# Presentation: 367115

## The West Point Carronade: 

- The West Point Carronade:
- Up Close and Personal

- Aaron J. Ferguson, Ph.D., CISSP
- National Security Agency Visiting Professor
- Department of Electrical Engineering & Computer Science
- United States Military Academy

- 23 March 2005
- Federal Information Systems
- Security Educators Association
- Bethesda, MD

**Notes:**
Department of Defense transformation includes "new combinations of concepts, capabilities, people, and organizations“.

Your Army is transforming to meet the very real challenges of the 21st century.

 It is critical that everyone understands the challenges that your Army faces today and how we are changing to meet those challenges .  

 We are transforming to a Campaign Quality Army with a Joint and Expeditionary Capabilities. 

## Agenda

- What is a Carronade?
- Why West Point?
- Carronade Non-Technical Design Considerations
- Carronade Technical Design Considerations
- West Point Stakeholder Buy-in
- Deployments
- Carronade 1 – The Crawl
- Carronade 2 – The Walk
- Carronade 3 – The Run
- Implementation in Other Academic Environments
- Implications for Training, Teaching, and Learning (TTL)

## What is a Carronade?

- The Carronade was a Navy cannon used in the early 1770s.
- The inventors, Charles Gascoigne, LTG Robert Melville, and Patrick Miller, designed the cannon in 1759 while working at the Carron Iron Works Company on the Carron River in Stirlingshire, Scotland.
- The Carronade, although possessing limited range, was destructive at close quarters (less than 0.6 miles).

## The West Point Carronade

- While the email had the potential to be destructive, the intent was to get the attention of cadets, not to cause damage to the Academy network or to penalize the cadets.
- The exercise was short range--conducted _inside_ the USMA security perimeter--only cadets with a *usma.edu* domain name could launch the embedded link.

## Why West Point?

- West Point is perhaps the only service academy with a Computer Emergency Response Team (USMA CERT) that has membership that includes academic faculty and staff
- The United States Military Academy was the first undergraduate institution to be certified (since Spring 2000) by the National Security Agency (NSA) as a Center of Academic Excellence in Information Assurance Education (CAEIAE).
- West Point is currently the only service academy with this certification. The CAEIAE certification establishes West Point as a proactive institution of higher learning in the area of Information Assurance.

## “Phishing” Variants

- Embedded Link
- Attachment

## Carronade Non-Technical Design Considerations

- Randomness
- Social Engineering
- Timing
- “High-Beam Effect”
- Human Subject Research

**Notes:**
Leadership starts with the person. What is your character? Do you know what the right thing is? Do you always do the right thing?

## Carronade Technical Design Considerations

- Open Source Products
- Tomcat from Apache as the Web App Container
- serves up both static HTML pages and dynamic Java Server Pages (JSP)
- Hibernate - Object-relational mapping solution
- Class Diagrams
- Java Bean Standards

**Notes:**
Leadership starts with the person. What is your character? Do you know what the right thing is? Do you always do the right thing?

## High-Level Architecture

## Stakeholder Buy-In

-  West Point seeks to accomplish two primary goals:
-  Balance the information technology needs of cadets, staff and faculty with the need to maintain a secure and robust network.
-  Provide a forum that would foster development of educated leaders who understand information security.
-    These two goals were accomplished by establishing a USMA-level “community of practice” called the USMA Computer Emergency Response Team (USMA CERT).

**Notes:**
If you hold a position of authority, you also have an obligation to do all you can to create an environment in which others can succeed. 
Some behaviors don’t belong within a group if working in a professional atmosphere. Namely, Vulgarity, inappropriate humor, etc..   
Never underestimate any individual’s capabilities. Use an individual’s accomplishments rather than his/her failures to weigh his/her potential.[1]
[1] Holtz p. 157

## Stakeholder Buy-In

- “Gotcha”
- Information Security Officer Ownership
-  Incentives and/or recognition to cadets practicing good email security

## Carronade I – The Crawl

- Four regiments  (1 through 4) with each regiment comprised of eight companies (A through H). Each company has approximately 130 cadets.
- The goal of the Carronade was to obtain results down to the company level.
- Within each of the eight companies in each of the four regiments, four cadets were randomly selected from each class (i.e., four freshman, four sophomores, four juniors, and four seniors) for a total of 512 cadets out of a total of approximately 4200 cadets (about 12% of the Corps of Cadets).

