DOCSLIB.ORG

“Reducing Systemic Cybersecurity Risk”

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
“Reducing Systemic Cybersecurity Risk” IFP/WKP/FGS(2011)3 MULTI-DISCIPLINARY ISSUES INTERNATIONAL FUTURES PROGRAMME OECD/IFP Project on “Future Global Shocks” “Reducing Systemic Cybersecurity Risk” Peter Sommer, Information Systems and Innovation Group, London School of Economics Ian Brown, Oxford Internet Institute, Oxford University Contact persons: Pierre-Alain Schieb: +33 (0)1 45 24 82 70, [email protected] Anita Gibson: +33 (0)1 45 24 96 27, [email protected] 14th January 2011 This report was written by Peter Sommer and Ian Brown as a contribution to the OECD project ―Future Global Shocks‖. The opinions expressed and arguments employed herein are those of the authors, and do not necessarily reflect the official views of the OECD or of the governments of its member countries. TABLE OF CONTENTS EXECUTIVE SUMMARY ............................................................................................... 6 SYSTEMIC CYBER SECURITY RISK .......................................................................... 9 SYSTEMIC CYBER SECURITY RISK ........................................................................ 10 DESCRIPTION AND HISTORICAL CONTEXT ......................................................... 15 Early days of business and government computing ..................................................... 15 1970s and 1980s: changing patterns of risk ................................................................. 15 Routes to democratisation ............................................................................................ 16 The emergence of the Internet ...................................................................................... 17 Changing business practices ........................................................................................ 20 E-Government .............................................................................................................. 20 Smart Grids and SCADA ............................................................................................. 21 Cloud Computing ......................................................................................................... 22 Complexity / Source Lines of Code / Program Bugs ................................................... 22 Critical Infrastructures: Cyber Elements ...................................................................... 23 Specific Systemic Threats ............................................................................................ 24 Blended attacks ............................................................................................................ 29 Large-scale criminal attacks ......................................................................................... 29 Recreational Hacking ................................................................................................... 31 Hactivism ..................................................................................................................... 31 Large-scale State and Industrial espionage .................................................................. 32 REMEDIES ..................................................................................................................... 34 Remedies: Security Doctrines ...................................................................................... 34 Remedies: System Design ........................................................................................... 35 Remedies: Detective and Preventative ........................................................................ 36 Remedies: Mitigation and Recovery .......................................................................... 39 RISK CHARACTERISATION, INTERLINKAGES AND KNOCK-ON EFFECTS ... 42 3 RISK ANALYSIS AND THE BROADER CONTEXT ................................................. 48 Impact, scope and duration .......................................................................................... 48 Threshold, tipping, trigger and control points .............................................................. 48 Duration Issues ............................................................................................................. 50 LEVEL OF PREPAREDNESS ....................................................................................... 61 Military Responses ....................................................................................................... 61 Civil Contingencies ...................................................................................................... 63 Private sector ................................................................................................................ 65 Policing and Counter-Fraud Responses ....................................................................... 68 Research Responses ..................................................................................................... 69 Legal and Regulatory Approaches ............................................................................... 70 CONCLUSIONS AND RECOMMENDATIONS .......................................................... 81 National Strategies ....................................................................................................... 83 Public Private Partnerships .......................................................................................... 84 International Strategies ................................................................................................. 85 Possible New Technical Measures ............................................................................... 86 Research ....................................................................................................................... 