DOCSLIB.ORG

Web Attack Survival Guide

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Web Attack Survival Guide WHITE PAPER Web Attack Survival Guide What Is Your Worst Security Nightmare? Receiving a “ransom note” with an ultimatum to pay millions of dollars or to watch your company’s website buckle under a deluge of DDoS requests? Or opening an ominous Google alert that reveals your company is the next target of a hacktivist campaign? Or discovering the application framework that powers your website is riddled with vulnerabilities—and learning it will take months to fix them? What Do You Do When Your Worst Nightmare Becomes Reality? The Web Attack Survival Guide describes today’s application threat landscape, including the attack methods and tools used by hacktivists and cybercriminals. It explains the processes and the technologies you can use to safeguard your website from attack. It also helps you prioritize security efforts and it lists security tips and tricks that you might otherwise have overlooked. After reading the Web Attack Survival Guide, you will be able to confidently face an impending web attack with a well-thought out strategy. A Blueprint for Web Attack Survival 1 Understand the Threat Actor 2 Develop a Security Response Plan 3 Locate and Assess Applications and Servers 4 Strengthen Application, Network, and End-Point Security Controls 5 Counter the Attack: Monitoring and Tuning Procedures When Under Attack 6 Bring in the Experts: Optional Security Consulting Services 7 Conduct a Post Mortem of the Attack The State of Application Security The Application Threat Landscape 74% of organizations received Web applications sit at the top of the list of hackers’ favorite attack targets. In fact, 75% of all a DDoS attack in the past year1 cyber-attacks target web applications. Most websites suffer dozens of attacks per day and some 86% of all websites have at sites sustain, on average, up to 26 attacks per minute. least one serious vulnerability2 While web attacks are not new—they have existed since the dawn of the Internet—one attack trend 75% of all cyber-attacks target is the emergence of hacktivism and prolonged attack campaigns. 3 web applications Rise of Hacktivism 33% of all websites had at least Hacktivism vaulted onto the scene and into the collective imagination in late 2010, with the one serious vulnerability every emergence of hacktivist groups like Anonymous, LulzSec, and Anti-Sec. Initially targeting financial day of the year in 20124 institutions, Anonymous and its imitators quickly moved on to dozens of other government and business targets. Within two years, 58% of all data theft5 was attributed to hacktivist attacks. In 2012, new players, like the Syrian Electronic Army, AnonGhost, and Iranian Cyber Army, joined the party and launched a spree of attacks against U.S. banks and other western targets. Many of these attacks combine traditional web attacks, like SQL injection and cross-site scripting, with Distributed Denial of Service (DDoS) assaults. Hacktivist attacks not only pose public relations disasters for the targeted companies, but many also result in costly data breaches and prolonged website outages. Distributed Denial of Service (DDoS) Attacks Go Commercial Besides the specter of hacktivism, organizations must contend with DDoS attacks launched by competitors or cyber extortionists. These industrialized DDoS attacks can be extraordinarily powerful—hundreds of times greater than typical bandwidth levels, reaching over 300 Gbps or more. And DDoS attacks are becoming more advanced in order to outwit conventional security controls. Instead of simply inundating targets with a flood of TCP or UDP packets, many DDoS attacks now exploit application and database flaws. Fighting Back Every day, hackers unleash massive attack campaigns designed to take websites offline, steal DDoS Attack Tools Used by confidential data, and deface content. Fortunately, organizations can prepare for and repel these Hacktivist and Commercial attacks. Based on feedback from application security consultants and from IT security personnel DDoS Services on the front lines of attack, this survival guide lays out a step-by-step plan to fend off web threats. 1 “2012 Data Breach Investigations Report,” Verizon Business, 2012 2 “WhiteHat website Security Statistic Report,” WhiteHat Security, 12th Edition 3 Gartner Research 4 “State of Web Security,” Ponemon Institute 5 2012 Data Breach Investigations Report,” Verizon Business, 2012 2 Web Attack Survival: Step-by-Step Strategy Step 1. Understand the Threat Actor To prepare for an attack, the first step is to understand the threat actor. What enemy do you face? “If you know your enemies A well-known hacktivist group such as Anonymous or the Syrian Electronic Army? A script kiddie? and know yourself, you will Industrialized cybercriminals? Research their attack techniques and identify the tools that they use. not be imperiled in a hundred Monitor Social Media battles... if you do not know your enemies nor yourself, If hacktivists have threatened your organization, then track social media sites such as Twitter, you will be imperiled in Facebook, and YouTube for updates about their attack methods and timelines. Hacktivists may every single battle.” discuss vulnerabilities or weak points of your site. – Sun Tzu, The Art of War6 Hacktivist groups will also disclose the types of DDoS attack tools that volunteer recruits can use to attack your site. Armed with this information, you can create application security signatures to easily block these attack tools. With several recent attacks, hacktivists have published “booster packs” that