# Presentation: LX6K7G7ORPI7UMRQHJL3ZZWZYRQR2V6Y

## War Games, from laptop to real life: Making the Cyber World a Safer Place

- COL Curtis A. Carver Jr. Associate Dean, Information and Educational Technology

## What to Take from this Presentation

- The situation is getting worst.
- Perimeter defenses are not working.
- Centralized management is not working.
- Passive approaches to awareness and training are not working.
- Active approaches are necessary to create an army of one.

## The Situation is Getting Worst

- Increasing  number of attacks
- Increasing complexity of attacks
- Decreasing interval between patch release and attack exploitation

## Increasing Attacks

**This is about the point that **
**Bloodhound.Exploit.45**
**attacked my computer. **

## How could I be Attacked!

- Antivirus on perimeter.
- Antivirus updates 14 times a day.
- Anti-spam updated automatically.
- Windows patches update automatically.
- Firewalls on computer and on perimeter.
- Was working over an encrypted VPN channel.

**Attacked occurred at 8:00PM.**
**Patches released 6:00 PM.****  **

## Remedial Action

- Check for updates to anti-virus and anti-spam (didn’t work).
- Ran anti-virus (didn’t work), ran anti-spam (didn’t work), ran windows update (worked!)
- Set anti-virus to run at reboot. Reboot (worked!).

## Changing Environment(Speed of Attack)

**Morris Internet Worm** (1988 - Over 72 hours affected 6,000 computers taking 90 minutes to bring a system down).
**Melissa Virus** (May 1999 – Over 72 hours affected 100,000 computers. One site received 32,000 Melissa email messages in 45 minutes.)
**Code Red** (July 2001 approx.250,000 computers in 20 hours)

## Slammer

**The World**
**January 25, 2003**

**Slammer penetration**
**30 minutes after **
**release.**

**http://www.cs.berkeley.edu/~nweaver/sapphire/**

## Increasing Complexity

- Slammer
- Sapphire contains a simple, fast scanner in a small worm with a total size of only 376 bytes.
- In the first minute, the infected population doubled every 8.5 seconds.
- Achieved full scanning rate in less than 3 minutes. Full scanning rate was 55 million scans per second.
- The scanning rate was limited because significant portions of the internet ran out of bandwidth.
- Sapphire spread nearly two orders of magnitude faster than Code Red.

**http://www.cs.berkeley.edu/~nweaver/sapphire/**

## Perimeter Defenses are not Working(Necessary but not Sufficient)

- Anti-virus, anti-spam, firewall, intrusion detection, and intrusion prevention systems are all necessary but not sufficient.
- Why?
- Mobile worker population is out there working hard to pick up new and exotic attacks.
- Insider threat much greater than outside threat.
- New computing devices are coming in all shapes and sizes.

**My Projector is attacking ****my network!**

## Centralized Management is not Working(Necessary but not Sufficient)

- Anti-virus and software update servers are necessary but not sufficient. Active directory helps with authentication and authorization but is not enough.
- Why?
- Mobile work force
- Time between release of patch and release of an attack tool, “flash to bang”, is rapidly shrinking.
- As you hardened the perimeter and central management, attackers attempt to bypass these defenses through social engineering attacks.

## Social Engineering(Hidden Attack)

- In this case, the attacker is trying to trick you into clicking on the embedded link. The link does not go to an webserver in the Electrical Engineering and Computer Science (EECS) department but instead opens an invisible frame and launches a program embedded in another part of the email message.

## Social Engineering(Hidden Encrypted Attack)

- As you might imagine, the virus creators were not thrilled about their viruses being deleted by the corporate virus checkers so they tried another approach. They encrypted the virus to disguise it, gave the user the password to decrypt it and install it, and hide it behind a familiar looking web address that did not go to the website but launched the virus.

**The Military Academy will not refer to you as “Dear member of usma.edu” – it will refer to you by name. **

- Does not really go there**.**

## Social Engineering(Hidden Zipped File)

- Legitimate email to all users.

- The attack contained in the zipped file is new and host anti-virus software cannot protect the computer. The computer must be reimaged.

## Passive Approaches to Awareness and Training are not working

- Attacks are bypassing perimeter defenses.
- Sophistication of attacks is increasing.
- Every user is an attack point.
- Every user is a vulnerability.
- Even one user fails, insider attack occurs and it will spread very rapidly.

