# Presentation: 028038

## Cyber Security Challenge 

***President and Chief Operating Officer***

***The***
***Cyber Security Challenge****** ***

## “Cyber Protection is no longer merely an enabler but is now required for business survival...”

## Slide 3

## The Statistics

***Surveyed organizations estimate losses of $265 million in the last year as a result of unauthorized employee access or abuses. (Past three years combined reported total was $120M)***
*Source:  Survey conducted by Federal Bureau of Investigation*
*and Computer Security Institute*
***91 percent of surveyed organizations experienced penetration or hacking/cracking incidents in the last year.***
*Source: Information Security Magazine Security Survey, July, 1999*
***Web defacements happen at an average of 13-21 per day***
*Source:  attrition.org*
***YAHOO /E-Trade/Internet Losses from recent DDOS attack costs the companies over $1.3B.***
*Yankee Group Feb 2000*

## Effort Needed to Disrupt Systems is Decreasing

**Effort Needed to Disrupt Systems is Decreasing**

- _	_

**low**

**Skills &**
**Knowledge**
**Required**

**1980**

**1985**

**1990**

**1995**

**password**

** ****guessing**

**password **

**cracking**

**disabling **

**audits**

**hijacking **

**sessions**

**diagnostics**

**stealth**

**diagnostics**

**packet**

**spoofing**

**sniffers**

**self replicating **

**code**

**exploiting known**

**vulnerabilities**

**back doors**

**GUI**

**high**

**Tools**

**Attackers**

**packet**
**protocol**
**DOS**
**attack**

**Sophistication**
**of Attack**

**2000**

## Vulnerabilities of Computerized Assets

- Errors or
- Malicious Damage- from Inside

- Malicious Attack
- From Outside

## Vulnerabilities of Computerized Assets

- Errors or
- Malicious Damage- from Inside

- Your

- Money
- Stolen

- Denial Of
- Service

- Lost
- Trade
- _Secrets_
- $66M Losses
- in ‘99

- Damaged
- Reputation

- Retrusting
- Data
- &
- Systems

- Organization

- Malicious Attack
- From Outside

## Vulnerabilities of Computerized Assets

- Errors or
- Malicious Damage- from Inside

- Malicious Attack
- From Outside

**$1.3B estimated losses**
**from Feb 2000 Distributed**
**Denial of Service Attacks.**
_***The Yankee Group***_

- 6%

- 5%

- 7.50%

- 19%

- 7%

- 7.50%

- 25.50%

- 5.50%

- 6%

- 9%

**IP Theft **

**Sabotage**

**Penetration**

**Insider Abuse**

**Fraud**

**DOS**

**Virus**

**Unauth Access**

**Web**

**Other**

- Source:

- Computer Security Institute (CSI) / Federal Bureau of Investigation.

- “Issues and Trends:  1999 CSI/FBI Computer Crime and Security Survey”

***Reported Incident Types***

*** ***

_***1999 losses - $27M***_

_***1999 losses- $66M***_

_***1999 losses - $56M***_

**0%**

**5%**

**10%**

**15%**

**20%**

**25%**

**30%**

**35%**

**Client Info**

**Threats**

**Stock**

**Tech Info**

**R&D/IP**

**Trademark**

**Other**

- Source:

-   GIC Electronic Threat and Analysis Center (ETAC)

***Open Source Incident Types***

**3%**

**21%**

**2%**

**20%**

**15%**

**13%**

**18%**

**8%**

- Espionage

- Profit/Greed

- Extortion

- Psychological

- Status

- Challenge

- Non-Malice

- Other

- Source:

- Computer Security Institute (CSI) / Federal Bureau of Investigation.

- “Issues and Trends:  1999 CSI/FBI Computer Crime and Security Survey”

***Attack Motives***

***Attack Sources***

_***External Attacks***_

- Source:  Information Security Magazine
- 2000 Information Security Survey

- Source:  Information Security Magazine
- 2000 Information Security Survey

-   Source: GIC Electronic
- Threat and Analysis Center
- (ETAC)

**47%**

**48%**

**5%**

**Foreign**

**Domestic**

**FN in U.S.**

- Source:

-   GIC Electronic Threat and Analysis Center (ETAC)

