Information Warfare Playgrounds to Battlegrounds

CSCE Farkas2 Last Class: Theory of IW Information resources Players Offensive operations Defensive operations WIN-LOSE NATURE OF OPERATIONS

Security Objectives Confidentiality Integrity Availability CSCE Farkas3

4 Offense Increase availability of resource for the offense Decrease integrity of resource for the defense Decrease availability of resource for defense

CSCE Farkas5 Defense Prevent availability of resource for offense Ensure integrity of resource for the defense Ensure availability of resource for the defense

CSCE Farkas6 Offense: Increased availability Collection of secret: – Espionage (illegal) and intelligence (may be legal) Piracy Penetration (hacking) Superimposition fraud (use by the offense on the defense’s legitimate usage) Identity theft Perception management (affect beliefs and behavior)

CSCE Farkas7 Offense: Decrease Availability for Defense Physical theft Sabotage Censorship

CSCE Farkas8 Offense: Decreased Integrity Tampering Penetration – Cover up – Virus, worm, malicious code Perception management – Fabrication, forgeries, fraud, identity theft, social engineering

CSCE Farkas9 Defense Prevention: keeps attacks from occurring Deterrence: makes attack unattractive Indications and warning: recognize attacks before it occurs Detection: recognize attacks Emergency preparedness: capability to recover from and response to attacks Response: actions taken after the attack

Playgrounds to Battlegrounds

CSCE Farkas11 IW Activities Context of human actions and conflict Domains: – Play: hackers vs. owners – Crime: perpetrators vs. victims – Individual rights: individuals vs. individuals/organizations/government – National security: national level activities

CSCE Farkas12 Play Playing pranks Actors: hackers/crackers/phreakers Motivation: challenge, knowledge, thrill Culture: social/educational – “global networks” – publications – forums Law – DHS, Cybersecurity Laws & Regulations,

CSCE Farkas13 Crime Intellectual Property Crimes – IT targets: research and development, manufacturing and marketing plan, customer list, etc. – 1996: Economic Espionage Act (U.S. Congress) + amendments Fraud – Telemarketing scam, identity theft, bank fraud, telecommunication fraud, computer fraud and abuse Fighting crime P. Roberts, U.S. Congress Hears Of Growing Cyber Espionage Threat To U.S., 06/ , growing-cyber-espionage-threat-us http://threatpost.com/en_us/blogs/us-congress-hears- growing-cyber-espionage-threat-us

CSCE Farkas14 Crime Actors: – Employees – Temp. staff – Vendors – Suppliers – Consultants Trade secrets Identity theft Law

CSCE Farkas15 Individual Rights Privacy – Secondary use of information Free speech – Harmful/disturbing speech – Theft and distribution of intellectual property – Censorship E. Moyer, In Swartz protest, Anon hacks U.S. site, threatens leaks, 01/28/2013, _ /in-swartz-protest-anon-hacks-u.s- site-threatens-leaks/ 1009_ /in-swartz-protest-anon-hacks-u.s- site-threatens-leaks/

CSCE Farkas16 National Security Foreign Intelligence – Peace time: protecting national interests Open channels, human spies, electronic surveillance, electronic hacking (?) – War time: support military operations – U.S. Intelligence Priorities: Intelligence supporting military needs during operation Intelligence about hostile countries Intelligence about specific transnational threats – Central Intelligence Agency (CIA) – Primary targets in USA: high technology and defense- related industry

CSCE Farkas17 War and Military Conflict IT support, e.g., sensors, weapons, surveillance, etc. Psyops and perception management Physical weapons (?) Cyber space battle (?) Unmanned devices (?)

CSCE Farkas18 Terrorism Traditional: – Intelligence collection – Psyops and perception management New forms: – Exploitation of computer technologies Internet propaganda Cyber attacks (electronic mail flooding, DOS, etc.) Protection of national infrastructure

Awareness Insider threat Remote access – authentication Counterfeit hardware Abuse of security guidelines CSCE Farkas19

Origin of Attacks Vulnerable computers – Dependence on computers – Education of users – Economy – Monopoly of OS Non-state actors CSCE Farkas20