DOCSLIB.ORG

Classes of Defense for Computer Systems Josephine Wolff

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Classes of Defense for Computer Systems Josephine Wolff Classes of Defense for Computer Systems by Josephine Wolff A.B., Princeton University (2010) S.M., Massachusetts Institute of Technology (2012) Submitted to the Engineering Systems Division in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Engineering Systems: Technology, Management, and Policy at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY June 2015 ○c Massachusetts Institute of Technology 2015. All rights reserved. Author................................................................ Engineering Systems Division June 1, 2015 Certified by. David D. Clark Senior Research Scientist Thesis Supervisor Certified by. Kenneth A. Oye Associate Professor, Political Science and Engineering Systems Committee Chair Certified by. Frank R. Field, III Senior Research Associate Accepted by . Munther Dahleh William A. Coolidge Professor of Electrical Engineering and Computer Science Acting Director, Engineering Systems Division 2 Classes of Defense for Computer Systems by Josephine Wolff Submitted to the Engineering Systems Division on June 1, 2015, in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Engineering Systems: Technology, Management, and Policy Abstract Computer security incidents often involve attackers acquiring a complex sequence of escalating capabilities and executing those capabilities across a range of different intermediary actors in order to achieve their ultimate malicious goals. However, pop- ular media accounts of these incidents, as well as the ensuing litigation and policy proposals, tend to focus on a very narrow defensive landscape, primarily individ- ual centralized defenders who control some of the capabilities exploited in the ear- liest stages of these incidents. This thesis proposes two complementary frameworks for defenses against computer security breaches—one oriented around restricting the computer-based access capabilities that adversaries use to perpetrate those breaches and another focused on limiting the harm that those adversaries ultimately inflict on their victims. Drawing on case studies of actual security incidents, as well as the past decade of security incident data at MIT, it analyzes security roles and defense design patterns related to these broad classes of defense for application designers, ad- ministrators, and policy-makers. Application designers are well poised to undertake access defense by defining and distinguishing malicious and legitimate forms of activ- ity in the context of their respective applications. Policy-makers can implement some harm limitation defenses by monitoring and regulating money flows, and also play an important role in collecting the data needed to expand understanding of the se- quence of events that lead up to successful security incidents and inform which actors can and should effectively intervene as defenders. Organizations and administrators, meanwhile, occupy an in-between defensive role that spans both access and harm in addressing digital harms, or harms that are directly inflicted via computer capabil- ities, through restrictions on crucial intermediate harms and outbound information flows. The comparative case analysis ultimately points to a need to broaden defensive roles and responsibilities beyond centralized access defense and defenders, as well as the visibility challenges compounding externalities for defenders who may lack not only the incentives to intervene in such incidents but also the necessary knowledge to figure out how best to intervene. David D. Clark Senior Research Scientist Thesis Supervisor Kenneth A. Oye 3 Associate Professor, Political Science and Engineering Systems Committee Chair Frank R. Field, III Senior Research Associate 4 Acknowledgments I came to MIT five years ago knowing very little about computer networks andeven less about policy. That I believed I would be able to do research at the intersection of those two topics was frankly laughable. That anyone else believed it was nothing short of incredible. I was fortunate to be advised by David Clark, whose clear thinking and patience (especially in the face of my impatience) were essential every step of the way. In response to my first attempt at drawing out general lessons from the case studies in this thesis, he sent me an email with the subject line: “generalization” chapter. I have never received feedback defter or more discerning than those quotation marks. Ken Oye helped me understand the ways in which defensive considerations were ab- solutely, inextricably tied to institutional interests, and served as a constant source of encouragement, as well as educational and entertaining anecdotes, throughout grad- uate school. Frank Field was the rare engineer who read this thesis and encouraged me to make it more philosophical, not less. I am grateful also to Alan Davidson, Susan Landau, Fred Schneider, and Bruce Schneier for crucial conversations about security and defense, and to the National Science Foundation