87 Education ...................................................................................................................... 88 REFERENCES .............................................................................................................. 111 Tables Table 1. Types of Malware ...................................................................................... 24 Table 2. Extract from provisions of leading cybercrime laws ................................. 73 Figures Figure 1. Increasing dependence on the Internet ...................................................... 18 Figure 2. Increasing important of the Internet .......................................................... 19 Figure 3. Steps Towards E-Government ................................................................... 21 Figure 4. Critical Infrastructure Inter-Dependencies ................................................ 23 Figure 5. Shape of Disaster Recovery....................................................................... 39 4 Figure 6. Internet Users per 100 Inhabitants 1998-2008 .......................................... 52 Figure 7. Contribution of ICT capital growth to labour productivity growth in market services (1995-2004) .................................................................................................... 54 Figure 8. Enterprises using the Internet to interact with public authorities, by purpose, during 2007, EU27 (%) ................................................................................................ 55 Figure 9. UK Critical National Infrastructure ........................................................... 64 5 EXECUTIVE SUMMARY This report is part of a broader OECD study into ―Future Global Shocks‖, examples of which could include a further failure of the global financial system, large-scale pandemics, escape of toxic substances resulting in wide-spread long-term pollution, and long-term weather or volcanic conditions inhibiting transport links across key intercontinental routes. The authors have concluded that very few single cyber-related events have the capacity to cause a global shock. Governments nevertheless need to make detailed preparations to withstand and recover from a wide range of unwanted cyber events, both accidental and deliberate. There are significant and growing risks of localised misery and loss as a result of compromise of computer and telecommunications services. In addition, reliable Internet and other computer facilities are essential in recovering from most other large-scale disasters. Catastrophic single cyber-related events could include: successful attack on one of the underlying technical protocols upon which the Internet depends, such as the Border Gateway Protocol which determines routing between Internet Service Providers and a very large-scale solar flare which physically destroys key communications components such as satellites, cellular base stations and switches. For the remainder of likely breaches of cybsersecurity such as malware, distributed denial of service, espionage, and the actions of criminals, recreational hackers and hacktivists, most events will be both relatively localised and short-term in impact. Successful prolonged cyberattacks need to combine: attack vectors which are not already known to the information security community and thus not reflected in available preventative and detective technologies, so-called zero-day exploits; careful research of the intended targets; methods of concealment both of the attack method and the perpetrators; the ability to produce new attack vectors over a period as current ones are reverse-engineered and thwarted. The recent Stuxnet attack apparently against Iranian nuclear facilities points to the future but also the difficulties.
Load more

Recommended publications
  • Analyzing Cyber Trends in Online Financial Frauds Using Digital Forensics Techniques Simran Koul, Yash Raj, Simriti Koul
    International Journal of Innovative Technology and Exploring Engineering (IJITEE) ISSN: 2278-3075, Volume-9 Issue-9, July 2020 Analyzing Cyber Trends in Online Financial Frauds using digital Forensics Techniques Simran Koul, Yash Raj, Simriti Koul Online frauds refer to the usage of Internet services or other Abstract: Online financial frauds are one of the leading issues open-source software requiring Internet access to frame users in the fields of digital forensics and cyber-security today. Various or to otherwise take advantage of them. Finance-related flaws online firms have been employing several methodologies for the are becoming quite commonplace today. The most common prevention of finance-related malpractices. This domain of criminal activity is becoming increasingly common in the present types of online financial frauds include: cyberspace. In this paper, we will try to implement an online Phishing: Here, the fraudsters acquire users’ sensitive data financial fraud investigation using the digital forensics tool: such as passwords and credit card credentials through email Autopsy. A few existing cyber-security techniques for the messages, fraud websites, and phone calls. investigation of such crimes, namely the Formal Concept Analysis Card Skimming: This crime involves the illegal extraction and Confirmatory Factor Analysis; have been analyzed and of the user’s sensitive financial details on the magnetic stripe reviewed. These techniques are primarily based on mathematical cyber-security concepts. Henceforth, it has been tried to find out from ATMs, debit, and credit cards. This is usually done by whether the investigation of similar crimes can be done the installation of malware on the card reader used by the satisfactorily using the readily-accessible digital forensics tool: victim.
