Presentation is loading. Please wait.

Presentation is loading. Please wait.

E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 1 of 49 Information.

Similar presentations


Presentation on theme: "E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 1 of 49 Information."— Presentation transcript:

1 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 1 of 49 Information Insecurity Part I: The Problem

2 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 2 of 49 Cyber-attacks are different No need for physical contact with the victims Easy to learn techniques and acquire tools Small investment can cause massive economic damage Many network operators and countries may be involved When done subtly it leaves few or no traces Easy for the players to hide Inadequate cyberspace legislation

3 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 3 of 49 Today’s Seven major threats 1.State sanctioned information warfare 2.Information counter-intelligence 3.Cyber-terrorism 4.Cyber-organized crime 5.Information sabotage 6.Cyber-crime 7.Cyber-hooliganism

4 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 4 of 49 Cyberterror and Cyberwar Question 1 What constitutes an act of war in Cyberspace? Question 2 What is cyber-terrorism? Lack of definitions Electromagnetic pulse Attack on military networks/ computers Attack on critical civilian infrastructure (electricity, water, transport, hospitals) Disruption of civil systems (tax, social security, banking) Disinformation not IF but WHEN

5 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 5 of 49 Cybercriminals Financial fraud Theft of intellectual property Money laundering Unlicensed gambling Pornography Identity theft Industrial (& other) espionage Extortion and many other…

6 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 6 of 49 Cyberhooligans Spam Synchronised DOS attack Hijacking a computer Disseminating virus/worm (without destructive payload) Redirecting website traffic Website Spoofing Website defacement Activating intrusion detection

7 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 7 of 49 It all started with the invention of writing Bronze Age cuneiform writing on clay tablet Accounting document in which the pictures represent goods and the notches quantities Mesopotamia ± 6,000 years ago Musée du Louvre, Paris and the need to keep secrets

8 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 8 of 49 Followed by more inventions Paper Printing Books Libraries Photography Phonograph Photocopier Scanner Digital everything Growing ease of copying (copyright issues) making increasing use of binary digits (bits)

9 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 9 of 49 Cyberspace: the world of bits World Wide Web Deep Web Intranets Extranets Networks not using Internet technologies OECD’s “OLIS” Business to Business procurement (B2B) Computer aided design done jointly by several companies Satellite communications Military communications Railroad communications Air traffic control Nuclear utilities 400 million “users” and growing

10 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 10 of 49 What do we do in cyberspace? Transaction Process support Publication Analysis E-commerce Treasury, funds transfer Stock Exchanges Airline reservations Procurement Messaging Usually Mission Critical Statistics Data mining Credit rating Actuarial analysis Business Intelligence Situation Analysis Some may be Mission Critical Some may not be Mission Critical Factory automation Air traffic control Utilities Logistics and tracking Accounting and payroll Knowledge management Office automation Wire services e-publishing Interactive databases Publishing Increasingly Mission Critical ever expanding lists of possibilities

11 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 11 of 49 The world of bits and atoms (1) Scheduling: timetable Scheduling: aircraft/ trains, etc Scheduling: maintenance Scheduling: staff and crews Calculating fuel requirements Traffic Control Ticketing, fares and yield management Passenger information systems Modeling and traffic rerouting etc.

12 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 12 of 49 The world of bits and atoms (2) Robotic systems Computer assisted manufacturing Mass customization Just in time logistics Assembly line monitoring Quality assurance and controls etc.

13 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 13 of 49 The world of bits and atoms (3) Electricity generation Water treatment 7 days a week, 24 hours a day operations Safety monitoring and controls Environmental controls (for discharges) Quality assurance and controls Distribution management etc.

14 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 14 of 49 And more: vital services Skills and knowledge intensive I.T. is becoming a component in all of them Emergency services Hospitals Education

15 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 15 of 49 Crime and punishment Codes of conduct and law recorded since the invention of writing Humans are tool makers. Tools have always been used creatively in crime and war Legislation develops less fast than technology and new forms of crime Law enforcement is not a 100% answer Code of Hammurabi contains 282 proclamations (laws) Mesopotamia ~ 3300 years ago Musée du Louvre, Paris particularly in cyberspace

16 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 16 of 49 Types of cyber-attack Computers and communications as tools Breaking passwords Decryption Interception Computers and communications as weapons Malicious code dis-information sabotage smart weapons Computers and communications as a target Fraud Extorsion Disruption Espionage

17 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 17 of 49 101101010… Many forms of attack Many players Everyone a target Every system a challenge No need for physical contact Few, if any, traces left Inadequate or non-existent legislation

18 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 18 of 49 Attack trends: malicious code Source: CERT, Computer Emergency Response Team April 2002 at Carnegie Mellon University www.cert.org Year 1995199619971998199920002001 Vulnerabilities 17134531126241710902437 Year 1988198919901991199219931994 Incidents reported 613225240677313342340 Year 1995199619971998199920002001 Incidents reported 240225732134373498592175652658 Vulnerabilities reported to CERT Number of incidents reported to CERT