and Northrop Grumman for funding this work. Members of MIT’s Information Systems & Technology group were exceedingly gener- ous with both their time and their security records, and played a vital role in helping me understand the practical considerations involved in making defensive decisions. The advanced network architecture group in CSAIL has been a wonderful academic home for the past five years, and I am especially grateful to Shirley Hung, Susan Perez, and Jesse Sowell for support and guidance throughout that period. Other ANA members whom I have been lucky enough to share an office with include Albert Domingo, Alex Gamero-Garrido, Rubén Garcia, Cecilia Testart, and Steve Woodrow. Beth Milnes in the Engineering Systems Divison and Ed Ballo and Barb DeLaBarre in the Technology Policy Program were unfailingly friendly presences in E40 and cheerfully helped me navigate the administrative side of MIT. Dara Fisher made a crucial contribution to this thesis by suggesting, during an espe- cially cold and snowy month of writing, that I should start watching The Bachelor. Tommy Leung and Nathan Perkins helped me keep a sense of humor and a sense of perspective about the ups and downs of graduate school. During the 2014-15 academic year, the Berkman Center for Internet & Society pro- vided me with a remarkable community of people interested in understanding the Internet in the context of social and political issues. 5 Paul Mitchell and Kevin Sullivan hosted me at Microsoft during the summers of 2012, 2013, and 2014, providing an up-close look at the endlessly fascinating and occasion- ally agonizing process of security policy-making. Torie Bosch at Slate allowed me to test out several ideas that eventually made their way into this thesis in a series of columns about computer security and current events. Cooper Lloyd and Mary Schnoor made MIT feel just a little bit like middle school (in the best possible way). The 2013 World Champion Red Sox made the penultimate fall of graduate school feel just a little bit like the penultimate fall of high school (in the best possible way). Email correspondence with Alexis Levinson, in which we vowed on a daily basis to put our lives in order and take the world by storm just as soon as we managed to change out of pajama pants, made the purple house feel just a little bit like our college dorm rooms (in the best possible way). Sheila Solomon Klass hated computers almost as much as she loved writing, and she believed, with the wholly unwarranted and unconditional faith of a grandmother, that I had a great genius for both. I wrote the last chapters of this thesis on her computer and no one would have been prouder to see me finish, or more be- wildered by the final product. The summer before my fourth year of graduate school, after I retrieved a web browser icon she had accidentally deleted from her desktop, she sent me an email with the subject line: You have made me the hap- piest Jewish grandmother-writer-with-a-big-mouth-who-should-have-gotten-married- but-instead-roasted-peanuts-in-Planter’s-Duffy-Square-window-and-went-to-college! I was so lucky to know her. Orlando and Anatol Klass let me fill out forms, make calendars, and file paperwork for them when graduate school proved to have too few deadlines and bureaucratic demands to satisfy my need for color-coded charts and recreational organizational activities. Larry Wolff, who lived with that organizational mania for many years, understood how daunted I was by the prospect of a project that couldn’t be reduced to checklists and meticulous planning. The month after my general exams, as I struggled to figure out what came next, he sent me an email with the advice Imost needed to hear to embark on this thesis. He wrote: remember that you can NOT lay the whole thing out in advance, exactly what you’re going to read, write, and show; if you could do that then the research wouldn’t really be worth doing. Perri Klass instilled in me early on the belief that life was too short for wide-ruled paper, and supplied graph-paper notebooks and pads with appropriately small squares from all over the world for my checklists and meticulous planning. Throughout graduate school, she reminded me of the joys of non-academic writing and urged me to write about the topics in this thesis for a wider audience. Together, they supported the thesis-writing process primarily by making fun of me and encouraging me to drink more (not necessarily in that order). It would have been weird for them not to have done that. 6 These ambiguities, redundancies and deficiencies remind us of those which doctor Franz Kuhn attributes to a certain Chinese encyclopaedia entitled ‘Celestial Empire of Benevolent Knowledge.’ In its remote pages it is written that the animals are divided into: (a) belonging to the emperor, (b) embalmed, (c) tame, (d) sucking pigs, (e) sirens, (f) fabulous, (g) stray dogs, (h) included in the present classification, (i) frenzied, (j) innumerable, (k) drawn with a very fine camelhair brush, (l) et cetera, (m) having just broken the water pitcher, (n) that from a long way off look like flies.