***Sources of Activity and Attacks***

## Web Page Defacements

***Date collected from “attrition.org”.***

## Source: Attrition.Org

**Source: Attrition.Org**

## 2000 YTDDefacements

**Source: Attrition.org**

## 2000: Purple 

- 1999: Green,
- 2000: Purple

- 1999 vs. 2000
- Daily Cumulative
- Total Comparison:

**Source:  Attrition.Org**

## Web Server

- Yellow: IIS,
- White: Apache,
- Green: NetScape,
- Orange: All Others

**Web Server**
**Vulnerability**

**Source: Attritrion.Org**

## Operating System 

**Source:  Attrition.org**

**Operating System **
**Vulnerability**

## Top Ten Known Defacers

## Current IDS Statistics

- Average number of IDS events per day (per engine)
- Denial of Service	    		   5
- Unauthorized Access Attempts  	   3
- Pre-Attack Probes 		  	 28
- Suspicious Activity 		     	   9
- Benign Triggers		          163

## Current IDS Statistics

## Personal IDS

- Hundreds of source hosts
- 25 countries

## Personal IDS

- Probe Events

## Personal IDS

***Personal IDS***

- Identification and Enforcement

- IP: 24.10.126.223
- DNS: cc687931-a.etntwn1.nj.home.com
- Node: cc687931-a
- Group: OEMWORKGROUP
- NetBIOS:  WILLIAM PROETTA
- MAC: 00E02937B9A3

- www.anywho.com
- www.mapquest.com

## Are Companies Ready For An Attack?

**How Often Are Systems Tested ?**

- Source:  Information Security Magazine
- 2000 Information Security Survey

## Information Overload ---> PDD 63

_***ATTRITION Security Advisory Library. Currently 3027 advisories available***_. **8LGM**: 8 Little Green Men **ADM**: **Association De Malfaiteurs** **Allaire** (www.allaire.com/security/) Arne Vidstrom **ASSIST**: Automated Systems Security Incident Support Team **AUSCERT**: Australian CERT Caldera (Linux) Cerberus (www.cerberus-infosec.co.uk/advisories.shtml) **CERT**: Computer Emergency Response Team (www.cert.org) SURFnet **CERT** (www.surfnet.nl/surfnet/security/cert-nl.html) Cheyenne Security Newsline **CIAC**: Computer Incident Advisory Capability (www.ciac.org) Cisco (www.cisco.com/warp/public/707/advisory.html) Cobalt Linux CORE-SDI (www.core-sdi.com) CPIO: Corinne Posse CSL Bulletin Debian Linux **DEC**: Digital Equipment Corporation Delphis Consulting Plc (www.delphisplc.com) eEye Digital Security Team (www.eeye.com) FedCIRC (www.fedcirc.gov) FreeBSD Security **HERT**: Hacker Emergency Response Team (www.hert.org) HHP (hhp.perlx.com/ouradvisories.html) **HP**: Hewlett Packard Advisories IBM Emergency Response Service (www-1.ibm.com/services/continuity/recover1.nsf/advisories Independence Linux (independence.seul.org/security/) **ISS**: Internet Security Systems (www.iss.net) KSR[T] Advisories (www.ksrt.org) l0pht Advisories (www.l0pht.com) MCI Advisories Microsoft Advisories (www.microsoft.com/security/) Misc Advisories **NAI**: Network Associates Inc (www.nai.com) NetBSD Security FBI NIPC (www.fbi.gov/nipc/nipcaaw.htm) NIST (cs-www.ncsl.nist.gov) NMRC: Nomad Mobile Research Center OpenBSD Security (www.openbsd.org/security.html) Plaguez Advisories Redhat Linux (www.redhat.com) RSI: Repent Security Inc. Advisories RFP: Rain Forest Puppy (www.wiretrip.net/rfp/) Roses Labs (www.roses-labs.com/advisory/advisory.htm) SAFER Advisories SGI: Silicon Graphics Inc. Advisories SMS: Sun MicroSystems Advisories (sunsolve.sun.com/pub-cgi/secBulletin.pl) SUSE Linux Team Asylum Teso (teso.scene.at) UssrLabs (www.ussrback.com) WSD: w00w00 Security Development (www.w00w00.org/advisories.html)

## ISAC

**Participants share information about security incidents, vulnerabilities, threats, solutions**
**Each participating firm is alerted immediately, 24 hours/day, anywhere in the world**
**Results of analysis are reported in three categories: Normal, Urgent, or Crisis**