configure attack tools to exploit web vulnerabilities or URLs in the targeted websites. Be aware of the contents of these booster packs, so you can implement policies to repulse them. Profiling cybercriminals is more challenging than profiling hacktivists, simply because cybercriminals do not advertise their methods or strategies. Unless you monitor hacker forums, your best option is to talk to peers in your industry about attack sources, techniques, and tools.7 Be sure to read hacker intelligence reports and security research that pertain to your industry. Step 2. Develop a Security Response Plan Change Is If your organization is the target of a specific attack campaign, like a DDoS attack or a hacktivist Unavoidable attack, then you should organize an incident response team that will manage security response efforts. The response team may potentially need to be available around-the-clock. Depending on Your incident response team the severity of the attack, assign 24x7 coverage to assure that someone is available to respond to may need to apply security new threats, immediately. policies quickly during an attack. Determine whether The security response team will most likely be composed of IT security personnel, but may include you need to relax your internal members from the networking and application development teams. approval processes to ensure you can rapidly adapt to Red Team changing attack vectors. Create a “red team”—a team of security engineers that will look for vulnerabilities that attackers could exploit. The red team should evaluate all potential risks including, application, network, end-user, social engineering, and even physical threats. 6 Although over-quoted, Sun Tzu’s suggestions—from preparation, to the art of deception, to battle tactics—are surprisingly apropos for defending against web attacks. 7 Security information sharing and analysis organizations include National Council of ISACs, Financial Services ISAC, SANS Internet Storm Center, and National Healthcare ISAC. 3 Your Little Black Book of Contacts Prepare a contact list with the names, phone numbers, and email addresses of the following groups: 1. IT security (including members of your security response team), IT operations, networking, application development, database administration, legal, and executive management 2. DNS and Internet Service Providers 3. DDoS Protection Services 4. Relevant security specialists or consultants—for example, record the contact information of field engineers at your web application firewall (WAF), Security Information and Event Management (SIEM), and Intrusion Prevention System (IPS) vendors. You may need to enlist their help when you are under attack. Document Network and Server Information Security Tip Gather network and server information, including: DO: Keep your response 1. IP addresses of web servers, databases, DNS servers, network firewalls, web application firewalls, plan information, network database firewalls, and routers and switches diagrams, and IP address 2. Disaster recovery IP addresses, if applicable schemes secure. Also, prepare network architecture diagrams of all data centers at risk. If architecture diagrams DON’T: Email your already exist, review them, and make sure they are up-to-date. network architecture and contact lists to the entire Notify Executive Management and Employees security department or When you know about an impending attack, inform your executive management team about the store them in a public file threat and provide periodic status updates. In addition, you may need to warn company employees share titled “Steal me first.” of the attack. For DDoS attacks, notify all relevant users of potential application or network downtime. If your organization faces a hacktivist attack or a targeted attack, instruct users to update any non-secure passwords and educate them about the risk of phishing attacks. Prepare your IT personnel for social engineering threats. Ask them to verify any IT helpdesk and password change
Load more

Recommended publications
  • The Iranian Cyber Threat
    The Iranian Cyber Threat May 2021 0 Contents Introduction .............................................................................................................................................. 2 Cyber Retaliation ..................................................................................................................................... 2 Iran’s National Security Strategy .............................................................................................................. 4 Laying the Groundwork ........................................................................................................................... 5 Structure ................................................................................................................................................... 5 Defense ................................................................................................................................................... 6 Offense .................................................................................................................................................... 6 History of Iranian Cyber Attacks and Incidents ........................................................................................... 7 The Attacks .............................................................................................................................................. 8 Iranian Cyber Army .................................................................................................................................