Load more

Recommended publications
  • Cyber Security Practices and Challenges at Selected Critical Infrastructures in Ethiopia: Towards Tailoring Cyber Security Framework
    ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCES SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK By TEWODROS GETANEH JUNE, 2018 ADDIS ABABA, ETHIOPIA ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCES SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK A Thesis Submitted to School of Graduate Studies of Addis Ababa University in Partial Fulfillment of the Requirements for the Degree of Master of Science in Information Science By: TEWODROS GETANEH Advisor: Tebebe Beshah (PhD) JUNE, 2018 Addis Ababa, Ethiopia ADDIS ABABA UNIVERSITY COLLEGE OF NATURAL AND COMPUTATIONAL SCIENCE SCHOOL OF INFORMATION SCIENCE CYBER SECURITY PRACTICES AND CHALLENGES AT SELECTED CRITICAL INFRASTRUCTURES IN ETHIOPIA: TOWARDS TAILORING CYBER SECURITY FRAMEWORK By: Tewodros Getaneh Name and signature of Members of the Examining Board Tebebe Beshah (PhD) __________ _________ Advisor Signature Date Lemma Lenssa (PhD) ___________ __________ Examiner Signature Date Dereje Teferi (PhD) __________ _________ Examiner Signature Date Declaration This thesis has not previously been accepted for any degree and is not being concurrently submitted in candidature for any degree in any university. I declare that the thesis is a result of my own investigation, except where otherwise stated. I have undertaken the study independently with the guidance and support of my research advisor. Other sources are acknowledged by citations giving explicit references. A list of references is appended. Signature: ________________________ Tewodros Getaneh This thesis has been submitted for examination with my approval as university advisor. Advisor’s Signature: ________________________ Tebebe Beshah (PhD) i | P a g e Dedication This work is dedicated to my beloved sister Eleni Getaneh.
    [Show full text]
  • Chapter 25: Taking Stock
    Chapter 25 Taking Stock But: connecting the world meant that we also connected all the bad things and all the bad people, and now every social and political problem is expressed in software. We’ve had a horrible ‘oh shit’ moment of realisation, but we haven’t remotely worked out what to do about it. – Benedict Evans If you campaign for liberty you’re likely to find yourself drinking in bad company at the wrong end of the bar. –WhitDiffie 25.1 Introduction Our security group at Cambridge runs a blog, www.lightbluetouchpaper.org, where we discuss the latest hacks and cracks. Many of the attacks hinge on specific applications, as does much of the cool research. Not all applications are the same, though. If our blog software gets hacked it will just give a botnet one more server, but there are other apps from which money can be stolen, others that people rely on for privacy, others that mediate power, and others that can kill. I’ve already discussed many apps from banking through alarms to prepay- ment meters. In this chapter I’m going to briefly describe four classes of ap- plication at the bleeding edge of security research. They are where we find innovative attacks, novel protection problems, and thorny policy issues. They are: autonomous and remotely-piloted vehicles; machine learning, from adver- sarial learning to more general issues of AI in society; privacy technologies; and finally, electronic elections. What these have in common is that while previously, security engineering was about managing complexity in technology with all its exploitable side-e↵ects, we are now bumping up against complexity in human society.
    [Show full text]
  • Climate Change Adaptation in the Arab States Best Practices and Lessons Learned
    Climate Change Adaptation in the Arab States Best practices and lessons learned United Nations Development Programme 2018 | 1 UNDP partners with people at all levels of society to help build nations that can withstand crisis, and drive and sustain the kind of growth that improves the quality of life for everyone. On the ground in nearly 170 countries and territories, we offer global perspective and local insight to help empower lives and build resilient nations. www.undp.org The Global Environment Facility (GEF) was established on the eve of the 1992 Rio Earth Summit to help tackle our planet’s most pressing environmental problems. Since then, the GEF has provided over $17 billion in grants and mobilized an additional $88 billion in financing for more than 4000 projects in 170 countries. Today, the GEF is an international partnership of 183 countries, international institutions, civil society organizations and the private sector that addresses global environmental issues. www.thegef.org United Nations Development Programme July 2018 Copyright © UNDP 2018 Manufactured in Bangkok Bangkok Regional Hub (BRH) United Nations Development Programme 3rd Floor United Nations Service Building Rajdamnern Nok Avenue, Bangkok, 10200, Thailand www.adaptation-undp.org Authors: The report preparation was led by Tom Twining-Ward in close collaboration with Kishan Khoday, with Cara Tobin as lead author and Fadhel Baccar, Janine Twyman Mills, Walid Ali and Zubair Murshed as contributing authors. The publication was professionally reviewed by fellow UNDP colleagues, Amal Aldababseh, Greg Benchwick, Hanan Mutwaki, Mohamed Bayoumi, and Walid Ali. Valuable external expert review, comments, and suggestions were provided by Hussein El-Atfy (Arab Water Council), Ibrahim Abdel Gelil (Arabian Gulf University), and William Dougherty (Climate Change Research Group).