19 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 19 of 49 Economic Impact (1) Average bank holdup: $ 14,000 dollars Average computer theft: $ 2,000,000 dollars Source: Association of Certified Fraud Examiners (U.S.A.), 2000

20 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 20 of 49 Economic Impact (2) CODE RED (a worm) infected 360,000 web servers in the first 14 hours Source: Computer Economics Inc, 2000 The bad news: CODE RED and NIMDA had no destructive payload and are seen as “proof of concept” for future designs It then spread around the world in 48 hours

21 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 21 of 49 Economic Impact (3) Estimated cost of virus and worm infections in 2001 – 17 billion US dollars to clean malicious software from all equipment restore lost and damaged data help end users and clients test and return systems to normal operations loss of productivity as a result of downtime Assumes 1 person-minute = 1 $

22 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 22 of 49 The Players – by organization Individual users Small businesses Large enterprises and organizations National government and legislation Vendors and service providers Higher education Critical Infrastructures International Organizations

23 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 23 of 49 Critical infrastructures Oil refineries and distribution depots Airlines and air traffic control Banking and financial services Power generation and distribution pipelines Water purification and distribution IXPs Public transport Emergency services Fixed and mobile telecommunications

24 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 24 of 49 Public domain information Some of these Exchanges are not secure facilities

25 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 25 of 49 so far, just fun www.turnofftheinternet.com

26 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 26 of 49 Special responsibilities Ensure computing is highly secure Monitor and deal with vulnerabilities continually Maintain effective boundaries with the Internet Employ qualified and trained I.T. security personnel Manage interdependencies with other critical infrastructures Share information with other critical infrastructures Have ready disaster recovery and crisis management plans Seek, obtain and maintain security certification CRITICAL INFRASTRUCTURES

27 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 27 of 49 Special responsibilities NATIONAL GOVERNMENT AND LEGISLATION Implement national security programs Promote standards and best practices Ensure clear definition of accountability and oversight Conduct security audits of government agencies Provide adequate funding for information security Recruit, train and retain qualified I.T. security personnel Conduct awareness programs for government employees Make arrangements for reporting security incidents Have warning, analysis, incident response and recovery procedures

28 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 28 of 49 Special responsibilities INTERNATIONAL ORGANIZATIONS Encourage international standards for information security Develop mechanisms for international cooperation Develop appropriate governance of cyberspace Create effective mechanisms for sharing information

29 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 29 of 49 Special responsibilities VENDORS AND SERVICE PROVIDERS Balance “time to market” against product vulnerabilities Protect the interests of customers by providing alerts, patches, fixes and upgrades, perform more functions for them Liaise with User Groups and others to reduce vulnerabilities Develop fair terms and conditions of software licences that do not absolve vendors from responsibility and liability Collaborate in the pursuit of cyber-attackers by providing access to records, logs and data

30 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 30 of 49 Special responsibilities LARGE ENTERPRISES AND ORGANIZATIONS Establish clear responsibility for information security and appropriate reporting lines The CEO, the Board and the Auditors should know about standards, best practices and self-evaluation Establish enterprise-wide security policies including what should be disclosed to the Board, stakeholders, auditors, etc Implement employee awareness programs Manage insider threats (and balance risk vs. employee privacy) Have appropriate risk management and insurance cover Have working arrangements to report security incidents

31 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 31 of 49 Special responsibilities HIGHER EDUCATION Take steps to prevent attacks originating within Institutions Protect critical information from external and internal attack Organize for security as a shared concern with other Institutions worldwide

32 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 32 of 49 Special responsibilities SMALL BUSINESSES AND INDIVIDUALS Be aware of cyber-security issues and of how to deal with vulnerabilities and incidents Awareness of the security issues of new technologies such as ADSL, wireless connectivity, etc Require vendors to disclose risks Need for Internet Service Providers to perform more cyber-security functions for home users ?

33 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 33 of 49 The Players – by nature Responsible end-users Security administrators Security managers Internal auditors Security coordinators Providers of security alerts Ethical hackers Malicious insiders Script kiddies Hackers, crackers, phreakers Hacktivists Spies (industrial and other) Organised crime Cyber-terrorists Vendors Security auditors Security consultants Legislators BAD GUYS VERY SPECIAL GUYS GOOD GUYS and many more

34 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 34 of 49 The Bad Guys Knowledge Access Motivation Malicious insiders Script kiddies Hackers, crackers, phreakers Hacktivists Spies (industrial and other) Organised crime Cyber-terrorists