    [Show full text]
  • The Iranian Cyber Threat
    The Iranian Cyber Threat May 2020 0 Contents Introduction ............................................................................................................................................ 1 Structure ................................................................................................................................................. 4 History of Iranian Cyber Attacks and Incidents ......................................................................................... 6 Conclusions ........................................................................................................................................... 11 Introduction In the early morning hours of January 3, 2020, Iran’s Islamic Revolutionary Guard Corps (IRGC) Quds Force commander Qassem Soleimani was killed in a U.S. drone strike that targeted his convoy immediately after landing at Baghdad’s international airport. Iranian leaders vowed “harsh retaliation” for the attack, and followed up on this threat by firing a salvo of over a dozen ballistic missiles at two Iraqi air bases housing U.S. troops in the early morning hours of January 8, wounding over 100 soldiers. While Iran has not yet taken additional major acts of revenge, it has signaled that it is likely to strike U.S. interests again at a future time of its choosing. Iran’s Supreme Leader, Ayatollah Ali Khamenei, intoned that while the ballistic missile attack represented a “slap on the face” for the U.S., “military action like this (ballistic missile) attack is not sufficient,” vowing to refuse to enter negotiations and to continue to confront the U.S. until its influence is expelled from the region. In the intervening period, Iran’s leaders have maintained a steady drumbeat of threatening rhetoric aimed at the U.S., with Soleimani’s successor, Esmail Qaani, for instance vowing to “hit his enemy in a manly fashion.” With U.S.-Iran tensions heightened, the U.S. national security apparatus has cautioned that one avenue for retaliation Iran is likely to pursue is launching offensive cyber attacks targeting the U.S.
    [Show full text]
  • Iranian Offensive Cyber Attack Capabilities
    January 13, 2020 Iranian Offensive Cyber Attack Capabilities Threat Evolution internal internet security controls. The NCC is also tasked Iran’s use of cyberspace has evolved from an internal with “preparing for a cultural war” between Iran and its means of information control and repression to more enemies, according to the 2013 NCC Statute issued by Iran. aggressive attacks on foreign targets. The regime has been developing its own cybersecurity software and internet Islamic Revolutionary Guard Corps (IRGC). A branch architecture in order to protect and insulate its networks, of the Iranian Armed Forces, this military force oversees and it has been developing technological cyber expertise as offensive cyber activities. a form of asymmetric warfare against a superior conventional U.S. military. IRGC Electronic Warfare and Cyber Defence Organization. This organization provides training courses Iran also has a history of using cyberattacks in retaliation in cyber defenses and denies access to and censors online against the United States. In 2010, a computer worm known content and communications. as Stuxnet was discovered by cybersecurity researchers to have infiltrated the computers that controlled nuclear Basij Cyber Council. Considered a paramilitary force, centrifuges in Iran, causing physical damage and preventing Basij comprises nonprofessionals, using volunteer hackers operation. The Stuxnet worm was reported to have been a under IRGC specialist supervision. These volunteers are joint effort between the governments of the United States sometimes referred to as “cyber war commandos.” and Israel. Following the discovery of the Stuxnet malware, U.S. assets experienced an increase in the severity and National Passive Defense Organization (NPDO).
    [Show full text]
  • Ethical Hacking
    Ethical Hacking Alana Maurushat University of Ottawa Press ETHICAL HACKING ETHICAL HACKING Alana Maurushat University of Ottawa Press 2019 The University of Ottawa Press (UOP) is proud to be the oldest of the francophone university presses in Canada and the only bilingual university publisher in North America. Since 1936, UOP has been “enriching intellectual and cultural discourse” by producing peer-reviewed and award-winning books in the humanities and social sciences, in French or in English. Library and Archives Canada Cataloguing in Publication Title: Ethical hacking / Alana Maurushat. Names: Maurushat, Alana, author. Description: Includes bibliographical references. Identifiers: Canadiana (print) 20190087447 | Canadiana (ebook) 2019008748X | ISBN 9780776627915 (softcover) | ISBN 9780776627922 (PDF) | ISBN 9780776627939 (EPUB) | ISBN 9780776627946 (Kindle) Subjects: LCSH: Hacking—Moral and ethical aspects—Case studies. | LCGFT: Case studies. Classification: LCC HV6773 .M38 2019 | DDC 364.16/8—dc23 Legal Deposit: First Quarter 2019 Library and Archives Canada © Alana Maurushat, 2019, under Creative Commons License Attribution— NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) https://creativecommons.org/licenses/by-nc-sa/4.0/ Printed and bound in Canada by Gauvin Press Copy editing Robbie McCaw Proofreading Robert Ferguson Typesetting CS Cover design Édiscript enr. and Elizabeth Schwaiger Cover image Fragmented Memory by Phillip David Stearns, n.d., Personal Data, Software, Jacquard Woven Cotton. Image © Phillip David Stearns, reproduced with kind permission from the artist. The University of Ottawa Press gratefully acknowledges the support extended to its publishing list by Canadian Heritage through the Canada Book Fund, by the Canada Council for the Arts, by the Ontario Arts Council, by the Federation for the Humanities and Social Sciences through the Awards to Scholarly Publications Program, and by the University of Ottawa.