    [Show full text]
  • Significant Cyber Incidents Since 2006 This List Is a Work in Progress That We Update As New Incidents Come to Light. If You H
    Significant Cyber Incidents Since 2006 This list is a work in progress that we update as new incidents come to light. If you have suggestions for additions, send them to [email protected]. Significance is in the eye of the beholder, but we focus on successful attacks on government agencies, defense and high tech companies, or economic crimes with losses of more than a million dollars. 1. May 2006. The Department of State’s networks were hacked, and unknown foreign intruders downloaded terabytes of information. If Chinese or Russian spies backed a truck up to the State Department, smashed the glass doors, tied up the guards and spend the night carting off file cabinets it would be an act of war, but when it happens in cyberspace we barely notice. 2. August 2006. A senior Air Force Officer stated publicly that, “China has downloaded 10 to 20 terabytes of data from the NIPRNet (the unclassified military network).” 3. November 2006. Hackers attempted to penetrate U.S. military War College networks, resulting in a two week shutdown at one institution while infected machines are restored. 4. December 2006. NASA was forced to block emails with attachments before shuttle launches out of fear they would be hacked. Business Week reported that the plans for the latest U.S. space launch vehicles were obtained by unknown foreign intruders. 5. 2006. Chinese hackers were thought to be responsible for shutting down the House of Commons computer system. 6. April 2007. The Department of Commerce had to take the Bureau of Industrial Security’s networks offline for several months because its networks were hacked by unknown foreign intruders.
    [Show full text]
  • Zerohack Zer0pwn Youranonnews Yevgeniy Anikin Yes Men
    Zerohack Zer0Pwn YourAnonNews Yevgeniy Anikin Yes Men YamaTough Xtreme x-Leader xenu xen0nymous www.oem.com.mx www.nytimes.com/pages/world/asia/index.html www.informador.com.mx www.futuregov.asia www.cronica.com.mx www.asiapacificsecuritymagazine.com Worm Wolfy Withdrawal* WillyFoReal Wikileaks IRC 88.80.16.13/9999 IRC Channel WikiLeaks WiiSpellWhy whitekidney Wells Fargo weed WallRoad w0rmware Vulnerability Vladislav Khorokhorin Visa Inc. Virus Virgin Islands "Viewpointe Archive Services, LLC" Versability Verizon Venezuela Vegas Vatican City USB US Trust US Bankcorp Uruguay Uran0n unusedcrayon United Kingdom UnicormCr3w unfittoprint unelected.org UndisclosedAnon Ukraine UGNazi ua_musti_1905 U.S. Bankcorp TYLER Turkey trosec113 Trojan Horse Trojan Trivette TriCk Tribalzer0 Transnistria transaction Traitor traffic court Tradecraft Trade Secrets "Total System Services, Inc." Topiary Top Secret Tom Stracener TibitXimer Thumb Drive Thomson Reuters TheWikiBoat thepeoplescause the_infecti0n The Unknowns The UnderTaker The Syrian electronic army The Jokerhack Thailand ThaCosmo th3j35t3r testeux1 TEST Telecomix TehWongZ Teddy Bigglesworth TeaMp0isoN TeamHav0k Team Ghost Shell Team Digi7al tdl4 taxes TARP tango down Tampa Tammy Shapiro Taiwan Tabu T0x1c t0wN T.A.R.P. Syrian Electronic Army syndiv Symantec Corporation Switzerland Swingers Club SWIFT Sweden Swan SwaggSec Swagg Security "SunGard Data Systems, Inc." Stuxnet Stringer Streamroller Stole* Sterlok SteelAnne st0rm SQLi Spyware Spying Spydevilz Spy Camera Sposed Spook Spoofing Splendide
    [Show full text]
  • Cybercrime Digest
