First Edition: MAJ THOMAS A. OWENS, CAP 2019 Revision: MAJ DEREK RUSTVOLD, CAP DIRECTOR OF CYBER PROGRAMS, MID-ATLANTIC REGION Editing: SUSAN MALLETT, CAP NHQ DR. JEFF MONTGOMERY, CAP NHQ Published by NATIONAL HEADQUARTERS CIVIL AIR PATROL AEROSPACE EDUCATION DIRECTORATE MAXWELL AFB, ALABAMA 36112 REVISED SEPTEMBER 2019 Contents AN INTRODUCTION TO CYBERSECURITY 4 CAP Cybersecurity Module 4 Summary of Recent Attacks and Motivation for Action 5 Activity Group One: Codes, Ciphers and Encryption Awareness 8 Unit Profile: Room 40 and Bletchley Park 15 Biography: Alan Turing 15 CONCEPTS IN INFORMATION ASSURANCE AND CYBER WARFARE 16 Activity Group Two: Vulnerabilities and Basic Defense Skills 19 Patriot Bio: Maj. Gen. Robert J. Skinner 25 CONCEPTS OF OPERATING SYSTEMS AND NETWORKING 26 Activity Group Three: Basic Probing Skills 27 th Unit Profile: 24 Air Force 38 th Unit Profile: 67 Network Warfare Wing 38 Patriot Bio: Brig. Gen. Kevin B. Wooton 38 EXPLORING CAREERS IN CYBERSECURITY 39 Unit Profile: USCYBERCOM 43 Patriot Bio: General Keith B. Alexander 43 Bonus Graphic: USCYBERCOM 44 CONCLUSION AND NEXT STEPS 45 APPENDICES 51 A: Motivational Chronology of Cyber Warfare 51 B: Glossary of Terms, Threats, and Countermeasures 55 C: Toolbox of Promotional Resources 68 D: Toolbox of Technical Resources 72 E. Solutions to Module Activities 74 3 An Introduction to Cybersecurity Our Nation's Cyber Dependency At all its various levels, the United States has become a “cybernation.” Aviators will be amused to discover the prefix “cyber-” is derived from the word cybernetic, which comes from a Greek word κυβερνητικός (kybernētēs) which means pilot, rudder, steersman, or governor. Some early cybernetic applications will be reviewed in the Chronology Appendix. Every aspect of American culture, commerce, public safety, and national defense is now inextricably dependent upon systems of networked computers. These systems make our nation competitive and safe. However, our dependency on computers and networks is not without risk. Our economy and national defense would be seriously disrupted if the networked computer systems on which we depend became unreliable or unavailable. Anyone driving on the Eisenhower Interstate System eventually sees the signs and recognizes transportation to be a vital to national security and our economy. Should key data access be denied or corrupted, problems with signal lights at busy interchanges or intersections or with Air Traffic Control flight plans could grind our nation to a halt. Cyber Attackers Some individuals (“hackers”) electronically break into networked computer systems just to prove they can. In other cases, well organized groups break into systems to conduct illicit financial transactions including stealing people’s credit card numbers. Better funded groups have recently penetrated US systems to corrupt data, sabotage operations and conduct espionage to include capturing aircraft performance and avionics data. Cybersecurity Cybersecurity is the professional practice of identifying vulnerabilities and countering threats of exploitation or disruption to computers, smart phones and network systems. For most of us, it involves doing very simple things such as setting strong passwords, using encryption for our wireless networks, ignoring suspicious links or attachments and not responding to “phishing” emails. At management levels, we do not transmit DOD contractor design data across unsecured channels. At technical levels, we work to employ good configuration control with correct firewall and port settings, and router configurations. In all cases, we as patriots do the necessary things to ensure that the cybernetic systems on which we depend are trustworthy, confidential, accessible, and secure. CAP Cybersecurity Module The purpose of this module is to introduce all of our readers to current threats in Cyberspace and to provide some immediate activities for improving our collective awareness and defense. A summary of careers in computer and network security is provided. This module also serves as a primer for those seeking to compete in the CyberPatriot Program sponsored by the Air Force Association. The battlefield is vast and so we provide checklists, a chronology and a very practical glossary of common terms in the appendices. You can use the chronology to motivate participants. You can use the glossary to look up concepts and commands and rapidly build your understanding. NOTE: This module is fully intended by Civil Air Patrol to be used as an education product to help our members understand the implications of cyber threats and the need for cyber security. 