View
1
Download
0
Category
Preview:
Citation preview
CCYBER YBER TTERRORISM ERRORISM & & IINFORMATIONNFORMATION M MANAGEMENT ANAGEMENT
SSECURITYECURITY
BBY:Y: JJITESH,ITESH,HHARSH & ARSH & AAAYUSHIAYUSHI IT BIT BRANCH RANCH 11stst year year
TermsTerms Cyber Terrorism – The use of net for Cyber Terrorism – The use of net for terrorismterrorism
Cyber Crime – Use of net for criminals Cyber Crime – Use of net for criminals actions.actions.
Cyber Attacks – Email Cyber Attacks – Email bombs,viruses,intentional actionsbombs,viruses,intentional actions
Information Warfare – Formalized govermental Information Warfare – Formalized govermental warfarewarfare
Netwar – Conducting war via net & networksNetwar – Conducting war via net & networks Techno Terrorism – Use of technology by Techno Terrorism – Use of technology by terrorist groupsterrorist groups
The Cyber Threat According to the United Nations
“The rapid transnational expansion of large-scale computer networks and the ability to access many systems through regular telephone lines increases the vulnerability of these systems and the opportunity for misuse or criminal activity. The consequences of computer crime may have serious economic costs as well as serious costs in terms of human security.”
Terrorism & the Internet
The use of the Internet and the computer networks will represent a major challenge in the near future. Such use could include use of the nets not only as a propaganda tool, but also as a means of communication between militants of terrorist organization and between various organizations.”
Dr. Ely Karmon, Intelligence and the Challenge of Terrorism in the 21stCentury
Netwar, Technology & Terrorism
“netwar refers to an emerging mode of conflict and crime at societal levels, involving measures short of traditional war, in which the protagonists use network forms of organization and related doctrines, strategies, and technologies attuned to the information age”–John Arquilla, David Ronfeldt, Michele ZaniniNetworks,Netwarand Information Age Terrorism
Terrorists & Information Technology
Terrorist groups are learning to use IT for decision making and other organizational purposes. They are using the same technology as an offensive weapon to destroy or disrupt.
The Threat is not Traditional
There is a new generation of radicals and activists just beginning to create information-age ideologies, in which identities and loyalties may shift from the nation-state to the transnational level of global civil society.
The Threat is Rising
•An increasing number of terrorist groups are relying on information technology to support such structures.
•Newer groups are more networked than traditional groups.
The Threat Is Real
Governments and their surrogates are using the Internet to harass political opponents and unfriendly neighbors, to go after business trade secrets, and to prepare for outright warfare. The government of Myanmar is blamed for targeting the "Happy 99" E-mail virus at opponents who use the Net to advance their cause.
Governments are Attacking Governments
Hackers from Azerbaijan ( thought to be government agents) tampered with dozens of Armenian-related Web sites, including host computers in the United States. Relations are tense between Azerbaijan and Armenia -it wasn't long before the Armenians retaliated in kind.
The 3rdWorld Is Active
More than a dozen countries–among them Russia, China, Iraq, Iran, and Cuba–are developing significant information-warfare capabilities. A senior CIA official cited a Russian general who compared the disruptive effects of a cyber attack on a transportation or electrical grid to those of a nuclear weapon.
Cyber-Spying Is Occurring
Successful cyber war does not have a face. Tapping into a command-and-control/enterprise management system could yield a gold mine of data about plans, processes and strategies. The longer a cyber spy conceals his/her presence, the longer the intelligence flows.
Private Industry Is A Major Target
Governments, and industry, are hungry for intellectual property, business processes, and methodology will, and are, targeting private industry as much as, or more so, than other governments.
Attacks Are On The Rise
A recent FBI survey found that 90 percent of respondents detected security breaches within the last 12 months. 80 percent acknowledged financial losses due to security breaches.
Attacks are More Frequent
•Based on FBI investigations and other information, there has recently been an increase in hacker activity specifically targeting systems associated withe-commerceand other internet-hosted sites.
•In most cases, the hacker activity had been ongoing for several months before the victim became aware of the intrusion.
Common Types of Cyber Crimes
•Fraud by computer manipulation •Computer forgery •Damage to or modifications of computer data or programs
•Unauthorized access to computer systems and service
•Unauthorized reproduction of legally protected computer programs
Motivations for Cyber Attack
•Vandalism •Anger (Insiders) •Political •Curiosity •Notoriety •Malice •Personal Gai
Assets That Need Protection
•Software, data and information •Data-processing services •Electronic data-processing equipment
•Electronic data-processing facilities
Potential Cyber Security Risks
•Hosts running unnecessary services •Outdated code •Information leakage •Misappropriated trust relationships
•Misconfiguredfirewall or ACL •Weak passwords
Potential Cyber Security Risks
•MisconfiguredWeb servers •Improperly exported file sharing •MisconfiguredNT servers •Inadequate logging and detecting •Unsecured remote access •Lack of defined security policy
Cyber Vulnerabilities
Policy vulnerabilities -i.e. simple passwords, unauthorized software or hardware, authorization, etc.
