INFORMATION WARFARE Part 3 Theory Advanced Course in

Скачать презентацию INFORMATION WARFARE Part 3 Theory Advanced Course in

93f70e28cd3c8d919b60050b97ec72a5.ppt

Количество слайдов: 42

INFORMATION WARFARE Part 3: Theory Advanced Course in Engineering 2005 Cyber Security Boot Camp Air Force Research Laboratory Information Directorate, Rome, NY M. E. Kabay, Ph. D, CISSP Assoc. Prof. Information Assurance Program Direction, MSIA Division of Business & Management, Norwich University Northfield, Vermont mailto: mkabay@norwich. edu V: 802. 479. 7937 1 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Topics Ø 08: 00 -08: 15 Introductions & Overview Ø 08: 15 -09: 00 Fundamental Concepts Ø 09: 05 -11: 55 Case Histories Ø 13: 15 -15: 15 INFOWAR Theory Ø 15: 30 -16: 00 Project Assignments 2 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

What is INFOWAR? Ø Use of or attacks on information and information infrastructure to achieve strategic objectives Ø Tools in hostilities among q. Nations q. Trans-national groups (companies, NGOs, associations, interest groups, terrorists) q. Corporate entities (corporations, companies, government agencies) q. Individuals 4 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Dorothy Denning’s Nutshell Ø Information Warfare and Security (1999). ACM Press (ISBN 0 -201 -43303 -6). Ø Offensive information warfare operations alter availability and integrity of information resources q. Benefit of offense & detriment to defense q. Offense acquires greater access to info q. Defense loses all or partial access to info q. Integrity of information diminished 5 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Denning’s Theory of INFOWAR Ø Information resources include people & tools q. Containers q. Transporters q. Sensors q. Recorders q. Processors Ø Value of resource differs q. Over time q. To different people 6 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Psyops in Cyberspace Ø Digital “photographs” may not be photographs Ø Audio “recordings” may not be recordings Ø Log files may be fiction Ø Opinion polls may be nonsense Ø Election results may be fixed Ø Conspiracy theories may be true Ø References may be nonexistent Ø Facts may be illusory (see article “Junk Science”) Ø History may be recreation 7 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Schwartau’s Levels of INFOWAR Ø I: Against individuals q. Theft, impersonation q. Extortion, blackmail q. Defamation, racism Ø II: Against organizations q. Industrial espionage q. Sabotage q. Competitive & stock manipulation Ø III: Against nations q. Disinformation, destabilization q. Infrastructure destabilization q. Economic collapse 8 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Military Approaches to IW Ø HUMINT q INTEL q COINTEL Ø SIGINT q COMINT q ELINT q FISINT Ø MASINT Ø IMINT Ø TECHNINT Ø OSINT 9 Ø Human intelligence q Intelligence q Counterintelligence Ø Signals intelligence q Communications q Electronic q Foreign Instrumentation Ø Measurement & signals Ø Imagery Ø Technical information Ø Open source intelligence Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Information Warfare: Chaos on the Electronic Superhighway (1996. 05) Winn Schwartau, The Security Awareness Co. Ø Overview Ø Military Model Must Reflect Changes in Warfare Ø What Is War? 10 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Schwartau’s View (1996. 05) Overview Ø National economies increasingly virtual q. Most money no longer tangible Ø Espionage increasing for economic benefits q 14% increase in espionage according to FBI Ø Must resolve problem of defending against powerful technology not limited to military use Ø Should define defensive posture against potential enemies’ capabilities, not perceived motivations 11 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Schwartau’s View (1996. 05) Military Model & Changes in Warfare Ø Military systems are not necessarily the prime targets of attack Ø Psyops increasingly important: manipulation of perceived reality using the gullibility of the mass media Ø Attacks on software: increasing the failure rates of systems even when people are trying to reduce errors Ø Denial of service increasing: airports, phone systems, banks 12 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Schwartau’s View (1996. 05) What Is War? Ø Physical attacks are no longer the only basis for defining acts of war Ø What will military and civil response be to concerted attack on civilian / industrial infrastructure? qtaking down the banks qinterfering with air-traffic control qdamaging productivity of major industries Ø …and if this is war, what is the response? 13 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Schwartau’s View (1996. 05) Destruction vs Reducing Competitiveness Ø Question: in a free-market world, not necessary to destroy enemy; need merely render less competitive Ø Response from Schwartau: q. US govt must defend country, yet military limited to physical warfare q. Classifying EW threats is foolish; should educate civilian sector q. Should define conditions for termination of hostilities 14 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Schwartau’s View (1996. 05) How do we know who is attacking? Ø Anonymity pervasive throughout cyberspace Ø Stealth attacks natural consequence of Internet architecture Ø Agents can be hired without knowing their handlers Ø Conventional intelligence services must wake up to electronic threats Ø See Information Warfare 1 st Edition online http: //www. thesecurityawarenesscompany. com/chez/IW 11. pdf 15 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

