1. Lesson 2 Computer Security Incidents Taxonomy

2. Need an accepted taxonomy because... Provides a common frame of reference If no taxonomy, then we: Can’t develop common reporting criteria Can’t develop processes and standardization Ultimately-no IA “Common Language”

3. Must have these characteristics... + = Logically related columns 1 1 2 2 3 3 4 4 5 5 1 1 2 2 3 3 1 1 2 2 3 3 4 4 Must be: Mutually exclusive Unambiguous Repeatable Accepted Useful Exhaustive

4. Where to start? For this reason several computer security taxonomies have already been developed Currently in use at Carnegie Mellon’s CERT/CC The inability to share data because of non- standard terminology is not a new problem Most comprehensive study done by Sandia Labs in conjunction with Carnegie Mellon University Sandia Report: “A Common Language for Computer Security Incidents”, John D. Howard and Thomas A. Longstaff (October 1998)

5. Sandia Labs Network Based Taxonomy Network Based Taxonomy Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Incident Event Unauthorized Result Increased Access Disclosure of Information Corruption of Information Denial of Service Theft of Resources Objectives Challenge, Status, Thrills Political Gain Financial Gain Damage Attack Vulnerability Design Implementation Configuration Tool Physical Attack Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Attackers Hackers Spies Terrorists Corporate Raiders Professional Criminals Vandals Voyeurs

6. Basic Model ToolVulnerability Unauthorized Result ActionTarget Objectives Attackers Objectives Attackers Attacks Incident Intrusions Intruders

7. Computer Network “Incident” Objectives Status/Thrills Political Gain Financial Gain Damage Intruders Hackers Terrorists Other Intrusions Increased access Disclosure of info Theft of resources Corruption of info Denial of Service Defended Network Computer Network Incident

8. Intrusion Taxonomy ToolVulnerability Unauthorized Result ActionTarget Intruders Objectives Intrusion ToolVulnerability Unauthorized Result ActionTarget Event ActionTarget

9. Intrusion Jl;j;j jjl;j;lj jl;kllkj Physical force Info exchange User command Script/Program Autonomous agent Toolkit Distributed tool Data tap Physical force Info exchange User command Script/Program Autonomous agent Toolkit Distributed tool Data tap Tools Vulnerabilities Design Implementation Configuration Vulnerabilities Design Implementation Configuration Unauthorized Results Increased access Disclosure Corrupt data Denial of Service Theft Unauthorized Results Increased access Disclosure Corrupt data Denial of Service Theft Thrills Political Gain Financial Gain Damage Thrills Political Gain Financial Gain Damage Events Action Target Events Action Target

10. Intrusion Jl;j;j jjl;j;lj jl;kllkj Physical force Info exchange User command Script/Program Autonomous agent Toolkit Distributed tool Data tap Physical force Info exchange User command Script/Program Autonomous agent Toolkit Distributed tool Data tap Tools Vulnerabilities Design Implementation Configuration Vulnerabilities Design Implementation Configuration Thrills Political Gain Financial Gain Damage Thrills Political Gain Financial Gain Damage Did have Intent No Unauthorized Results No Unauthorized Results

11. Intrusion taxonomy in practice... Taxonomy in practice... Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Sandia Labs Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Event Unauthorized Result Increased Access Disclosure of Information Corruption of Information Denial of Service Theft of Resources Attack Vulnerability Design Implementation Configuration Intrusion Intruders Objectives Toolkit Design Bypass Process Corruption of Data Denial of Service Computer Network Intrusion

12. Intrusion taxonomy in practice... Taxonomy in practice... Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Sandia Labs Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Event Unauthorized Result Increased Access Disclosure of Information Corruption of Information Denial of Service Theft of Resources Attack Vulnerability Design Implementation Configuration Intrusion Intruders Objectives Insider Threat Authorized User Authorized User Increased Access Tool Kit Design Bypass Process Unauthorized Result Authorized User Authorized User

13. Taxonomy applied

14. Sandia Labs Network Based Taxonomy Network Based Taxonomy Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Event Unauthorized Result Increased Access Disclosure of Information Corruption of Information Denial of Service Theft of Resources Attack Vulnerability Design Implementation Configuration Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Intrusion Intruders Objectives Design User Command Authenticate Account Increased Access Intrusion 1

15. Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Unauthorized Result Increased Access Disclosure of Information Corruption of Information Denial of Service Theft of Resources Vulnerability Design Implementation Configuration Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Intrusion 1 - Increased Acess Intruders Objectives Intrusion 2 User Command Design Bypass Process Root Access

16. Unauthorized Result Increased Access Disclosure of Information Corruption of Information Denial of Service Theft of Resources Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Vulnerability Design Implementation Configuration Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Intrusion 1 - Increased Access Intrusion 2 - Root Level Access User Command Design Steal Data Disclosure of Information Intruders Objectives Root Access Intrusion 3

17. Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Unauthorized Result Increased Access Disclosure of Information Corruption of Information Denial of Service Theft of Resources Vulnerability Design Implementation Configuration Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Intrusion 1 - Increased Access Intrusion 2 - Root Level Access Intrusion 3 - Disclosure of Information Intruders Objectives

18. Action Probe Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Target Account Process Data Component Computer Network Internetwork Unauthorized Result Increased Access Disclosure of Information Corruption of Information Denial of Service Theft of Resources Vulnerability Design Implementation Configuration Tool Physical Force Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Intrusion 1 - Increased Access Intrusion 2 - Root Level Access Intrusion 3 - Disclosure of Information Intruders Objectives Script or Program Implementation Modify Process Denial of Service Theft of Resources Disclosure of Information

19. New definition: “Intrusion Set” Multiple Events Multiple related intrusions = “Intrusion Set” ToolVulnerability Unauthorized Result ActionTarget Intruder Objective

20. Who? What? Why? answer the what Need more information to get to attribution Need to know who ? Need to know why ?

21. Who and Why? Intrusion Set Intruders Objectives Tool Vulnerability ActionTarget Unauthorized Result Attribution

22. Challenge, Status, Thrills Political Gain Financial Gain Damage Challenge, Status, Thrill Damage Financial gain Pol/Mil Gain Action Target Not every event? Action Target Objective reporting criteria Scan Flood Authenticate Bypass Spoof Read Copy Steal Modify Delete Process Data Component Computer Network Internetwork Implementation Configuration Information Exchange User Command Script or Program Autonomous Agent Toolkit Distributed Tool Data Tap Spies Terrorists Corporate Raiders Professional Criminals Vandals Voyeurs ObjectivesVulnerabilityToolAttackers Intruders Probe Account Disclosure of Information Corruption of Information Denial of Service Theft of Resources Unauthorized Result Increased Access Design Physical Force Hackers Spies Terrorists Corporate Raiders Professional Criminals Vandals Voyeurs Group 1 Group 2 Group 3 Group 4 Unauthorized Result Disclosure of Information Corruption of Information Denial of Service Theft of Resources Increased Access ActionTarget Unauthorized Result Action TargetVulnerabilityTool Including intrusion data Intrusion(s) Must report all unauthorized results (Actual or attempted)

23. SUMMARY Common Taxonomy Developed Increased Data Sharing Ongoing Prosecutions Increasing