# Presentation: 013569

## Bill Neugent
11 March 2004

**Bill Neugent**
**11 March 2004**

**The views expressed are those of the author and *****boy***** do they **
**not reflect the official policy or position of The MITRE Corp.**

**The Cybersecurity Story;****Show As You Tell**

## Outline

**Cyberterrorism!**
**Who is to blame?**
**What’s really happening?**
**The simple solution**
**National strategy**
**Conclusion**

## The Situation

**	****Computer-controlled networks empower and enable modern society**

**Networks bring us together**

## World is Interconnected

**Cyber assets sit on rug of communications**
**Global Internet**
**Global Public Switched Network**
**We’re at risk**
**Rug can be pulled out from under us**
**Cyberterrorists are seconds away**

## Power travels at light speed
Power networks are controlled by computers
Communication signals travel at light speed
Communication networks are controlled by computers

**Power networks are controlled by computers**
**Communication signals travel at light speed**
**Communication networks are controlled by computers**

**The Dilemma**

**Remote control makes it possible**
**to ru****i****n a complex network**

## What’s At Risk?

##  SCADA On Thin Ice*

-  **SCADA On Thin Ice***

**3 million SCADA systems in use**
**Increased use of Windows, UNIX**
**Utilities connecting SCADA to corporate networks, Internet, wireless networks**

**Stratum8 Networks, “New Layer of Internet Security is Required to Protect Critical Systems that Manage Oil, Natural Gas, and Electricity Resources,” ****30 October 2002**

## So You Say You’re Not On The Internet

**“****Nearly every bank in the United States runs its operations on an internal network that connects to the Internet.”***

**Maybe your ****front**** door isn’t**

*** Sandeep Junnarkar, CNET News, 1 May 2002**

## Shouts of Warning

**“****Electronic Pearl Harbor”** – Winn Schwartau
**“****Digital Waterloo”**
- 	– Center for Strategic and International Studies
**“****Digital Armageddon”**
- 	– Sen. Charles Schumer, D-N.Y.

## Outline

**Cyberterrorism!**
**Who is to blame?**
**What’s really happening?**
**The simple solution**
**National strategy**
**Conclusion**

## Users

## Bullies

## What Motivates Bullies?

**“****The reason the software you buy isn’t secure is that companies don’t care.”**
**“****The reason is there is no liability for producing a shoddy product.”**
**	****	****	****	****	****	****	****Bruce Schneier**

**“****COMDEX: Panel: Accept the Net is vulnerable to attack,” IDG News Service, 19 November 2002**

## Software Complexity

**Software more complex than any other human construct***
**No two parts alike**
**Software differs profoundly from computers, buildings, or automobiles, where repeated elements abound**
**Rapid time to market**
**Armies of programmers work independently**
**Complex legacy software carried forward**

*** Frederick Brooks**

**Feature-rich software asks for trouble**

## Industry Complexity*

**Example: freight information systems involve changing mix of companies**
**Carriers, shippers, distributors, freight forwarders, government agencies, e.g., Customs**
**No integration; hard to establish:**
**Consistent security baseline**
**Security standards, e.g., e-documents **
**Identity of users and systems**

*** Transportation Research Board Special Report 274, Cybersecurity of Freight**
**Information Systems, A Scoping Study, National Research Council, 2003**

**800,000 hazmat shipments/day in U.S.**

## Market Forces Made Us Do It*

**Competition forced cost-cutting**
**Lead to dependency on Internet**
**Freight information systems efficient, reliable**
**Freight customers have lower inventories, just-in-time inbound material strategies**

**Market forces**
**	****Computer-enabled efficiencies**
**	****	****Critical dependencies**

*** Transportation Research Board Special Report 274, Cybersecurity of Freight**
**Information Systems, A Scoping Study, National Research Council, 2003**

