ITS 834 Campbellsville University Cyber Attacks on Oil and Gas Companies Discussion Please read the question, PPTS and start working on my question and I a

ITS 834 Campbellsville University Cyber Attacks on Oil and Gas Companies Discussion Please read the question, PPTS and start working on my question and I am attaching textbook for the reference

Make sure no plagarism and dont forget to add refernce

Attacks on our national infrastructure are already happening. And the expectation is that they will continue to increase at an accelerated rate. For this week’s discussion, we’ll cover threats to our nation’s pipelines. To get started, read this article:

https://www.eenews.net/stories/1060054924

After reading the article, start a discussion thread and discuss how the types of threats discussed in the article could impact our economy, and how implementing Diversity and Commonality (as discussed in chapters 5) could help mitigate these threats.

You must do this following:

1) Create a new thread. As indicated above, discuss how the types of threats discussed in the article referenced above could impact our economy, and how implementing Commonality (as discussed in chapters 5) could help mitigate these threats.

2) Select AT LEAST 3 other students’ threads and post substantive comments on those threads. Your comments should extend the conversation started with the thread.

All original posts and comments must be substantive. (I’m looking for about a paragraph – not just “I agree.”) Cyber Attacks
Protecting National Infrastructure, 1st ed.
Chapter 5
Commonality
Copyright © 2012, Elsevier Inc.
All Rights Reserved
1
• Certain security attributes must be present in all
aspects and areas of national infrastructure to
ensure maximum resilience against attack
• Best practices, standards, and audits establish a lowwater mark for all relevant organizations
• Audits must be both meaningful and measurable
Chapter 5 – Commonality
Introduction
– Often the most measurable things aren’t all that
meaningful
Copyright © 2012, Elsevier Inc.
All rights Reserved
2
• Common security-related best practices/standards
–
–
–
–
–
Federal Information Security Management Act (FISMA)
Health Insurance Portability and Accountability Act (HIPAA)
Payment Card Industry Data Security Standard (PCI DSS)
ETSI Cyber Security Technical Committee (TC-CYBER)
ISO/IEC 27000 Standard family (ISO27K)
Chapter 5 – Commonality
Introduction
• ISO 27001 – Security management systems
• ISO 27002 – Code of practice for InfoSec controls
– COBIT – Control Objectives for Information and related Technology
– NIST Cybersecurity Framework
Copyright © 2012, Elsevier Inc.
All rights Reserved
3
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Fig. 5.1 – Illustrative security audits for two
organizations
4
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Fig. 5.2 – Relationship between
meaningful and measurable
requirements
5
• The primary motivation for proper infrastructure
protection should be success based and economic
Chapter 5 – Commonality
Meaningful Best Practices for
Infrastructure Protection
– Not the audit score
• Security of critical components relies on
– Step #1: Standard audit
– Step #2: World-class focus
• Sometimes security audit standards and best
practices proven through experience are in conflict
Copyright © 2012, Elsevier Inc.
All rights Reserved
6
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Fig. 5.3 – Methodology to achieve
world-class infrastructure
protection practices
7
• Four basic security policy considerations are
recommended
– Enforceable: Policies without enforcement are not
valuable
– Small: Keep it simple and current
– Online: Policy info needs to be online and searchable
– Inclusive: Good policy requires analysis in order to include
computing and networking elements in the local nat’l
infrastructure environment
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Locally Relevant and
Appropriate Security Policy
8
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Fig. 5.4 – Decision process for security
policy analysis
9
• Create an organizational culture of security
protection
• Culture of security is one where standard operating
procedures provide a secure environment
• Ideal environment marries creativity and interest in
new technologies with caution and a healthy
aversion to risk
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Culture of Security Protection
10
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Fig. 5.5 – Spectrum of organizational
culture of security options
11
• Organizations should be explicitly committed to
infrastructure simplification
• Common problems found in design and operation of
national infrastructure
–
–
–
–
Chapter 5 – Commonality
Infrastructure Simplification
Lack of generalization
Clouding the obvious
Stream-of-consciousness design
Nonuniformity
Copyright © 2012, Elsevier Inc.
All rights Reserved
12
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Fig. 5.6 – Sample cluttered engineering
chart
13
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Fig. 5.7 – Simplified engineering chart
14
• How to simplify a national infrastructure
environment
–
–
–
–
–
Reduce its size
Generalize concepts
Clean interfaces
Highlight patterns
Reduce clutter
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Infrastructure Simplification
15
• Key decision-makers need certification and education
programs
• Hundred percent end-user awareness is impractical;
instead focus on improving security competence of
decision-makers
–
–
–
–
Chapter 5 – Commonality
Certification and Education
Senior Managers
Designers and developers
Administrators
Security team members
• Create low-cost, high-return activities to certify and
educate end users
Copyright © 2012, Elsevier Inc.
All rights Reserved
16
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Fig. 5.8 – Return on investment (ROI)