    [Show full text]
  • Attribution and Response to Cybercrime/Terrorism/Warfare Susan W
    Journal of Criminal Law and Criminology Volume 97 Article 2 Issue 2 Winter Winter 2007 At Light Speed: Attribution and Response to Cybercrime/Terrorism/Warfare Susan W. Brenner Follow this and additional works at: https://scholarlycommons.law.northwestern.edu/jclc Part of the Criminal Law Commons, Criminology Commons, and the Criminology and Criminal Justice Commons Recommended Citation Susan W. Brenner, At Light Speed: Attribution and Response to Cybercrime/Terrorism/Warfare, 97 J. Crim. L. & Criminology 379 (2006-2007) This Symposium is brought to you for free and open access by Northwestern University School of Law Scholarly Commons. It has been accepted for inclusion in Journal of Criminal Law and Criminology by an authorized editor of Northwestern University School of Law Scholarly Commons. 0091-4169/07/9702-0379 THE JOURNALOF CRIMINAL LAW & CRIMINOLOGY Vol. 97. No. 2 Copyright 0 2007 by NorthwesternUniversity. Schoolof Low Printedin U.S.A. "AT LIGHT SPEED": ATTRIBUTION AND RESPONSE TO CYBERCRIME/TERRORISM/WARFARE SUSAN W. BRENNER* This Article explains why and how computer technology complicates the related processes of identifying internal (crime and terrorism) and external (war) threats to social order of respondingto those threats. First, it divides the process-attribution-intotwo categories: what-attribution (what kind of attack is this?) and who-attribution (who is responsiblefor this attack?). Then, it analyzes, in detail, how and why our adversaries' use of computer technology blurs the distinctions between what is now cybercrime, cyberterrorism, and cyberwarfare. The Article goes on to analyze how and why computer technology and the blurring of these distinctions erode our ability to mount an effective response to threats of either type.
    [Show full text]
  • 193 194 Chapter 17
    National Institute of Standards and Technology Technology Administration U.S. Department of Commerce An Introduction to Computer Security: The NIST Handbook Special Publication 800-12 User Contingency Assurance I & A Issues Planning Personnel Training Access Risk Crypto Controls Audit Planning Management Support Physical Program Threats Policy & Management Security Operations Table of Contents I. INTRODUCTION AND OVERVIEW Chapter 1 INTRODUCTION 1.1 Purpose .................................................... 3 1.2 Intended Audience .......................................... 3 1.3 Organization ............................................... 4 1.4 Important Terminology ..................................... 5 1.5 Legal Foundation for Federal Computer Security Programs . 7 Chapter 2 ELEMENTS OF COMPUTER SECURITY 2.1 Computer Security Supports the Mission of the Organization. 9 2.2 Computer Security is an Integral Element of Sound Management. .............................................. 10 2.3 Computer Security Should Be Cost-Effective. ............... 11 2.4 Computer Security Responsibilities and Accountability Should Be Made Explicit. .......................................... 12 2.5 Systems Owners Have Security Responsibilities Outside Their Own Organizations. ........................................ 12 2.6 Computer Security Requires a Comprehensive and Integrated Approach. ................................................. 13 2.7 Computer Security Should Be Periodically Reassessed. ...... 13 2.8 Computer Security is Constrained by Societal
    [Show full text]
  • Cybersecurity & Computing Innovations
    Cybersecurity & Computing Innovations: Notes In this lesson: - Online Security - Legal & Ethical Concerns - Computing Innovations Online Security: ● Personal identifiable information (PII) is information about an individual that identifies links, relates, or describes them. ● Examples of PII include: ○ Social Security Number ○ Age ○ Race ○ Phone numbers ○ Medical information ○ Financial information ○ Biometric data (fingerprint and retinal scans) ● Search engines can record and maintain a history of search made by users. ○ Search engines can use search history to suggest websites or for targeted marketing. ● Websites can record and maintain a history of individuals who have viewed their pages. ○ Devices, websites, and networks can collect information about a user’s location. ● Technology enables the collection, use, and exploitation of information about by and for individuals, groups and institutions. ● Personal data such as geolocation, cookies, and browsing history, can be aggregated to create knowledge about an individual. ● Personal identifiable information and other information placed online can be used to enhance a user’s experiences. ● Personal identifiable information stored online can be used to simplify making online purchases. ● Commercial and government curation (collection) of information may be exploited if privacy and other protections are ignored. ● Information placed online can be used in ways that were not intended and that may have a harmful effect. ○ For example, an email message may be forwarded, tweets can be retweeted, and social media posts can be viewed by potential employers. ● Personal identifiable information can be used to stalk or steal the identity of a person or to aid in the planning of other criminal acts. ● Once information is placed online, it is difficult to delete.