## Deregulation 

**“****We’ve delegated public safety and national security to market forces”***

*** Scott Charney, “Cyberwar!**”, **PBS Frontline, April 2003**

## Competition

**Competition**

**Got to drop this extra security weight**

## Cutting Software Development Costs

**Products that include software developed in Beijing:**
**Microsoft**
**IBM**
**Sun**
**Etc.**

## The Issue: Closing The Gap

**Security provided by market-based solutions**

**Security needed against state-sponsored attacks**

**}**

** ****Where should it be closed?**
** ****How?**

## The Inescapable Conclusion:We’re Toast

## Outline

**Cyberterrorism!**
**Who is to blame?**
**What’s really happening?**
**The simple solution**
**National strategy**
**Conclusion**

## Terrorist Know-How, Resources

**We train the world**
**Try to find an American in an American grad school**
**Funding**

## Terrorist Requirement

**Make headline news**
**“****What’s the visual?”***

*** TV news producer, judging whether to include coverage of a fire**

**After a bomb**

**After a cyberattack**

## Prognosis For Cyberterrorism

**Not top terrorist priority**
**Definitely on their to-do list**
**Much terrorist research and preparation for cyberterrorism***

**Col Bradley K. Ashley, USAF, “Anatomy of Cyberterrorism--Is America Vulnerable?”**
** ****IA Newsletter, Vol. 5., No. 4., IA Technology Analysis Center (IATAC), Winter 2002/2003**

## Computer Crime; We’re Being Robbed

**Credit card fraud**
**5.2 percent of online shoppers***
**Identity theft!!!**
**Top consumer complaint in U.S., per FTC****
**27.3M American victims in last five years; 9.9M in last year*****
**$48B losses last year to business, financial institutions*****
**$5B losses to consumers*****
**Spyware**
**40% of companies infected**

***Greg Sandoval, “War on cybercrime--we're losing,” ZdNet News, 14 May 2002**
****Robert Moritz, “When Someone Steals Your Identity,” Parade Magazine, 6 July 2003**

## Vulnerabilities Reported*

**2002**
**4,129**

**2001**
**2,437**

**2000**
**1,090**

**1999**
**417**

**1998**
**262**

*** CERT/CC**

**4,000**
**3,000**
**2,000**
**1,000**

## Vulnerabilities Costed

**    ****“****We’re fast approaching the point at which we’re spending more money to find, patch, and correct vulnerabilities than we pay for the software”**
**	****	****	****	****	****	****John Gilligan**
**	****	****	****	****	****	****USAF CIO**
**	****	****	****	****	****	****(formerly DOE CIO)**

**Washington Monthly, “The Myth of Cyberterrorism,” November 2002**

## Are You On The Patch?

**We’ve treated this as housekeeping problem**
**Lack of automatic patching, e.g., virus signature updates, is a fatal weakness**

## How Bad Is It Really?

*** PC World Communications, “Cyberterrorism Scenarios Scrutinized,” 23 August 2002**
**** Richard Clarke, “Cyberwar!”, PBS Frontline, April 2002**

**Sanctum broke into ****98 percent**** of 350 corporate sites it audited***
**Average attack took two hours**
**Government Red Teams succeed “****every single time****”****

## Security on the Internet

**PSINet set up unprotected server**
**Was attacked ****467 times within 24 hours**

**Graham Hayday, “Exposed server—magnet for hack attacks,”**
**Silicon.com, 29 January 2003**

## What Can Happen*

**	****http://www.caida.org/analysis/security/sapphire/sapphire-2f-30m-2003-01-25.gif**

- Code Red       To see an animation, go to:

**	****http://www.caida.org/analysis/security/code-red/coderedv2_analysis.xml#animations**

- Slammer       To see an animation, go to:

**	*****  http://www.caida.org/**

## Slammer

**250 times faster than Code Red**
**Within ten minutes, most of systems hit had been infected**
**Traveled in 404-byte packet**

*** Ted Bridis, “Internet attack's disruptions more serious than many thought possible,”**
**  ****Associated Press,** **27 January 2003**
**** Kevin Poulsen, “Slammer worm crashed Ohio nuke plant net,” SecurityFocus,** ** 20 August 2003**

**Crippled sensitive systems, including banking operations and 911 centers***
**Prevented many ATM withdrawals***
**Disabled safety monitoring system at Ohio nuclear power plant****