## Carronade I – The Crawl

- Because this was a proof-of-concept with a small sample size (512), extrapolating the results to the general population is ambitious at best.
- Approximately 80% (over 400) of the cadets selected clicked on the embedded link.
- Even with four hours of computer security instruction, 90% of the freshmen still clicked on the embedded link.

## Carronade I – The Crawl

- Feedback from the cadets that clicked on the embedded link included comments, such as*:*
*“**The email looked suspicious but it was from an Army colonel, so I figured it must be legitimate”* and *“Any email that contains the word “grade” in it gets my immediate attention and action!”*

## Carronade II – The Walk

*There were 4155 persons in the student body minus the 37 ISOs there were 4118 persons that could potentially receive the email.*
*Approximately 1010 embedded link emails were sent out. *
*Approximately 1014 attachment emails were sent out. *
* **Approximately 999 sensitive information emails were sent out.*

## Carronade II – The Walk

*More Stats*

## Carronade III – The Run

*More Stats*

## Implementation in Other Academic Environments

- How Can It Work At My School?

## Implications for Training, Teaching, and Learning (TTL)

- Educational Value Added
- Training Value Added

## Summary

**Summary**

- Traditional classroom instruction model is necessary but not sufficient when it comes to learning.
- Students have to touch, feel, and experience (“Close and Personal” the content in order to learn.
- Goal of any security awareness exercise should be to make security an attitude within the organization, campus, or university.

**Notes:**
 As always, the soldier is the centerpiece of what we are doing.
 They are the face of the United States overseas.
 Most effective, flexible and adaptable asset we possess.
 Rapidly re-tasked from combat to stability operations to homeland defense.
 Best sensor – receives & processes information better than any technology.
 Everything is designed to support the soldier.
 GEN Schoomaker has made it clear that everything is on the table for debate – except our values.  And nothing symbolizes our values better than the American Soldier. 

**QUESTIONS?**

## Embedded Link

**From: sr1770@usma.edu [mailto:sr1770@usma.edu] ****Sent: Thursday, February 17, 2005 11:49 AM****To: Cobb, M. MAJ EECS****Subject: Grade Report Problem**
- There was a problem with your last grade report. You need to do two things:Select this link _Grade Report_ and follow the instructions to make sure that your information is correct; andReport any problems to me.Robert DanteCOL, USCCsr1770@usma.eduOlmstead Hall, 7th Floor, Room 7206** **

**Next Slide**

## Embedded Link

**From:** sr1770@usma.edu [mailto:sr1770@usma.edu] **Sent:** Tuesday, February 15, 2005 8:01 AM**To:** Cobb, M. MAJ EECS**Subject:** Account Adminstration Error!
- Our records do not show an account verification word associated with your account. This will allow you to access your account in the event you forget your password. You need to do two things:Select this link Update Account and follow the instructions to make sure that your information is correct; and Report any problems to me.Charles LidelLTC, AVSecurity Administration and Network Support Branch sr1770@usma.eduOlmstead Hall, 7th Floor, Room 7206** **

## Attachment

**From:** sr1770@usma.edu [mailto:sr1770@usma.edu] **Sent:** Tuesday, February 15, 2005 11:03 AM**To:** Cobb, M. MAJ EECS**Subject:** Grade Report Problem**Attachments**:       Grade Report.html (381B)
- There was a problem with your last grade report. You need to do two things:Open the attached web page and follow the instructions to make sure that your information is correct; andReport any problems to me.Robert DanteCOL, USCCsr1770@usma.eduOlmstead Hall, 7th Floor, Room 7206** **