

IdeologyGain

The Model as a Whole (again)

Resume at 09:05:03

1-1/29 Copyright © 2006 M. E. Kabay. All rights reserved. 08:15-09:00 INFORMATION WARFARE Part 1:...

Documents

Using Social Psychology to Implement Security Policies - ME Kabay

1 Copyright © 2012 M. E. Kabay. All rights reserved. Cyberstalking & Cyberbullying Our House Summit on Sexual Violence 2012-04-11 M. E. Kabay, PhD, CISSP-ISSMP

Network Centric Warfare, Cyber Warfare, & KSCO

Fernando C Gonzalez MScMESE(EW)Land Warfare Conference 2006 JOINT ELECTRONIC WARFARE OPERATIONAL SUPPORT UNIT PRISM - Air Defence From Training Aid to

Web-Based Vulnerabilities - M. E. Kabay Web Site Web-Based Vulnerabilities Author Michel E. Kabay Subject CSH5 Chapter 21 Created Date 10/5/2015 2:47:26 PM

The Irregular Warfare Roadmap (H.A.S.C. No. 109-85), 2006

1 Copyright © 2015 M. E. Kabay. All rights reserved. Introduction IS 342 – Management of Information Assurance Introduction to the Course M. E. Kabay,

Information Warfare Theory of Information Warfare

M. E. Kabay, PhD, CISSP-ISSMP · ON WRITING M. E. Kabay, PhD, ... when I started editing my professors’ and fellow graduate students’ articles. ... according the number of a verb

Yoshikawa Kabay GMR Background Paper on Global ECCE FINAL

1 Copyright © 2014 M. E. Kabay. All rights reserved. Backups CSH5 Chapter 57 Backups M. E. Kabay & Don Holden

1 Copyright © 2014 M. E. Kabay. All rights reserved. Introduction IS 340 – Information Assurance Lecture # 1 M. E. Kabay, PhD, CISSP-ISSMP Professor of

Antivirus Technology - M. E. Kabay...Title Antivirus Technology Author Michel E. Kabay, PhD, CISSP-ISSMP Subject CSH6 Chapter 41 Keywords Updated 2014-11-10 Created Date 11/18/2015

Unmanned Underwater Vehicles Library/Events/2006/seca/Carreiro... · Naval Undersea Warfare Center September 12, ... Naval Undersea Naval Undersea Warfare CenterWarfare Center

Chapter 10 Aggression and Warfare Lecia E. Wright Creighton University November 07 and 09, 2006

1 Copyright © 2010 M. E. Kabay. All rights reserved. Introduction IS 340 – Information Assurance Lecture # 1 M. E. Kabay, PhD, CISSP-ISSMP Assoc Prof Information

1 Copyright © 2010 M. E. Kabay. All rights reserved. Application Development IS240 – DBMS Lectures # 13a & 13b – 2010-04-19 & 21 M. E. Kabay, PhD, CISSP-ISSMP

1 Copyright © 2014 M. E. Kabay. All rights reserved. OPSEC & Production Controls CSH5 Chapter 47 “Operations Security and Production Controls” M. E. Kabay

FREE to all delegates atLand Warfare Conference2006 · PDF fileDEFENCE CAPABILITIES MAGAZINE September/October 2006 UAVs can one size fit all Land Warfare special edition Upgrading

On Writing - ME Kabay