## Implications

**Implications**

**Slammer infected few systems -- 120,000**
**What if vulnerability existed on millions of systems?**

## There is no current defenseagainst such a threat

## Opportunity

**August 2003 Windows of vulnerability**
**RPC vulnerability**
**Affected Windows NT 4.0, Win2K, Windows XP, Windows Server 2003**

## Attack of the Worms

**Blaster**
**Welchia**
**Sobig.F**

## Why No Intentionally Destructive Attacks?

**Hackers, criminals, spammers want to use Internet, not destroy it**
**Terrorists not yet active in cyber domain**
**To most adversaries, our nets are worth more up than down**
**The Big One Is Coming**
**We live in a straw house**
**Too many people have matches**

- But

## Ultimate Disaster Scenario?

**AMERICAN ECONOMY STRUCK BY BUSINESS FAILURES**
**Loss of confidence in U.S. goods**

*** Scott Borg**

**Dartmouth study of business failures shows many could have been induced by cyber means***
**Could focus on confidentiality and denial of service be misplaced?**

## It’s Not Always BadWhen Security and Secrecy Fail

**“****At the Iraqi Intelligence Service, a man walked up with a grimy sack of documents and tapes. ‘Tell the world what happened here,’ he said.”***

*** Melinda Liu, Rod Nordland and Evan Thomas, “The Saddam Files”**
**NEWSWEEKTM, 28 April 2003**

## Hackers Wanted

**Instead of defacements, leave a signature worthy of your deed; create your own mark of Zorro**
**Tyrants and dictators still keep detailed records of their atrocities, except now they’re using computers**

**Do we need a Robin Hood**
**in cyberspace?**

## Most Likely Outcome: Cyberstroke

**Maybe paired with physical terrorism**

## Outline

**Cyberterrorism!**
**Who is to blame?**
**What’s really happening?**
**The simple solution**
**National strategy**
**Conclusion**

## Consider A Managed Security Service

**If you can’t do the job yourself, hire someone who can**
**This is a job for trained professionals**

## Get Money

**Show vulnerability**
**Scan for vulnerabilities**
**Map network!**
**Red team as outsider!**
**Red team as authorized insider!**
**Show threat**
**Deploy intrusion detection system**
**Scan for unauthorized wireless!**
**Monitor Internet usage!**

**Prove threat is real**
**Produce near-term results**

## Get People

**Empower engineers**
**Provide challenge, authority, resources**
**Approaches explored in labs**
**Build partnerships**
**Internal security committee**
**Business units**
**Infrastructure, service providers**
**Legal, human resources**
**External**
**Infrastructure, service providers**
**Software vendors**
**Business partners, e.g., critical infrastructure sector **
**Law enforcement, counterintelligence, counterterrorism**

## A Defense-in-Depth Consideration

**Poor security often due to lack of qualified people**
**Layered security creates more work, not more people**

## Simplify Architecture (Pg 1 of 2)

**Firewall enterprise**
**Castle walls and gates enable control**
**Firewall desktops*******
**Manage enterprise security**
**Network management centers**
**Identity management, policy and access management, and provisioning, e.g., Netegrity**
**Server-based architectures**
**E.g., thin clients, Citrix Secure Gateway**

******* ****Applies to home computers**

## Simplify Architecture (Pg 2 of 2)

**Manage configurations**
**Get it secure*******
**Configuration management: configuration guidance and tools, best practices**
**Keep it secure*******
**Compliance management, including patch management**

******* ****Applies to home computers**

## CIO’s Choice

**Chaos **
**Diverse hardware and software**
- Applications testing
- Staff training
**Non-interoperable applications**
**Assimilation by The Borg**
**Homogeneous hardware and software**
**Applications and infrastructure part of a coherent, holistic whole**

## The More Integrated And Interoperable You Are, The Easier You Fall

**Defense-in-depth**
**becomes more critical**

## Secure Architecture (Pg 1 of 3)

**Ensure resilient foundation**
**Programmed to respond automatically**
**Power networks “trip offline” for self-protection**
**Partitioned**
**Domains separated by filtering routers**
**Able to sustain emergency operation**
**Not fully Internet-dependent**

