Campbellsville University Emerging Threats Counter Measures & Diversity Strategy Paper This chapter discusses the relevance of diversity strategy while sec

Campbellsville University Emerging Threats Counter Measures & Diversity Strategy Paper This chapter discusses the relevance of diversity strategy while securing any set of national assets. Diversity in national infrastructure involves the introduction of intentional differences into systems such as vendor source, deployment approach, network connectivity, targeted standards, programming language, operating system, and software version. Two systems are considered diverse if their key attributes differ, and nondiverse otherwise. The requirement for physical diversity in the design of computing infrastructure is perhaps the most familiar of all diversity-related issues. The idea is that any computing or networking asset that serves as an essential component of some critical function must include physical distribution to increase its survivability. A national diversity program should be developed that would call for coordination between companies and governmental agencies in several

Start a discussion thread and discuss how the types of threats discussed in the article could impact our economy, and how implementing Diversity (as discussed in chapters 4) could help mitigate these threats.

For additional information click the link below:

https://www.resdal.org/Archivo/usa-home-prote.htm

Attacks on our national infrastructure are already happening. And the expectation is that they will continue to increase at an accelerated rate. For this week’s discussion, we’ll cover threats to our nation’s pipelines. To get started, read this article:

https://www.eenews.net/stories/1060054924

After reading the article, start a discussion thread and discuss how the types of threats discussed in the article could impact our economy, and how implementing Diversity (as discussed in chapter 4 ) could help mitigate these threats.

You must do this following:

1) Create a new thread. As indicated above, discuss how the types of threats discussed in the article referenced above could impact our economy, and how implementing Diversity and Commonality (as discussed in chapters 4 and 5) could help mitigate these threats.

2) Select AT LEAST 3 other students’ threads and post substantive comments on those threads. Your comments should extend the conversation started with the thread.

ALL original posts and comments must be substantive. (I’m looking for about a paragraph – not just “I agree.”)

You must do this following:

1) Create a new thread. As indicated above, discuss how the types of threats discussed in the article referenced above could impact our economy, and how implementing Diversity (as discussed in chapters 4) could help mitigate these threats.

2) Select AT LEAST 3 other students’ threads and post substantive comments on those threads. Your comments should extend the conversation started with the thread.