    [Show full text]
  • How Cyber-Geopolitics Will Destabalize the Middle East
    Policy Brief 2017 | No. 35 Cheap Havoc: How Cyber-Geopolitics Will Destabilize the Middle East By Kristina Kausch Since a hack on a Qatari government website in June 2017 triggered the Gulf Cooperation Council’s (GCC) deepest diplomatic crisis since its inception, the Gulf states have been stepping up their efforts to enhance their cyber reach and keep up with the rapid strides of regional cyber powers Iran and Israel. Planting a seed of misinformation in a bed of long-standing tensions, a fake news story exploited regional polarization and anti-Iranian sentiments to rip the region further apart. Over the past few years, governments and non-state The Qatar crisis not only escalated long-simmering groups in the Middle East and North Africa have tensions in a region key to U.S. and EU interests and gone to great lengths to build cyber capabilities. put in question its regional security arrangements; it The proliferation of cyber weapons in the region also provided a glimpse of how the pursuit of expansive and their use as geopolitical tools has the potential geopolitical ambitions by means of targeted cyber- to further shake and unsettle regional crises and attacks can generate conflict and trigger political larger Western interests. landslides in the glimpse of an eye. The biggest risk for Western powers is to leave In the Middle East, global geopolitical trends tend any doubt about their readiness to retaliate or to manifest themselves early, and intensely. Digital to support their allies against any actors’ cyber innovation offers political adversaries increasing aggressions. As actors around the world begin opportunity to find vulnerabilities that have the to grasp the opportunities offered by conducting potential to undo the capacities of a nation’s economic geopolitical operations in cyberspace, the window and military force.
    [Show full text]
  • WORLD WAR C : Understanding Nation-State Motives Behind Today’S Advanced Cyber Attacks
    REPORT WORLD WAR C : Understanding Nation-State Motives Behind Today’s Advanced Cyber Attacks Authors: Kenneth Geers, Darien Kindlund, Ned Moran, Rob Rachwald SECURITY REIMAGINED World War C: Understanding Nation-State Motives Behind Today’s Advanced Cyber Attacks CONTENTS Executive Summary ............................................................................................................................................................................................................................................................................................................... 3 Introduction ............................................................................................................................................................................................................................................................................................................................................... 4 A Word of Warning ................................................................................................................................................................................................................................................................................................................. 5 The FireEye Perspective ...........................................................................................................................................................................................................................................................................................
    [Show full text]
  • The Future of Iranian Terror and Its Threat to the U.S. Homeland
    The Future of Iranian Terror and Its Threat to the U.S. Homeland Statement before the House of Representatives Committee on Homeland Security Subcommittee on Counterterrorism and Intelligence Ilan Berman Vice President, American Foreign Policy Council February 11, 2016 Chairman King, Ranking Member Higgins, distinguished members of the Subcommittee: It is an honor to appear before you today to discuss Iran’s ongoing sponsorship of international terrorism and the impact that the new nuclear deal, formally known as the Joint Comprehensive Plan of Action (JCPOA), will have upon it. It is a topic that is of critical importance to the security of the United States and our allies abroad. While the Obama administration has argued that the signing of the JCPOA has enhanced both U.S. and global security, there is compelling evidence to the contrary: namely, that the passage of the agreement has ushered in a new and more challenging phase in U.S. Mideast policy. SHORTFALLS OF THE JCPOA While the JCPOA can be said to include some beneficial elements—including short- term constraints on Iranian uranium enrichment, a reduction in the number of centrifuges operated by the Islamic Republic, and a delay of the “plutonium track” of the regime’s nuclear program—there is broad consensus among national security practitioners, military experts, scientists and analysts that the agreement is woefully deficient in several respects. First, the new nuclear deal does not dismantle Iran’s nuclear capability, as originally envisioned by the United States and its negotiating partners. Contrary to the White House’s pledges at the outset of talks between Iran and the P5+1 nations in November 2013, the JCPOA does not irrevocably reduce Iran’s nuclear potential.