    Cybercrime Digest Bi-weekly update and global outlook by the Cybercrime Programme Office of the Council of Europe (C-PROC) 16-30 June 2020 Source: Council of C-PROC series of cybercrime webinars continue: Europe materials available, next topics and dates announced Date: 30 Jun 2020 Initiated in April, the C-PROC series of webinars on cybercrime have continued in the second half of June with more sessions, respectively dedicated to Cybercrime in Africa and the challenges of international cooperation, co-organized by the U.S. Departement of Justice (USDoJ) and the Council of Europe in the framework of the GLACY+ Project, Introduction to Cyberviolence, conducted in the framework of the CyberEast Project, Cybercrime and Criminal Justice in Cyberspace the regional seminar dedicated to Asisa- Pacific, under the GLACY+ Project, and International standards on collection and handling of electronic evidence, under the CyberSouth Project. New webinars are scheduled for the next period: Cybercrime and Criminal Justice in Cyberspace, the series of seminars hosted by the European Union and the Council of Europe (Africa, EN - 7 July 2020; Africa, FR - 9 July 2020; Latin America and Caribbean, EN - 20 July; Latin America and Caribbean, ES - 22 July]. For further updates, please check our webinars dedicated webpage. Source: Council of CyberSouth: Regional workshop on interagency Europe cooperation on the search, seizure and confiscation of Date: 1 Jul 2020 on-line crime proceeds “CyberSouth project organised a regional online workshop on interagency cooperation on the search, seizure and confiscation of on-line crime proceeds, on the 1st of July 2020. The event gathered around 30 participants from Law Enforcement agencies, Financial Investigation Units and prosecutors of priority countries as well as experts from United Kingdom, Romania and FBI.
    [Show full text]
  • E-Commerce Security and Fraud Issues and Protections 10
    E-Commerce Security and Fraud Issues and Protections 10 C o n t e n t s Learning Objectives Opening Case: How State University of New York College at Old Westbury Upon completion of this chapter, you will be Controls Its Internet Use ...................................... 458 able to: 10.1 The Information Security Problem .......... 459 1. Understand the importance and scope of security of information systems for EC. 10.2 Basic E-Commerce Security Issues and Landscape ........................................... 465 2. Describe the major concepts and terminol- ogy of EC security. 10.3 Technical Malware Attack Methods: From Viruses to Denial of Service ............ 471 3. Understand about the major EC security threats, vulnerabilities, and technical attacks. 10.4 Nontechnical Methods: From Phishing to Spam and Fraud .................... 476 4. Understand Internet fraud, phishing, and spam. 10.5 The Information Assurance Model 5. Describe the information assurance security and Defense Strategy ................................. 484 principles. 10.6 The Defense I: Access Control, 6. Identify and assess major technologies Encryption, and PKI ................................. 488 and methods for securing EC access and 10.7 The Defense II: Securing communications. E-Commerce Networks ............................. 494 7. Describe the major technologies for protec- 10.8 The Defense III: General Controls, tion of EC networks. Spam, Pop Ups, Fraud, and Social 8. Describe various types of controls and special Engineering Controls................................. 497 defense mechanisms. 10.9 Implementing Enterprisewide 9. Describe consumer and seller protection from E-Commerce Security ............................... 500 fraud. Managerial Issues.................................................. 504 10. Discuss enterprisewide implementation issues Closing Case: How One Bank Stopped Scams, for EC security. Spams, and Cybercriminals ................................. 509 11. Understand why it is so diffi cult to stop computer crimes.