ALL original posts and comments must be substantive. (I’m looking for about a paragraph – not just “I agree.”) Cyber Attacks
Protecting National Infrastructure, 1st ed.
Chapter 4
Diversity
Copyright © 2012, Elsevier Inc.
All Rights Reserved
1
• The securing any set of national assets should
include a diversity strategy
• The deliberate introduction of diversity into national
infrastructure to increase security has not been well
explored
• Two system are considered diverse if their key
attributes differ
• Diversity bucks the trend to standardize assets for
efficiency’s sake
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Introduction
2
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Fig. 4.1 – Diverse and nondiverse
components through attribute
differences
3
• Worm propagation is an example of an attack that
relies on a nondiverse target environment
• Worm functionality in three steps:
Chapter 4 – Diversity
Diversity and Worm Propagation
– Step #1: Find a target system on the network for
propagation of worm program
– Step #2: Copy program to that system
– Step #3: Remotely execute program
– Repeat
• Diversity may be expensive to introduce, but saves
money on response costs in the long run
Copyright © 2012, Elsevier Inc.
All rights Reserved
4
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Fig. 4.2 – Mitigating worm activity
through diversity
5
• Most individual computers run the same operating
system software on a standard processor platform
and browse the Internet through one or two popular
search engines with the one of only a couple
browsers
• The typical configuration is a PC running Windows on
an Intel platform, browsing the Internet with Internet
Explorer, searching with Google
• This makes the average home PC user a highly
predictable target
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Desktop Computer System Diversity
6
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Fig. 4.3 – Typical PC configuration
showing diversity
7
• Three Considerations
– Platform costs
– Application interoperability
– Support and training
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Desktop Computer System Diversity
8
• Ultimate solution for making desktops more secure
involves their removal
Chapter 4 – Diversity
Diversity Paradox of Cloud
Computing
– Not a practical solution
• Cloud computing may offer home PC users a diverse,
protected environment
Copyright © 2012, Elsevier Inc.
All rights Reserved
9
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Fig. 4.4 – Spectrum of desktop diversity
options
10
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Fig. 4.5 – Diversity and attack difficulty
with option of removal
11
• Modern telecommunications consist of the following
two types of technologies
Chapter 4 – Diversity
Network Technology Diversity
– Circuit-switched
– Packet-switched
• When compared to one another, these two
technologies automatically provide diversity
• Diversity may not always be a feasible goal
– Maximizing diversity may defend against large-scale
attacks, but one must also look closely at the entire
architecture
Copyright © 2012, Elsevier Inc.
All rights Reserved
12
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Fig. 4.6 – Worm nonpropagation benefit
from diverse telecommunications
13
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Fig. 4.7 – Potential for impact
propagation over shared fiber
14
• Any essential computing or networking asset that
serves a critical function must include physical
distribution to increase survivability
• Physical diversity has been part of the national asset
system for years
Chapter 4 – Diversity
Physical Diversity
– Backup center diversity
– Supplier/vendor diversity
– Network route diversity
Copyright © 2012, Elsevier Inc.
All rights Reserved
15
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 4 – Diversity
Fig. 4.8 – Diverse hubs in satellite
SCADA configurations
16
• A national diversity program would coordinate
between companies and government agencies
Chapter 4 – Diversity
National Diversity Program
– Critical path analysis
– Cascade modeling
– Procurement discipline
Copyright © 2012, Elsevier Inc.
All rights Reserved
17
Cyber Attacks
“Dr. Amoroso’s fifth book Cyber Attacks: Protecting National Infrastructure outlines the challenges of protecting our nation’s infrastructure from cyber attack using security techniques
established to protect much smaller and less complex environments. He proposes a brand
new type of national infrastructure protection methodology and outlines a strategy presented
as a series of ten basic design and operations principles ranging from deception to response.
The bulk of the text covers each of these principles in technical detail. While several of these
principles would be daunting to implement and practice they provide the first clear and concise framework for discussion of this critical challenge. This text is thought-provoking and
should be a ‘must read’ for anyone concerned with cybersecurity in the private or government
sector.”
—Clayton W. Naeve, Ph.D.,
Senior Vice President and Chief Information Officer,
Endowed Chair in Bioinformatics,
St. Jude Children’s Research Hospital,
Memphis, TN
“Dr. Ed Amoroso reveals in plain English the threats and weaknesses of our critical infrastructure balanced against practices that reduce the exposures. This is an excellent guide
to the understanding of the cyber-scape that the security professional navigates. The book
takes complex concepts of security and simplifies it into coherent and simple to understand
concepts.”
—Arnold Felberbaum,
Chief IT Security & Compliance Officer,
Reed Elsevier
“The national infrastructure, which is now vital to communication, commerce and entertainment in everyday life, is highly vulnerable to malicious attacks and terrorist threats. Today, it
is possible for botnets to penetrate millions of computers around the world in few minutes,
and to attack the valuable national infrastructure.
“As the New York Times reported, the growing number of threats by botnets suggests that
this cyber security issue has become a serious problem, and we are losing the war against
these attacks.
“While computer security technologies will be useful for network systems, the reality
tells us that this conventional approach is not effective enough for the complex, large-scale
national infrastructure.
“Not only does the author provide comprehensive methodologies based on 25 years of experience in cyber security at AT&T, but he also suggests ‘security through obscurity,’ which
attempts to use secrecy to provide security.”
—Byeong Gi Lee,
President, IEEE Communications Society, and
Commissioner of the Korea Communications Commission (KCC)
Cyber Attacks
Protecting National
Infrastructure
Edward G. Amoroso
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Butterworth-Heinemann is an imprint of Elsevier
Acquiring Editor: Pam Chester
Development Editor: Gregory Chalson
Project Manager: Paul Gottehrer
Designer: Alisa Andreola
Butterworth-Heinemann is an imprint of Elsevier
30 Corporate Drive, Suite 400, Burlington, MA 01803, USA
© 2011 Elsevier Inc. All rights reserved
No part of this publication may be reproduced or transmitted in any form or by any means, electronic
or mechanical, including photocopying, recording, or any information storage and retrieval system,
without permission in writing from the publisher. Details on how to seek permission, further
information about the Publisher’s permissions policies and our arrangements with organizations such
as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our
website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the
Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience
broaden our understanding, changes in research methods or professional practices, may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating
and using any information or methods described herein. In using such information or methods they should be