4 Summary of Recent Attacks and Motivation for Action In August of 2003, CSX passenger and freight trains in the Washington D.C. area were stopped after the company's telecommunications network was overtaken by the Sobig.F worm. The Sobig.F worm self-deactivated on September 10, 2003. Microsoft announced that they would pay $250,000 for information leading to the arrest of the creator of the Sobig worm. To date, the perpetrator has not been caught. In 2007, McAfee, Inc. alleged that the People's Republic of China was actively involved in "cyberwar,” and had initiated cyber-attacks on the nations of India, Germany, and the United States. Two years later, McAfee releases a 37-page report observing that “The line between cyber crime and cyber war is blurred in large part because nation-states have already demonstrated that they are willing to tolerate, encourage or even direct criminal organizations and private citizens to attack enemy targets.” In June of 2007, the Pentagon forced 1500 computers off line as a result of cyber attacks. "The nature of the threat is large and diverse, [..]" said US Navy Lt Cmdr Chit Peppler, a Pentagon spokesman. In 2008, the Pentagon reported a total of 360 million attempts to break into its networks, up from just 6 million in 2006. This included a report in the Wall Street Journal about a successful cyberespionage attempt to hack into the $300 billion Joint Strike Fighter project and copy data about the aircraft's design and electronics systems. In April 2009, reports surfaced that China and Russia had infiltrated the U.S. electrical grid and left behind software programs that could be used to disrupt the system. The intruders seek to navigate and map the infrastructure. Many of the intrusions were detected, not by the companies in charge of the infrastructure, but rather by U.S. intelligence agencies. Intelligence officials maintain concerns that cyber-attackers could take control of electrical facilities, nuclear power plants or financial networks during a time of conflict. In December 2009 through January 2010, a cyber-attack dubbed Operation Aurora was launched from China against Google and over 20 other companies. Google determined the attacks originated from China and is currently set to "review the feasibility" of its business operations in China. In June of 2011, spear-phishing attacks on White House staffer Gmail accounts are traced to Jian, PRC. The People's Republic of China denied any involvement. 5 Sony PlayStation Network Hacked In April of 2011, Sony's PlayStation network was hacked and user account information to include names, passwords and credit card data was compromised. Crackers later broke into Sony Pictures' website and compromised the accounts of over 1 million users. The gaming company Sega was also violated with nearly 1.3 million users' details compromised. Sega makes games for PlayStation and other gaming systems. In June, an 18-year old was arrested in London under suspicion of “hacking into systems and mounting denial of service attacks against a number of international businesses and intelligence agencies," police said. The thought was that this suspect was the leader of Lulz Security, or LulzSec, a band of hackers who appear to be responsible for a string of high-profile and sometimes embarrassing Internet attacks. Their most notable strike was a distributed denial-of-service attack on 15 June 2011 that actually shut down the Central Intelligence Agency's website for several hours. On 17 June, the group posted an irreverent denial that it was their leader who had been arrested. "The main anti-LulzSec argument suggests that we're going to bring down more Internet laws by continuing our public shenanigans, and that our actions are causing clowns with pens to write new rules for you," the group wrote. "But what if we just hadn't released anything? What if we were silent? That would mean we would be secretly inside FBI affiliates right now, inside PBS, inside Sony... watching... abusing .................................................................. " On 1 August 2011, the arrested teenager was released on bail and soon after... Anonymous hackers penetrated FBI contractor ManTech International. Documents belonging to NATO, the U.S. Army, the U.S Department of Homeland Security and the U.S. State Department were said to have been compromised. The message from some youthful leaders of various hacker organizations is that trusted agencies and employers need to do a much better job of ensuring our national and economic security. This seems to be supported by a recent audit by the Department of Justice, which found the FBI unprepared. The year of 2014 included a series of high impact data breaches including Sony Pictures, Apple iCloud, Heartbleed vulnerability and Cryptolocker ransomware. The Sony Pictures breach was potentially attributed to North Korea for political retaliation. The same year