    [Show full text]
  • Moving Forward EU-India Relations. the Significance of the Security
    Moving Forward EU-India Relations The Significance of the Security Dialogues edited by Nicola Casarini, Stefania Benaglia and Sameer Patil Edizioni Nuova Cultura Output of the project “Moving Forward the EU-India Security Dialogue: Traditional and Emerging Issues” led by the Istituto Affari Internazionali (IAI) in partnership with Gate- way House: Indian Council on Global Relations (GH). The project is part of the EU-India Think Tank Twinning Initiative funded by the European Union. First published 2017 by Edizioni Nuova Cultura for Istituto Affari Internazionali (IAI) Via Angelo Brunetti 9 – I-00186 Rome – Italy www.iai.it and Gateway House: Indian Council on Global Relations Colaba, Mumbai – 400 005 India Cecil Court, 3rd floor Copyright © 2017 Gateway House: Indian Council on Global Relations (ch. 2-3, 6-7) and Istituto Affari Internazionali (ch. 1, 4-5, 8-9) ISBN: 9788868128531 Cover: by Luca Mozzicarelli Graphic composition: by Luca Mozzicarelli The unauthorized reproduction of this book, even partial, carried out by any means, including photocopying, even for internal or didactic use, is prohibited by copyright. Table of Contents Abstracts .......................................................................................................................................... 9 Introduction ................................................................................................................................. 15 1. Maritime Security and Freedom of Navigation from the South China Sea and Indian Ocean to the Mediterranean:
    [Show full text]
  • CIS 381: Social & Ethical Issues of Computing
    CIS 381: Social & Ethical Issues of Computing Security Dr. David Koop D. Koop, CIS 381, Spring 2019 Hackers, Past and Present • Original meaning of hacker: explorer, risk taker, system innovator (e.g. MIT’s Tech Model Railroad Club in 1950s) • Change in meaning from electronics to computers and networks • WarGames (1983): Hacking military supercomputer • Modern meaning of hacker: someone who gains unauthorized access to computers and computer networks [M. J. Quinn] D. Koop, CIS 381, Spring 2019 !2 Password Advice • Do not use short passwords • Do not rely solely on words from the dictionary • Do not rely on substituting numbers for letters • Do not reuse passwords • Give ridiculous answers to security questions • Enable two-factor authentication if available • Have password recoveries sent to a secure email address [M. J. Quinn] D. Koop, CIS 381, Spring 2019 !3 Case Study: Firesheep • October 2010: Eric Butler released Firesheep extension to Firefox browser • Firesheep made it possible for ordinary computer users to easily sidejack Web sessions • More than 500,000 downloads in first week • Attracted great deal of media attention • Early 2011: Facebook and Twitter announced options to use their sites securely • Evaluate: Was this a good action? [M. J. Quinn] D. Koop, CIS 381, Spring 2019 !4 Viruses • Virus: Piece of self-replicating code embedded within another program (host) • Viruses associated with program files - Hard disks, floppy disks, CD- ROMS - Email attachments • How viruses spread - Diskettes or CDs - Email - Files downloaded from Internet [M. J. Quinn] D. Koop, CIS 381, Spring 2019 !5 Worm • Worm: - Self-contained program 7.3 Malware 329 - Spreads via computer network - Exploits security holes W • Tappen's Internet Worm W W - Released worm onto Internet from W MIT computer - Spread to significant numbers of Unix computers W - Infected computers kept crashing or became unresponsive Figure 7.4 A worm spreads to other computers by exploiting security holes in computer networks.
    [Show full text]
  • How to Improve Data Security and Reduce Potential Liability for Data Breaches
    How to Improve Data Security and Reduce Potential Liability for Data Breaches Randy Gainer, Attorney, CISSP February 12, 2014 Topics . The risks of cyber attacks – Identifying threats – Conducting risk assessments . Choosing cost-effective security measures . Evaluating cyber insurance coverage 2 Identifying threats . If your business processes payment cards, card data thieves are targeting your customers’ card data: Trustwave 2013 Global Security Report, 8. 3 Identifying threats . Targeted malware – Deployed by phishing, poisoned websites, poisoned ads, watering hole attacks, and poorly protected third-party access tools. E.g., • Remote access accounts for service vendors that rely on weak passwords; and • Phished credentials for access to the cardholder data environment (“CDE”). 4 Identifying threats . Targeted malware – Programmed to find, copy, store, encrypt, and exfiltrate payment card data – Customized to avoid detection – Allows attacker to persistently communicate with, and exercise command and control of, the malware inside the target network – Permits an attacker to adapt to defenses (e.g., installs multiple backdoors to maintain attacker’s access). 5 Identifying threats . Targeted malware – Used to find assets on the network to steal: Insight Enterprise Intelligence tool. Used with permission. 6 Identifying threats 7 Identifying threats 8 Identifying threats 9 Identifying threats 10 Identifying threats 11 Identifying threats 12 Identifying threats . Issuers, merchants, and acquirers of credit, debit, and prepaid cards experienced gross fraud losses of $11.27 billion in 2012, up 14.6% over the prior year. Card issuers lost 63% and merchants and acquirers lost the other 37%. Business Wire, August 19, 2013, citing The Nilson Report. 13 Identifying threats . Global Payments, Inc.