35 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 35 of 49 ACCESS mechanisms OFFICIAL UNOFFICIAL Authorized insiders Rights of former personnel (should have been removed) Disclosure by insiders Abuse of insider knowledge Abuse of presence as visitor Theft of ID and password Newly discovered vulnerabilities Hacker club disclosures Forced entry (password breaker)

36 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 36 of 49 Knowledge sources Shared through hacker groups and conferences Obtained by following public discussions on product vulnerabilities Privileged insider knowledge Buying commercially available hacking tools Virus, worm and other malicious code design

37 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 37 of 49

38 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 38 of 49 What motivates the Bad Guys (1) nuisances Script Kiddies Ethical Hackers Individual copyright violators Hacktivists Cyber-hooligans Emulate the “big boys” ego-trip Deny service (sit-in) Make themselves heard Cause embarrassment Malice Gain publicity Defy authority Safely break the law Minor financial gain Show how smart they are Identify vulnerabilities = fun Many become security consultants

39 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 39 of 49 What motivates the Bad Guys (2) Industrial + spies Business copyright violatorsNon-ethical Hackers (crackers) Virus and worm designers almost always MONEY “Just because it’s there” Test new ways to spread malicious code Cause loss or corruption of data Steal IDs and passwords Impersonation and spoofing Steal credit card and similar data Sabotage, etc Low risk of detection and punishment

40 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 40 of 49 What motivates the Bad Guys (3) Organized crime Malicious insider Strong personal animosity towards a person Grudge against employer Criminal intent: fraud, extortion, theft, corruption of data, sabotage, etc Low risk of detection and punishment New areas of opportunity - globally Ease of hiding in cyberspace Ease of establishing global networks Lack of legislation and jurisdiction Interpol, Europol, FBI, Chambers of Commerce and many others organizing to fight it

41 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 41 of 49 What motivates the Bad Guys (4) Cyber-terrorists Ease of establishing global networks Ability to hide in cyberspace Lack of legislation and jurisdiction Richness of opportunity Availability and low cost of resources needed Impact of successful attacks Visibility Driven by ideology

42 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 42 of 49 Hiding in cyber-space (1) Encryption Voice, fax and data communications E-mail Stored data In public postings Dorothy Denning and William Baugh Information, Communication and Society, 1999 Digital compression Steganography XWR2T P5%WZ $E#GT LLVWLSHVBNRMVDFRMTHTXT Message bits are mixed with the bits defining the image

43 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 43 of 49 Hiding in cyber-space (2) Use of passwords Hiding information in remote servers Disabling audit logs in servers Anonymous remailers Anonymous digital cash Computer penetration and looping Cellphone cloning Cellphone pre-paid cards Anonymity Nobody knows who you are Nobody knows where you are

44 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 44 of 49 Offences – forms of attack Aiding and abetting cyber-criminals Fraud, embezzlement Forgery CATEGORIES Data-related Interception Modification Theft Network-related Interference Sabotage Anonymity Access-related Hacking Malicious code distribution Computer-related

45 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 45 of 49 Network-related offences Interference Sabotage Denial of service Control of a server or network devices Using a trusted network to access another network “Sniffing” traffic Hoaxes Physical disconnection or damage Corruption of Domain Name Servers Attack on an Internet Exchange Point (IXP) Attack of a critical infrastructure Anonymity Stolen and cloned cellphones Hijacking the ID and password of a legitimate network user

46 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 46 of 49 Data-related offences Interception Modification Theft Defacement of a website e-mail spoofing and impersonation Database and document contents Commercial transactions Intellectual property Personal data User IDs and passwords Non-public domain information Voice and fax e-mail Data transfers (fixed and mobile) 10010101001

47 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 47 of 49 Access-related offences Hacking Distribution of malicious code Unauthorized access to networks and computer systems Use of electronic services without payment Deleting and/or destroying data Disclosure of security weaknesses found and how to overcome them Invasion of privacy To launch a distributed denial of service attack To slow down/close down a network (worm) To corrupt servers and data (virus and/or worm) To gain control of a server or device (trojan horse, back door) To extort payment (logical bomb)

48 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 48 of 49 Computer-related offences Aiding and abetting cyber-crime Fraud Forgery Providing (knowingly or not) technical, financial and legal facilities for conducting and/or hiding cyber-crime Messaging and documents Digital I.D. Copyrighted data (software, music, e-book) Falsification of financial transactions Misuse of credit card and personal data Unlicensed financial services, gambling

49 E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 49 of 49 Impact of various offences Most pervasiveMost expensive Most publicisedMost frequent Virus, worm, trojan horse Insider fraud, sabotage Theft of proprietary information Attacks on e-business - theft of credit card data - Denial of Service Developers’ mistakes Network misconfiguration Poor system administration


Download ppt "E. Gelbstein A. Kamal Information Insecurity Part I: The Problem Next slide: PgDn or Click Previous slide: PgUp To quit the presentation: Esc 1 of 49 Information."

Similar presentations


Ads by Google