## Secure Architecture (Pg 2 of 3)

**Create risk domains**
**DMZ for sharing with outsiders**
**Castle keep for crown jewels**
**Strengthen systems, e.g., Host Intrusion Prevention Systems (HIPS) such as StormWatch, Entercept**
**Protect data, e.g., Digital Rights Management (DRM)-like technology such as Authentica, Liquid Machines**
**Deploy strong authentication**
**Such as Public key infrastructure, e.g., VeriSign; access tokens**

## Secure Architecture (Pg 3 of 3)

**Deploy automatic malware protection*******
**Email gateway, e.g., Trend VirusWall**
**eManager plug-in to block installer patches, registry files, etc.**
**Desktop, e.g., Symantec AntiVirus, HIPS, TripWire**
**Detect, automatically react to internal propagation**
**Deploy automatic backup infrastructure***
**E.g., Veritas NetBackup**
**Monitor and respond**
**Security Information Management System (SIMS)**
**Harness deluge of event data, e.g., ArcSight, netForensics, GuardedNet, Intellitactics**
**Integrate with operations, configuration management**

******* ****Applies to home computers**

## We’re Now Secure Against Some Threats

**What about professionals?**
**Honeytokens, tripwires, homing beacons**

## From Desktops to Belt-Tops

**Laptop**
**Personal Digital Assistant (PDA)/Palm PC**
**Cell phone**
**Display of alerts, messages**

**All wireless**
**All will include microphones**

## ConfrontUltimate Threats

## Nanotechnology

**Past**

**Future**

- .

**(smart dust)**

## 75% immediately gave passwords when asked
15% more required social engineering
“password” 12%, name 16%, football team 11%
75% knew coworkers passwords
67% used same password for everything
Personal banking, Web site access
91% of men circulated dirty pictures or jokes
40% of women did same
If discovering a salary file, 75% would read it
38% would pass file around office

**15% more required social engineering**
**“****password” 12%, name 16%, football team 11%**
**75% knew coworkers passwords**
**67% used same password for everything**
**Personal banking, Web site access**
**91% of men circulated dirty pictures or jokes**
**40% of women did same**
**If discovering a salary file, 75% would read it**
**38% would pass file around office**

**Users***

*** User Survey--Infosecurity Europe 2003**

## Two Things To Count On

**Users will click on attachments**
**Users will hit Reply All**

## User-Based Security

**	****Picture a vehicle with an independent steering wheel on each tire.**

## Build Culture Of Secure Behavior

**Eliminate passwords--go to tokens, biometrics**
**Train users in what is sensitive**
**Train users against social engineering**
**Monitor user activities**
**Enforce secure behavior**

**Train, Monitor, Enforce**

## It’s Who You Know

**80 percent of murder victims killed by someone they knew***
**22 percent killed by people with whom they had romantic involvement**

*** “Murder in Large Urban Counties,” The Bureau of Justice Statistics Study, 1988**

## Separation of Power In Government

**Humans don’t deal well with absolute power**

## Separation of Power In Systems

**	****Study of over 100 espionage cases showed 55% of spies were network or system administrators***

*** Data is from the Espionage Database Project of the Defense Personnel Security Research Center**

## Outline

**Cyberterrorism!**
**Who is to blame?**
**What’s really happening?**
**The simple solution**
**National strategy**
**Conclusion**

## National Strategy to Secure Cyberspace

**Create cyberspace security response system**
**Establish threat and vulnerability reduction program**
**Improve training and awareness**
**Secure government systems**
**Work internationally**

## Outline

**Cyberterrorism!**
**Who is to blame?**
**What’s really happening?**
**The simple solution**
**National strategy**
**Conclusion**

## Think In Advance

**Team**** with others**
**Community partnerships (**_**trust everyone**_**)**
**Innoculate ****against**** Insider ****attacks**
**Minimize trust on users (**_**trust no one**_**)**
**Safeguard treasures**
**Architect for resilience, emergency operation**
**Automate ****responses**

- TIA