    [Show full text]
  • Cyberpro December 31, 2009
    Volume 2, Edition 26 CyberPro December 31, 2009 Keeping Cyberspace Professionals Informed Officers The articles and information appearing herein are intended for President educational purposes to promote discussion in the public interest and to Larry K. McKee, Jr. keep subscribers who are involved in the development of Cyber-related concepts and initiatives informed on items of common interest. The Chief Operations Officer newsletter and the information contained therein are not intended to Jim Ed Crouch provide a competitive advantage for any commercial firm. Any misuse or unauthorized use of the newsletter and its contents will result in removal ------------------------------ from the distribution list and/or possible administrative, civil, and/or CyberPro Editor-in-Chief criminal action. Lindsay Trimble The views, opinions, and/or findings and recommendations contained in CyberPro Research Analyst this summary are those of the authors and should not be construed as an Kathryn Stephens official position, policy, or decision of the United States Government, U.S. Department of Defense, or National Security Cyberspace Institute. CyberPro Archive To subscribe or unsubscribe to this newsletter click here CyberPro News Subscription. Please contact Lindsay Trimble regarding CyberPro subscription, sponsorship, and/or advertisement. All rights reserved. CyberPro may not be published, broadcast, rewritten or redistributed without prior NSCI consent. 110 Royal Aberdeen Smithfield, VA 23430 ph. (757) 871 - 3578 CyberPro National Security Cyberspace
    [Show full text]
  • Introduction to Internet Governance
    For easy reference: a list of frequently The history of this book is long, in Internet time. The used abbreviations and acronyms original text and the overall approach, including AN INTRODUCTION TO TO AN INTRODUCTION the five-basket methodology, were developed APEC Asia-Pacific Economic Co-operation in 1997 for a training course on information ccTLD country code Top-Level Domain AN INTRODUCTION TO and communications technology (ICT) policy CIDR Classless Inter-Domain Routing for government officials from Commonwealth DMCA Digital Millennium Copyright Act countries. In 2004, Diplo published a print version DNS Domain Name System of its Internet governance materials, in a booklet DRM Digital Rights Management INTERNET entitled Internet Governance – Issues, Actors and GAC Governmental Advisory Committee Divides. This booklet formed part of the Information gTLD generic Top-Level Domain INTERNET Society Library, a Diplo initiative driven by Stefano HTML HyperText Markup Language Baldi, Eduardo Gelbstein, and Jovan Kurbalija. IANA Internet Assigned Numbers Authority GOVERNANCE Special thanks are due to Eduardo Gelbstein, who ICANN Internet Corporation for Assigned made substantive contributions to the sections Names and Numbers GOVERNANCE dealing with cybersecurity, spam, and privacy, and ICC International Chamber of Commerce AN INTRODUCTION TO INTERNET GOVERNANCE Jovan Kurbalija to Vladimir Radunovic, Ginger Paque, and Stephanie aICT Information and Communications Jovan Kurbalija Borg-Psaila who updated the course materials. Technology Comments and suggestions from other colleagues IDN Internationalized Domain Name are acknowledged in the text. Stefano Baldi, Eduardo IETF Internet Engineering Task Force An Introduction to Internet Governance provides a comprehensive overview Gelbstein, and Vladimir Radunovic all contributed IGF Internet Governance Forum of the main issues and actors in this field.
    [Show full text]