mindful of their own safety and the safety of others, including parties for whom they have a professional
responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume
any liability for any injury and/or damage to persons or property as a matter of products liability,
negligence or otherwise, or from any use or operation of any methods, products, instructions, or
ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Amoroso, Edward G.
Cyber attacks : protecting national infrastructure / Edward Amoroso.
p. cm.
Includes index.
ISBN 978-0-12-384917-5
1. Cyberterrorism—United States—Prevention. 2. Computer security—United States. 3. National
security—United States. I. Title.
HV6773.2.A47 2011
363.325⬘90046780973—dc22
2010040626
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
Printed in the United States of America
10 11 12 13 14 10 9 8 7 6 5 4 3 2 1
For information on all BH publications visit our website at www.elsevierdirect.com/security
CONTENTS
CONTENTS
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
Acknowledgment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Chapter 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
National Cyber Threats, Vulnerabilities, and Attacks . . . . . . . . . . . . . . . . 4
Botnet Threat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
National Cyber Security Methodology Components . . . . . . . . . . . . . . . 9
Deception . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Consistency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Discretion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Correlation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Awareness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Implementing the Principles Nationally . . . . . . . . . . . . . . . . . . . . . . . . 28
Chapter 2 Deception . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Scanning Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Deliberately Open Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Discovery Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Deceptive Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exploitation Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Procurement Tricks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exposing Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Interfaces Between Humans and Computers . . . . . . . . . . . . . . . . . . . .
National Deception Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
35
37
39
41
42
45
46
47
49
v
vi
CONTENTS
Chapter 3 Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
What Is Separation? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Functional Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Infrastructure Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
DDOS Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
SCADA Separation Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Physical Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Insider Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Asset Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Multilevel Security (MLS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
53
55
57
60
62
63
65
68
70
Chapter 4 Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Diversity and Worm Propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Desktop Computer System Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . .
Diversity Paradox of Cloud Computing . . . . . . . . . . . . . . . . . . . . . . . . .
Network Technology Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Physical Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Diversity Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
75
77
80
82
85
87
Chapter 5 Commonality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Meaningful Best Practices for Infrastructure Protection. . . . . . . . . . . . 92
Locally Relevant and Appropriate Security Policy . . . . . . . . . . . . . . . . 95
Culture of Security Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Infrastructure Simplification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Certification and Education . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Career Path and Reward Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Responsible Past Security Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
National Commonality Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Chapter 6 Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Effectiveness of Depth. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Layered Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Layered E-Mail Virus and Spam Protection . . . . . . . . . . . . . . . . . . . . . . 119
CONTENTS
Layered Access Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Layered Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Layered Intrusion Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Program of Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
vii
120
122
124
126
Chapter 7 Discretion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Trusted Computing Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Security Through Obscurity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Information Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Information Reconnaissance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Obscurity Layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Organizational Compartments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Discretion Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
130
133
135
137
139
141
143
Chapter 8 Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Collecting Network Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Collecting System Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Security Information and Event Management . . . . . . . . . . . . . . . . . .
Large-Scale Trending . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tracking a Worm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Collection Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
148
150
154
156
159
161
Chapter 9 Correlation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Conventional Security Correlation Methods . . . . . . . . . . . . . . . . . . . .
Quality and Reliability Issues in Data Correlation . . . . . . . . . . . . . . . .
Correlating Data to Detect a Worm. . . . . . . . . . . . . . . . . . . . . . . . . . . .
Correlating Data to Detect a Botnet . . . . . . . . . . . . . . . . . . . . . . . . . . .
Large-Scale Correlation Process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Correlation Program. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
167
169
170
172
174
176
Chapter 10 Awareness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Detecting Infrastructure Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Managing Vulnerability Information . . . . . . . . . . . . . . . . . . . . . . . . . . 184
viii
CONTENTS
Cyber Security Intelligence Reports . . . . . . . . . . . . . . . . . . . . . . . . . . .
Risk Management Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Security Operations Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Awareness Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
186
188
190
192
Chapter 11 Response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Pre- Versus Post-Attack Response . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Indications and Warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Incident Response Teams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Forensic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Law Enforcement Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Disaster Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Response Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
195
197
198
201
203
204
206
Appendix Sample National Infrastructure Protection
Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Sample Deception Requi…
Purchase answer to see full
attachment