trends for security education
17
• Create and establish career paths and reward
structures for security professionals
• These elements should be present in national
infrastructure environments
Chapter 5 – Commonality
Career Path and Reward Structure
– Attractive salaries
– Career paths
– Senior managers
Copyright © 2012, Elsevier Inc.
All rights Reserved
18
• Companies and agencies being considered for
national infrastructure work should be required to
demonstrate past practice in live security incidents
• Companies and agencies must do a better job of
managing their inventory of live incidents
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
Responsible Past Security Practice
19
• Companies and agencies being considered for
national infrastructure work should provide evidence
of the following past practices
Chapter 5 – Commonality
Responsible Past Security Practice
– Past damage
– Past prevention
– Past response
Copyright © 2012, Elsevier Inc.
All rights Reserved
20
• A national commonality plan involves balancing the
following concerns
– Plethora of existing standards
– Low-water mark versus world class
– Existing commissions and boards
Copyright © 2012, Elsevier Inc.
All rights Reserved
Chapter 5 – Commonality
National Commonality Program
21
Cyber Attacks
“Dr. Amoroso’s fifth book Cyber Attacks: Protecting National Infrastructure outlines the challenges of protecting our nation’s infrastructure from cyber attack using security techniques
established to protect much smaller and less complex environments. He proposes a brand
new type of national infrastructure protection methodology and outlines a strategy presented
as a series of ten basic design and operations principles ranging from deception to response.
The bulk of the text covers each of these principles in technical detail. While several of these
principles would be daunting to implement and practice they provide the first clear and concise framework for discussion of this critical challenge. This text is thought-provoking and
should be a ‘must read’ for anyone concerned with cybersecurity in the private or government
sector.”
—Clayton W. Naeve, Ph.D.,
Senior Vice President and Chief Information Officer,
Endowed Chair in Bioinformatics,
St. Jude Children’s Research Hospital,
Memphis, TN
“Dr. Ed Amoroso reveals in plain English the threats and weaknesses of our critical infrastructure balanced against practices that reduce the exposures. This is an excellent guide
to the understanding of the cyber-scape that the security professional navigates. The book
takes complex concepts of security and simplifies it into coherent and simple to understand
concepts.”
—Arnold Felberbaum,
Chief IT Security & Compliance Officer,
Reed Elsevier
“The national infrastructure, which is now vital to communication, commerce and entertainment in everyday life, is highly vulnerable to malicious attacks and terrorist threats. Today, it
is possible for botnets to penetrate millions of computers around the world in few minutes,
and to attack the valuable national infrastructure.
“As the New York Times reported, the growing number of threats by botnets suggests that
this cyber security issue has become a serious problem, and we are losing the war against
these attacks.
“While computer security technologies will be useful for network systems, the reality
tells us that this conventional approach is not effective enough for the complex, large-scale
national infrastructure.
“Not only does the author provide comprehensive methodologies based on 25 years of experience in cyber security at AT&T, but he also suggests ‘security through obscurity,’ which
attempts to use secrecy to provide security.”
—Byeong Gi Lee,
President, IEEE Communications Society, and
Commissioner of the Korea Communications Commission (KCC)
Cyber Attacks
Protecting National
Infrastructure
Edward G. Amoroso
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Butterworth-Heinemann is an imprint of Elsevier
Acquiring Editor: Pam Chester
Development Editor: Gregory Chalson
Project Manager: Paul Gottehrer
Designer: Alisa Andreola
Butterworth-Heinemann is an imprint of Elsevier
30 Corporate Drive, Suite 400, Burlington, MA 01803, USA
© 2011 Elsevier Inc. All rights reserved
No part of this publication may be reproduced or transmitted in any form or by any means, electronic
or mechanical, including photocopying, recording, or any information storage and retrieval system,
without permission in writing from the publisher. Details on how to seek permission, further
information about the Publisher’s permissions policies and our arrangements with organizations such
as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our
website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the
Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience
broaden our understanding, changes in research methods or professional practices, may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating
and using any information or methods described herein. In using such information or methods they should be
mindful of their own safety and the safety of others, including parties for whom they have a professional
responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume
any liability for any injury and/or damage to persons or property as a matter of products liability,
negligence or otherwise, or from any use or operation of any methods, products, instructions, or
ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Amoroso, Edward G.
Cyber attacks : protecting national infrastructure / Edward Amoroso.
p. cm.
Includes index.
ISBN 978-0-12-384917-5
1. Cyberterrorism—United States—Prevention. 2. Computer security—United States. 3. National
security—United States. I. Title.
HV6773.2.A47 2011
363.325⬘90046780973—dc22
2010040626
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
Printed in the United States of America