## Passive to Active

- Users remember:
- 30% of what they hear
- 40% of what they see and hear
- 70% of what they do.
- We have to get the users actively involved in learning.

## Active approaches are necessary to create an Army of One

- Cadet Information Security Officers (ISOs)
- Carronade
- CDX
- MAADNET

## Cadet Information Security Officers

- Empower **students** to administer their companies, fix problems locally, conduct training, conduct exercises, and lead.
- Results
- Increased notification of outages
- ISO Empowerment through Active Roles
- New User Training led by students
- IT SAMI
- Carronade Exercise

## IT SAMI

**IT-SAMI INSPECTION SHEET**
- Cadet Name	Company	Year	Inspector Name
- Category
- 	ITEM		POINTS
- AD-AWARE
- 	INSTALLED?	NO, 		-30
- 	CHECK UPDATES	>= 1 WEEK OLD, 	- 05
- 			>=3 WEEKS, 		-10
- 			>= 1 MONTH, 		- 20
- 	LAST SYSTEM SCAN	>= 1 WEEK OLD, 	- 05
- 			>=3 WEEKS, 		-10
- 			>= 1 MONTH, 		- 20
- 	SCAN RESULTS
- 		For each process 		-10
- 		For every 20 additional items, 		-05
- DEFRAGEMENT ANALYZE
- 	SYSTEM SUGGESTED?		YES, 	-10
- ADD/REMOVE PROGRAM LIST
- 	WILD TANGENT 		YES, 	-10
- 	WEATHER BUG		YES, 	-10
- 	WELL KNOWN FILE SHARING	YES, 	-20/item
- BROWSER HEALTH
- 	SEARCH BAR OTHER THAN GOOGLE	YES, 	-10
- VIRUSES
- 	DEFENITION FILES	>= 1 WEEK OLD, 	- 5
- 			>=3 WEEKS, 		-10
- 			>= 1 MONTH, 		- 20
- SYSTEM DATA
- 	SPACE REMAINING ON C-DRIVE	< 20%, 	-10
- 	MAJORITY OF ACDEMIC DATA
- 	STORED ON C-DRIVE		YES, 	-20

**                       ****Best In BDE****	****	**
- Best Regiment:		86.13
- Best Company:		95.00
- Worst Reg:	 	75.00
- Worst Company:		53.50

## Carronade

- Active learning phishing exercise.
- Student controlled, student initiated.
- Four messages
- Leadership and IT infrastructure aware of concept but not deployment date

## Carronade Results

## CDX

- Active learning competition between Army, Navy, Air Force, Coast Guard, Merchant Marine, and Air Force Institute of Technology.
- Cadets take onsite pass for the exercise and man the site 24 hours a day.
- NSA attacks through VPN channels. The sites defend and offer a standard suite of services.

## CDX

- Principal benefit is leadership and education.

## MAADNET

**Game that incorporates**
**people, procedures, data,**
**hardware, and software into**
**a realistic simulation.**

**Build components, systems,**
**Networks, and then scenarios. **

## MAADNET

**MAADNET will support nationwide competitions as teams compete to design the most productive and **
**best defended networks.  **

## DOOM

## USMA Team

- COL Curt Carver
**LTC Ron Dodge**
- Dr Aaron Ferguson
- LTC John Hill
- Dr John James
- MAJ Fernando Maymi
- COL Dan Ragsdale
- COL Gene Ressler

## Thing to Take Away

- The situation is getting worst.
- Perimeter defenses are not working.
- Centralized management is not working.
- Passive approaches to awareness and training are not working.
- Active approaches are necessary to create an **Army of one**.

## Questions, Queries, Comments, A Conversation 

## Class of 2009 Computing System

**Class of 2009 Computing System**

**Dell Precision M70 Laptop**
**15.4” Screen/256MB Video w/PCI-E**
**2.0 GHz PM(Dothan) CPU**
**1 GB DDR2 Memory**
**60 GB 7200 rpm Hard Drive**
**CD-RW/DVD Drive**
**Docking Station**
**WindowsXP, Office 2003**
**Iomega External HD**
**160 GB HD**
**USB 2.0/Firewire**
**Backup Software**
**DELL A922 Printer**
**Color Printer**
**Copier/Scanner**
**1GB Thumb Drive**