•Configuration vulnerabilities -software with known problems, privileges enabled, etc.
•Technology vulnerabilities -old technology, technology with known vulnerabilities, etc.
Cyber Vulnerabilities
Density of information and processes •System accessibility •Complexity •Electronic vulnerability •Vulnerability of electronic data-processing media
•Physical security of building(s). •Human factors
Cyber Vulnerabilities •Insider attacks!
•Software bugs •Human errors and mis-configurations •Enabled/unused services •Susceptibility to denial of service attacks …in network services and architecture, operating systems, applications
The “Hacker”or “Cyber-terrorist”Attack
Five Common Attack Methods •Network packet sniffers •IP spoofing •Password attacks •Denial-of-service attacks •Application layer attacks
Network Packet Sniffers
A packet snifferis a software application that uses a network adapter card in promiscuous mode to capture all network packets that are sent across a local-area network and send that to an application for processing.
IP Spoofing An IP spoofing attackoccurs when an attacker outside your network pretends to be a trusted computer either by using an IP address that is within the range of IP addresses for your network or by using an authorized external IP address that you trust and to which you wish to provide access to specified resources on your network.
Password Attacks
Password attackscan be implemented using brute-force attacks, Trojan horse programs, IP spoofing, and packet sniffers. Password attacks usually refer to repeated attempts to identify a user account and/or password; these repeated attempts are called brute-force attacks.
Denial-of-Service Attacks
Denial-of-serviceattacks are different from most other attacks because they are not targeted at gaining access to your network or the information on your network --They focus on making a service unavailable for normal use.
Distributed Denial of Service (DDoS)
Same methods and tools as DoS •Much larger scale attacks –Elephant hunting
•Uses hundreds or even thousands of attacking points to overwhelm target
•Very difficult to determine difference between DDoSand normal network outage
Application Layer Attacks
Application-layer attacksexploit well-known weaknesses in software commonly found on servers, such as FTP. Attackers can gain access to a computer with the permissions of the account running the application, which is usually a privileged system-level account. Trojan horse program attacks are an example.
The Cyber Security Process
Security is the mitigation of riskassociated with providing network connectivity to employees, partners and customers.
•Organizations need to focus on their security requirements to create a Security Policyand then allocate budget accordingly.
•Security is a Processwith Security Policy being the cornerstone of the customers’security architecture.
Contingency Planning
Contingency planning refers to a coordinated strategy involving plans, procedures, and technical measures that enable the recovery of IT systems, operations, and data after a disruption and generally includes one or more approaches: •Restoring IT operations at an alternate location •Recovering IT operations using alternate equipment
•Performing some or all of the affected business processes using non-IT (manual) means.
Best Practice #1
General Management Managers throughout the organization must consider information security a normal part of their responsibility and the responsibility of every employee.
Best Practice #2
Policy
Develop, deploy, review, and enforce security policies that satisfy business objectives.
Best Practice #3
Risk Management Periodically conduct an information security risk evaluation that identifies critical information assets (e.g., systems, networks, data), threats to critical assets, asset vulnerabilities, and risks.
Best Practice #4
Security Architecture & Design
Generate, implement, and maintain an enterprise-(or site-) wide security architecture, based on satisfying business objectives and protecting the most critical information assets.
Best Practice #5
User Issues: Accountability and
Training Establish accountability for user actions, train for accountability and enforce it, as reflected in organizational policies and procedures. Users include all those who have active accounts such as employees, partners, suppliers, and vendors.
Best Practice #6
User Issues: Adequate Expertise
Ensure that there is adequate in-house expertise or explicitly outsourced expertise for all supported technologies (e.g., host and network operating systems, routers, firewalls, monitoring tools, and applications software), including the secure operation of those technologies.
Best Practice #7
System & Network Management: Access Control Establish a range of security controls to protect assets residing on systems and networks.
Best Practice #8
System & Network Management: Software
Integrity Regularly verify the integrity of installed software.
Best Practice #9
System & Network Management: Secure Asset
Configuration
System & Network Management: Backups
Best Practice #10
System & Network Management: Backups
Mandate a regular schedule of backups for both software and data.
Best Practice #11
Authentication & Authorization: Users
Implement and maintain appropriate mechanisms for user authentication and authorization when using network access from inside and outside the organization. Ensure these are consistent with policies, procedures, roles, and levels of restricted access required for specific assets.
Best Practice #12
Authentication & Authorization: Remote and
3rd Parties Protect critical assets when providing network access to users working remotely and to third parties such as contractors and service providers. Use network-, system-, file-, and application-level access controls and restrict access to authorized times and tasks, as required.
Best Practice #13
Monitor & Audit Use appropriate monitoring, auditing, and inspection facilities and assign responsibility for reporting, evaluating, and responding to system and network events and conditions.
Best Practice #14
Physical Security Control physical access to information assets and IT services and resources.
Best Practice #15
Continuity Planning & Disaster Recovery
Develop business continuity and disaster recovery plans for critical assets and ensure that they are periodically tested and found effective.
Recommended