    [Show full text]
  • A PRACTICAL METHOD of IDENTIFYING CYBERATTACKS February 2018 INDEX
    In Collaboration With A PRACTICAL METHOD OF IDENTIFYING CYBERATTACKS February 2018 INDEX TOPICS EXECUTIVE SUMMARY 4 OVERVIEW 5 THE RESPONSES TO A GROWING THREAT 7 DIFFERENT TYPES OF PERPETRATORS 10 THE SCOURGE OF CYBERCRIME 11 THE EVOLUTION OF CYBERWARFARE 12 CYBERACTIVISM: ACTIVE AS EVER 13 THE ATTRIBUTION PROBLEM 14 TRACKING THE ORIGINS OF CYBERATTACKS 17 CONCLUSION 20 APPENDIX: TIMELINE OF CYBERSECURITY 21 INCIDENTS 2 A Practical Method of Identifying Cyberattacks EXECUTIVE OVERVIEW SUMMARY The frequency and scope of cyberattacks Cyberattacks carried out by a range of entities are continue to grow, and yet despite the seriousness a growing threat to the security of governments of the problem, it remains extremely difficult to and their citizens. There are three main sources differentiate between the various sources of an of attacks; activists, criminals and governments, attack. This paper aims to shed light on the main and - based on the evidence - it is sometimes types of cyberattacks and provides examples hard to differentiate them. Indeed, they may of each. In particular, a high level framework sometimes work together when their interests for investigation is presented, aimed at helping are aligned. The increasing frequency and severity analysts in gaining a better understanding of the of the attacks makes it more important than ever origins of threats, the motive of the attacker, the to understand the source. Knowing who planned technical origin of the attack, the information an attack might make it easier to capture the contained in the coding of the malware and culprits or frame an appropriate response. the attacker’s modus operandi.
    [Show full text]
  • A/74/130 General Assembly
    United Nations A/74/130 General Assembly Distr.: General 30 July 2019 Original: English Seventy-fourth session Item 109 of the provisional agenda* Countering the use of information and communications technologies for criminal purposes Countering the use of information and communications technologies for criminal purposes Report of the Secretary-General Summary The present report has been prepared pursuant to General Assembly resolution 73/187, entitled “Countering the use of information and communications technologies for criminal purposes”. In that resolution, the General Assembly requested the Secretary-General to seek the views of Member States on the challenges that they faced in countering the use of information and communications technologies for criminal purposes and to present a report based on those views for consideration by the General Assembly at its seventy-fourth session. The report contains information on the views of Member States submitted pursuant to the aforementioned resolution. __________________ * A/74/150. V.19-08182 (E) 190819 200819 *1908182* A/74/130 Contents Page I. Introduction ................................................................... 4 II. Replies received from Governments ............................................... 4 Argentina ..................................................................... 4 Armenia ...................................................................... 6 Australia ..................................................................... 8 Austria ......................................................................