    [Show full text]
  • Iranian Cyber-Activities in the Context of Regional Rivalries and International Tensions
    CSS CYBER DEFENSE PROJECT Hotspot Analysis: Iranian cyber-activities in the context of regional rivalries and international tensions Zürich, May 2019 Version 1 Risk and Resilience Team Center for Security Studies (CSS), ETH Zürich Iranian cyber-activities in the context of regional rivalries and international tensions Authors: Marie Baezner © 2019 Center for Security Studies (CSS), ETH Zürich Contact: Center for Security Studies Haldeneggsteig 4 ETH Zürich CH-8092 Zürich Switzerland Tel.: +41-44-632 40 25 [email protected] www.css.ethz.ch Analysis prepared by: Center for Security Studies (CSS), ETH Zürich ETH-CSS project management: Tim Prior, Head of the Risk and Resilience Research Group Myriam Dunn Cavelty, Deputy Head for Research and Teaching, Andreas Wenger, Director of the CSS Disclaimer: The opinions presented in this study exclusively reflect the authors’ views. Please cite as: Baezner, Marie (2019): Hotspot Analysis: Iranian cyber-activities in context of regional rivalries and international tensions, May 2019, Center for Security Studies (CSS), ETH Zürich. 1 Iranian cyber-activities in the context of regional rivalries and international tensions Table of Contents 1 Introduction 4 2 Background and chronology 5 3 Description 9 3.1 Attribution and actors 9 Iranian APTs 9 Iranian patriotic hackers 11 Western actors 12 3.2 Targets 12 Iranian domestic targets 12 Middle East 12 Other targets 13 3.3 Tools and techniques 13 Distributed Denial of Service (DDoS) attacks 13 Fake personas, social engineering and spear phishing 13
    [Show full text]
  • Was Stuxnet an Act of War? Jânis Jansons
    4. LESSONS LEARNED AND CONFLICTS HISTORY WAS STUXNET AN ACT OF WAR? JÂNIS JANSONS ABSTRACT DOI: 10.26410/SF 1/17/11 Modern societies live in the complex and fragile infor­ mation environment, in which data processing and ex­ change grow exponentially. Different digital computer­ ized systems support most of key infrastructures like financial systems, power and water supplies, air traffic management, public and military communications. To increase accessibility to those systems in the informa­ tion domain, it requires interoperability and interconnec­ tivity which makes them complex to maintain and vulner­ able to cyber-attacks/intrusions. The Internet is an own­ erless, ubiquitous and open to all information exchange domains which can shape the international relations through the cyber domain and there is no international entity that can control and affect the data flow. Each country has its own legislation to react and influence local users through Internet service providers and only close cooperation among the states can help to identify and prevent illegal activities against other states as well as support foreign countries during investigations. The JANIS JANSONS1 paper will uncover how cyber weapon was used to in­ [email protected] fluence state struggling, becoming a nuclear power for the first time. It is divided into two parts to explain the Baltic Defence College, essence of the act of war and cyberspace to understand Tartu. Estonia the environment where Stuxnet was applied. Next it will focus on impact and reaction of Stuxnet in order to ana­ Opinions expressed by the authoi lyse its utilization within cyberspace. are his own views and they do no1 reflect in any way the official policy or position of the Baltic Defence KEY WORDS College, or the governments of Cybersecurity, Internet, Stuxnet, act of war.