**Anonymous, private, authenticated submission**
**Web-based (primary), email backup**
**Designed for anonymous submission of incidents**
**Multiple levels of analysis**
**Passthrough**
**Sanitization**
**Trending and analysis**

## FS/ISAC Data Sources

- Strategic Partners
- 64 Distinct search engines
- 270 list servers
- AOL, ICQ and IRC Chartrooms
- WAP specific sites
- 20 “Hacker sites”
- Various message boards, Usenet, etc
- Advisories from 46 + sources
- Plus worldwide government support (input), but no reporting (no look up membership/seats)
- DoD JTF, NCC, Scotland Yard, Interpol, etc

## Two Operational ISAC’s

**Two Operational ISAC’s**
**- Financial Services ISAC**
**- NCC ISAC**

## Incident Targets Breakdown August 2000

***Incident Total - 50***

## Vulnerabilities Breakdown

***Vulnerability Total - 213***

## Incident Severity Breakdown

## Security Challenge Model

***Security Challenge Model***

**2000**

## Industry Penetration

**Standalone enterprise LANs and**
**WANs  are connected using**
**“****closed” technology and expensive**
**dedicated lines**

**Enterprises connect to the**
**internet and begin posting **
**web pages to share corporate**
**information. E-Mail is the**
**dominant internet application**

**Enterprises form extranets along**
**the supply chain and begin to**
**integrate enterprise applications such**
**as ERP into the electronic procurement**
**system.**

**Managed**
**Services**

**mCommerce**

**Authentication**

**Industry Penetration**

**Standalone**
**LAN/WAN**

**Internet**
**Connectivity**

**Basic**
**eCommerce**

**Advanced**
**eCommerce**

**Emerging platforms and media enable**
**new forms of transactions and distribution.**
**Requirements become too complex to **
**manage in-house.**

**Content Security**

**Digital Rights**
**Management**

**PKI**
**Middleware**

**Policy Based**
**Management**

**PKI**

**Encryption**

**Firewall/VPN**

**Intrusion**
**Detection**

**Mature**

**Emerging**

## 2000

- $

- Forecasted Trends

- 1998

- 1999

- 2001

- Y2k $

**Y2K Legislation**

**Public Confidence in IT**
**E-Commerce**
**IDS / FW Managed Services**
**E-Biz (Supply Chain)**
**Information Security**
**PKI**
**Wireless**

- 2002

**Cyber Legislation**

**Privacy Legislation**

## 2000

- $

- Forecasted Trends

- 1998

- 1999

- 2001

- Y2k $

**Y2K Legislation**

**Public Confidence in IT**
**E-Commerce**
**IDS / FW Managed Services**
**E-Biz (Supply Chain)**
**Information Security**
**PKI**
**Wireless**

- 2002

**Cyber Legislation**

**Privacy Legislation**

_***70 pieces of Legislation on the Hill Today***_
**- GLB Financial Liability Act (eff. 13 Nov)**
**- COPPA  (eff. 21 Apr 2000)**
**- Canadian Privacy Act  (1 Jan 2001)**
**- HIPPA (2001-2002)**
**- US/EU Safe Harbor Act (eff. Nov 2000)**

## What Do We Think Will Happen?

_**Cyber Forensics - Proactive monitoring, scanning, detection, litigation support**_
- Increasing interest in Integrated Architecture Solutions (Network Modernization)
_**Increased focus on embedding security technology in the Application Layers (e-Biz)**_
- Increased focus on international interoperability and enforcement
- Growth in web site trust programs (ASP and ISP)
_**Increased Legislation (CyberLaw /Privacy and Confidentiality)**_
- Increased emphasis on IT security certification of technology (BiTS)
- Greater reliance on the business imperative to drive IT solutions (e-biz)
_**Major Emphasis on Information Sharing on Incident Management (ISAC)**_
- Changes in the US Tax Code related to Tax Credits for Security Initiatives
- Unprecedented growth in IS managed services
_**Unprecedented Growth of Wireless Applications --- and RISK**_
_**Increased awareness on the issues of Personal Privacy and Confidentiality**_

## 12100 Sunset Hills Road

**12100 Sunset Hills Road**
**Reston, Virginia 20190**
**(703) 375-2100 or (888) 660-0134**
****
**www.globalintegrity.com**
**email:  info@globalintegrity.com**