    [Show full text]
  • Institutions for Cyber Security: International Responses and Data Sharing Initiatives Nazli Choucri Stuart Madnick Priscilla Koepke
    Institutions for Cyber Security: International Responses and Data Sharing Initiatives Nazli Choucri Stuart Madnick Priscilla Koepke Working Paper CISL# 2017-06 April 2017 Cybersecurity Interdisciplinary Systems Laboratory (CISL) Sloan School of Management, Room E62-422 Massachusetts Institute of Technology Cambridge, MA 02142 Institutions for Cyber Security: International Responses and Data Sharing Initiatives Nazli Choucri Stuart Madnick Priscilla Koepke Department of Political Sloan School of Management, Sloan School of Science, MIT MIT Management, MIT [email protected] [email protected] [email protected] August 2016 (Updated April 2017) Abstract Almost everyone recognizes the salience of cyberspace as a fact of daily life. Given its ubiquity, scale, and scope, cyberspace has become a fundamental feature of the world we live in and has created a new reality for almost everyone in the developed world and increasingly for people in in the developing world. This paper seeks to provide an initial baseline, for representing and tracking institutional responses to a rapidly changing international landscape, real as well as virtual. We shall argue that the current institutional landscape managing security issues in the cyber domain has developed in major ways, but that it is still “under construction.” We also expect institutions for cyber security to support and reinforce the contributions of information technology to the development process. We begin with (a) highlights of international institutional theory and an empirical “census” of the institutions-in-place for cyber security, and then turn to (b) key imperatives of information technology-development linkages and the various cyber processes that enhance developmental processes, (c) major institutional responses to cyber threats and cybercrime as well select international and national policy postures and so critical for industrial countries and increasingly for developing states as well, and (d) the salience of new mechanisms designed specifically in response to cyber threats.
    [Show full text]
  • Challenges to Building a Safe and Secure Information Society
    StatisticalChapter Five Annex chapter five Challenges to building a safe and secure Information Society 82 5.1 Introduction: Building tation of vulnerabilities in their data storage, industrial espionage, system downtime, etc. confidence and security in the Corporate users may also have liability in the use of ICTs case of threats to their customers, partners or suppliers; Over the past two decades, the Internet has trans- » Threats to critical public infrastructures, formed many aspects of modern life. Use of the including electronic communication net- Internet continues to grow, with the estimated works, financial systems, emergency services, number of Internet users exceeding one billion navigation systems, electrical power grids, air worldwide at the end of 2006 and an estimated traffic control, water control systems etc. 113 million websites.1 People around the globe and from all walks of life have been hearing about While these dependencies vary from nation to the promised improvements the Internet will nation, nearly all nations need to defend and pro- bring to their lives. While some of these promises tect their critical network information infrastruc- have materialized, the full potential of the Internet tures, as the risks are huge, especially in a world has not yet been realized. One of the main rea- in which strife between nations could transmute sons is that many users lack trust in the Internet into electronic warfare. Telecommunications is for conducting transactions or storing sensitive a critical national infrastructure3, as vital as the information. An online survey conducted by ITU in power supply in ensuring the smooth functioning 2006 found that almost two-thirds of respondents of society.
    [Show full text]
  • Information Assurance Situation in Switzerland and Internationally
    Federal Strategy Unit for IT FSUIT Federal Intelligence Service FIS Reporting and Analysis Centre for Information Assurance MELANI www.melani.admin.ch Information Assurance Situation in Switzerland and Internationally Semi-annual report 2009/II (July – December) MELANI – Semi-annual report 2009/II Information Assurance – Situation in Switzerland and Internationally Contents 1 Focus Areas of Issue 2009/II .........................................................................................3 2 Introduction.....................................................................................................................4 3 Current National ICT Infrastructure Situation ..............................................................5 33.1.1 FDFA targeted by malware.................................................................................5 33.2.2 Website defacements after adoption of minaret ban initiative ............................5 33.3.3 DDoS attacks against Swisscom and Swisscom clients ....................................6 33.4.4 Fraud with fake domain registrations..................................................................7 33.5.5 Purported free offers against viruses, scareware, rogueware and ransomware 8 33.6.6 New top level domains (TLD) and high security zones in the Internet .............10 33.7.7 Revision of provisions implementing the Telecommunications Act ..................10 33.8.8 Skype wiretap published as source code .........................................................11 4 Current International ICT
    [Show full text]
  • Cybercriminal Activity
    Cybercriminal Activity Hemavathy Alaganandam – The Evolution of Cybercrime Pravin Mittal – Cybercrime Case Study: Internet Bots Avichal Singh - Cyberforensics Chris Fleizach – Legal Policies and The Future of Cybercrime December 6th, 2005 Table of Contents Introduction............................................................................................... 3 The Evolution of Cybercrime......................................................................... 4 Evolution of Motivation............................................................................. 5 Categories of Cybercrime.......................................................................... 5 Cybercrime Tools..................................................................................... 7 Evolution & Profile of the Attacker.............................................................. 8 Malware and Threat Evolution....................................................................9 Evolution of Exploit Frameworks...............................................................11 Defence Evolution.................................................................................. 12 Cyber Victims........................................................................................ 13 Current Situation....................................................................................13 Cybercrime Case Study: The Emerging Threat of Internet Bots .......................14 Introduction.........................................................................................