10 11 12 13 14 10 9 8 7 6 5 4 3 2 1
For information on all BH publications visit our website at www.elsevierdirect.com/security
CONTENTS
CONTENTS
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
Acknowledgment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Chapter 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
National Cyber Threats, Vulnerabilities, and Attacks . . . . . . . . . . . . . . . . 4
Botnet Threat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
National Cyber Security Methodology Components . . . . . . . . . . . . . . . 9
Deception . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Consistency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Discretion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Correlation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Awareness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Implementing the Principles Nationally . . . . . . . . . . . . . . . . . . . . . . . . 28
Chapter 2 Deception . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Scanning Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Deliberately Open Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Discovery Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Deceptive Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exploitation Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Procurement Tricks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exposing Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Interfaces Between Humans and Computers . . . . . . . . . . . . . . . . . . . .
National Deception Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
35
37
39
41
42
45
46
47
49
v
vi
CONTENTS
Chapter 3 Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
What Is Separation? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Functional Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Infrastructure Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
DDOS Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
SCADA Separation Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Physical Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Insider Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Asset Separation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Multilevel Security (MLS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
53
55
57
60
62
63
65
68
70
Chapter 4 Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Diversity and Worm Propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Desktop Computer System Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . .
Diversity Paradox of Cloud Computing . . . . . . . . . . . . . . . . . . . . . . . . .
Network Technology Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Physical Diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Diversity Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
75
77
80
82
85
87
Chapter 5 Commonality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Meaningful Best Practices for Infrastructure Protection. . . . . . . . . . . . 92
Locally Relevant and Appropriate Security Policy . . . . . . . . . . . . . . . . 95
Culture of Security Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Infrastructure Simplification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Certification and Education . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Career Path and Reward Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Responsible Past Security Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
National Commonality Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Chapter 6 Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Effectiveness of Depth. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Layered Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Layered E-Mail Virus and Spam Protection . . . . . . . . . . . . . . . . . . . . . . 119
CONTENTS
Layered Access Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Layered Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Layered Intrusion Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Program of Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
vii
120
122
124
126
Chapter 7 Discretion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Trusted Computing Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Security Through Obscurity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Information Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Information Reconnaissance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Obscurity Layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Organizational Compartments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Discretion Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
130
133
135
137
139
141
143
Chapter 8 Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Collecting Network Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Collecting System Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Security Information and Event Management . . . . . . . . . . . . . . . . . .
Large-Scale Trending . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tracking a Worm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Collection Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
148
150
154
156
159
161
Chapter 9 Correlation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Conventional Security Correlation Methods . . . . . . . . . . . . . . . . . . . .
Quality and Reliability Issues in Data Correlation . . . . . . . . . . . . . . . .
Correlating Data to Detect a Worm. . . . . . . . . . . . . . . . . . . . . . . . . . . .
Correlating Data to Detect a Botnet . . . . . . . . . . . . . . . . . . . . . . . . . . .
Large-Scale Correlation Process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
National Correlation Program. . . . . . . . . . . . . . . . . . …
Purchase answer to see full
attachment