    [Show full text]
  • Significant Cyber Incidents Since 2006 This List Is a Work in Progress
    Significant Cyber Incidents Since 2006 This list is a work in progress that we update as new incidents come to light. If you have suggestions for additions, send them to [email protected]. Significance is in the eye of the beholder, but we focus on cyber-attacks on government agencies, defense and high tech companies, or economic crimes with losses of more than a million dollars. August 2016. Designs and data regarding India’s Scorpene submarines were leaked from the French shipbuilder DCNS. DCNS also builds submarines for Malaysia and Chile, and recently won contracts to build submarines for Brazil and Australia. July 2016. Forensic evidence points to Russian intelligence agencies as responsible for the release of 20,000 emails from the Democratic National Committee. July 2016. A series of DDOS attacks disrupted 68 Philippine government websites on July 12, the day the United Nations International Arbitration court released its decision ruling in favor of the Philippines on the West Philippine Sea territorial dispute. July 2016: A new strain of cyberespionage malware with a dropper designed to target specific European energy companies has been discovered. Researchers say the malware appears to be the work of a nation-state, may have originated in Eastern Europe, and its role seems to be battlespace preparation. July 2016: A Chinese cyber espionage group targeted defense industries in Russia, Belarus, and Mongolia with APTs using phishing campaigns to exfiltrate data. May 2016: Suspected Russian hackers attempted to penetrate the Turkish Prime Minister’s office and the German Christian Democratic Union party. The attacks targeted personal email accounts and attempted to obtain login credentials.
    [Show full text]
  • The Rise of China's Hacking Culture: Defining Chinese Hackers
    California State University, San Bernardino CSUSB ScholarWorks Electronic Theses, Projects, and Dissertations Office of aduateGr Studies 6-2016 The Rise of China's Hacking Culture: Defining Chinese Hackers William Howlett IV California State University - San Bernardino Follow this and additional works at: https://scholarworks.lib.csusb.edu/etd Part of the Asian Studies Commons, Criminology and Criminal Justice Commons, International Relations Commons, Politics and Social Change Commons, and the Science and Technology Studies Commons Recommended Citation Howlett, William IV, "The Rise of China's Hacking Culture: Defining Chinese Hackers" (2016). Electronic Theses, Projects, and Dissertations. 383. https://scholarworks.lib.csusb.edu/etd/383 This Thesis is brought to you for free and open access by the Office of aduateGr Studies at CSUSB ScholarWorks. It has been accepted for inclusion in Electronic Theses, Projects, and Dissertations by an authorized administrator of CSUSB ScholarWorks. For more information, please contact [email protected]. THE RISE OF CHINA’S HACKING CULTURE DEFINING CHINESE HACKERS A Thesis Presented to the Faculty of California State University, San Bernardino In Partial Fulfillment of the Requirements for the Degree Master of Arts in Social Sciences and Globalization by William Sedgwick Howlett June 2016 THE RISE OF CHINA’S HACKING CULTURE DEFINING CHINESE HACKERS A Thesis Presented to the Faculty of California State University, San Bernardino by William Sedgwick Howlett June 2016 Approved by: Cherstin Lyon, Committee Chair, Social Sciences and Globalization Jeremy Murray, Committee Member, History Jose Munoz, Committee Member, Sociology © 2016 William Sedgwick Howlett ABSTRACT China has been home to some of the most prominent hackers and hacker groups of the global community throughout the last decade.
    [Show full text]
  • US Efforts to Deter Hostile Iranian Cyber Actions
    U.S. Efforts to Deter Hostile Iranian Cyber Actions July 2015 Cyber attack is a new tool of national power. It provides a means of coercion, influence, and attack. The use of cyber techniques as intelligence tools dates back to the 1980s; cyber attack by militaries dates back to the 1990s.1 The use of cyber tools and techniques as an instrument of national power is the norm in the Gulf. The Gulf has become a flashpoint for cyber conflict given the high level of activity and the chance for miscalculation and escalation into conventional conflict. Three key incidents have focused the attention of Gulf states on cyber security. The first was the effect of social media and the Internet in the Arab uprisings of 2011 and the 2009 Iranian “Green Revolution.” The Internet can amplify political forces in ways that are difficult to predict or control. The second was the Stuxnet attacks launched against Iranian nuclear facilities in 2010. Stuxnet led to significant changes in Iranian policy, but it was not unique. Researchers around the world discovered significant malware programs–Stuxnet, Stars, Duqu, Flame, Shamoon–used for espionage or attack against Gulf targets.2 Finally, the 2012 attacks on Saudi Aramco and the Qatari firm RasGas, generally attributed to Iran, put most Gulf countries on notice of the new kind of risk they faced. Iran’s Cyber capabilities Three military organizations play leading operational roles: – Iran’s “Passive Defense Organization,” the Basiji and the IRG. The Passive Defense Organization is responsible for Iran’s “cyber defense strategy” and houses Iran’s cyber defense headquarters, which coordinates efforts by the armed forces, the intelligence services, and the Telecommunications Ministry.
    [Show full text]