    [Show full text]
  • An Introduction to Computer Security: the NIST Handbook U.S
    HATl INST. OF STAND & TECH R.I.C. NIST PUBLICATIONS AlllOB SEDS3fl NIST Special Publication 800-12 An Introduction to Computer Security: The NIST Handbook U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards Barbara Guttman and Edward A. Roback and Technology COMPUTER SECURITY Contingency Assurance User 1) Issues Planniii^ I&A Personnel Trairang f Access Risk Audit Planning ) Crypto \ Controls O Managen»nt U ^ J Support/-"^ Program Kiysfcal ~^Tiireats Policy & v_ Management Security Operations i QC 100 Nisr .U57 NO. 800-12 1995 The National Institute of Standards and Technology was established in 1988 by Congress to "assist industry in the development of technology . needed to improve product quality, to modernize manufacturing processes, to ensure product reliability . and to facilitate rapid commercialization ... of products based on new scientific discoveries." NIST, originally founded as the National Bureau of Standards in 1901, works to strengthen U.S. industry's competitiveness; advance science and engineering; and improve public health, safety, and the environment. One of the agency's basic functions is to develop, maintain, and retain custody of the national standards of measurement, and provide the means and methods for comparing standards used in science, engineering, manufacturing, commerce, industry, and education with the standards adopted or recognized by the Federal Government. As an agency of the U.S. Commerce Department's Technology Administration, NIST conducts basic and applied research in the physical sciences and engineering, and develops measurement techniques, test methods, standards, and related services. The Institute does generic and precompetitive work on new and advanced technologies. NIST's research facilities are located at Gaithersburg, MD 20899, and at Boulder, CO 80303.
    [Show full text]
  • North Dakota Homeland Security Anti-Terrorism Summary
    UNCLASSIFIED NORTH DAKOTA HOMELAND SECURITY ANTI-TERRORISM SUMMARY The North Dakota Open Source Anti-Terrorism Summary is a product of the North Dakota State and Local Intelligence Center (NDSLIC). It provides open source news articles and information on terrorism, crime, and potential destructive or damaging acts of nature or unintentional acts. Articles are placed in the Anti-Terrorism Summary to provide situational awareness for local law enforcement, first responders, government officials, and private/public infrastructure owners. UNCLASSIFIED UNCLASSIFIED NDSLIC Disclaimer The Anti-Terrorism Summary is a non-commercial publication intended to educate and inform. Further reproduction or redistribution is subject to original copyright restrictions. NDSLIC provides no warranty of ownership of the copyright, or accuracy with respect to the original source material. QUICK LINKS North Dakota Energy Regional Food and Agriculture National Government Sector (including Schools and Universities) International Information Technology and Banking and Finance Industry Telecommunications Chemical and Hazardous Materials National Monuments and Icons Sector Postal and Shipping Commercial Facilities Public Health Communications Sector Transportation Critical Manufacturing Water and Dams Defense Industrial Base Sector North Dakota Homeland Security Emergency Services Contacts UNCLASSIFIED UNCLASSIFIED North Dakota Three wildfires scorch parts of western North Dakota. While North Dakota has, for the most part, escaped the large-scale wildfires garnering national headlines and burning the landscapes of neighboring South Dakota and Montana, three fires have caused havoc in the western part of the State. The Bureau of Indian Affairs reported September 21 that the Little Swallow fire had grown to consume 6,000 acres and was just 40 percent contained. Northwest of Dickinson, visitors to Bennett Campground on the Dakota Prairie Grasslands were evacuated after the Trail Side fire broke out.
    [Show full text]