RAND on INFOWAR (1999. 01) Strategic Information Warfare Rising — The RAND Corporation qmid-1998 (reported in press 1999. 01) Ø Debate within the Pentagon qwisdom of offensive information warfare qcyberattacks on critical infrastructure worse for US Ø 4 basic scenarios q. U. S. supremacy in offense and defensive strategic IW qstrategic IW elites — no first use qglobal defensive dominance — arms control qmarket-based diversity — defend well, recover fast 16 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

INFOWAR @ AAAS (1999. 02) American Association for Advancement Science (AAAS) panelists qgovernment qprivate industry Ø INFOWAR real threat Ø Need better cooperation among law enforcement officials around world qcatch culprits responsible for attacks Ø Changes international law qextradiction suspects Ø Sceptics (e. g. , Kevin Poulson) scoffed qno electricity by now if IW threat so bad 17 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Kosovo. Cyberwar (1999. 03) Attacks on US government & military agencies began 1999. 03 Ø Serbian hackers Ø Retaliation for war against Serbs Ø As NATO bombing began in Serbia Ø "Black Hand" hacker group Ø "Serbian Angel" hackers Ø White house Web site defaced q. Red letters"Hackerz wuz Here“ 19 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Kosovo Cyberwar 1999. 03 Ø Kosovo conflict generated flurry hacking q“First Internet War” q“First Cyber. War” q“Web War I. ” Ø Serbs & Albanians + supporters attacked each others' Web sites & NATO q“If you're looking for truth visit WWW. B 92. NET” q“SAMURAI RULLEZ!” 21 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Kosovo. Cyberwar (1999. 03) Serbian viral attacks? Ø mi 2 g security group q. London England q. Notorious for sensationalist headlines Ø Pro-Serbian cyberwarriors sending virusladen e-mail to NATO qbusinesses qhospitals qgovernment agencies Ø Concerted effort qdisrupt Kosovo air-war 23 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Asymmetric INFOWAR (1999. 04) Countering New Terrorism by I. O. Lesser B. Hoffman J. Arquilla D. F. Ronfeldt M. Zanini & B. M. Jenkins Ø New terrorism more diverse qsources qmotivations qtactics Ø More lethal global reach Ø Asymmetric strategy qless-capable adversaries qpolitical violence 25 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

INFOWAR @ Do. D: (1999. 09) Ø Marvin Langston q. Deputy Assistant Secretary Defense (C 3 I) q. Office Secretary Defense's Deputy Chief Information Officer Ø National Defense University group September q. Pentagon needs put more effort into defensive & offensive information technology Ø Do. D's dependence commercial off-the-shelf software (COTS) qimpossible achieve information superiority q. Do. D must invest much more research development for particular technological needs 26 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

INFOWAR? Nonsense, says Christy (1999. 09) Ø US has never been target of information warfare q. James Christy q. Defense-wide Information Assurance Program (DIAP) Ø Cybercriminals not cyberwarriors Ø Fundamental difficulties responding qmilitary has expertise computer crime but qcannot help law enforcement agencies without presidential directive 28 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

INFOWAR? Nonsense. (cont’d) Ø Civilian sector ignorant of computer crime countermeasures Ø Can’t tell cyberattacks under way qmost victims keep information secret qdon’t help law enforcement investigators Ø Precise attribution & blame extremely difficult in cyberspace — anonymity Ø Public favors privacy over cybercrime prevention & law enforcement — ignorance Ø Jurisdiction over cyberspace crimes confused — competing geographical claims 29 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

INFOWAR in Oz? (1999. 10) Ø Foreign (US? ) military site attacked Stocik Exchange late 1998? Ø Richard Humphrey q. Managing Director Australian Stock Exchange qimplied attacking site was in USA Ø “Foreign government” denied any possibility such attack from military site Ø Urged changes to Australian laws qmake it easier to try hackers qpresent laws require criminal hackers be apprehended in act of hacking 30 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

INFOWAR / China (1999. 11) Ø Importance of INFOWAR grows in PRC q. Chinese military newspaper Jiefangjun Bao qauthors Leng Binglin, Wang Ylin, Zhao Wenxiang Ø For maximum war role, must integrate INFOWAR with other combat actions Ø Cybersuperiority necessary but not sufficient for military victory today 31 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

INFOWAR / China (2000. 02) Taiwan Research Institute Ø Gird itself against information warfare q. People's Republic China Ø Elements IW: qdisruption critical infrastructure qdisruption military C 3 I ops qmisinformation campaigns qdamage economic activity qlower morale on island before initiating conventional warfare 32 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

INFOWARGAMES (1999. 11) Institute for Security Intelligence's Center for Technology Terrorism & Jane's Publications Ø War-game simulation (did not really hack) Ø IRS primary target Ø False information, denial of service Ø Hack into IRS audit system Ø Send out millions audit & tax-due notices Ø Tap into immigration control (Dept State) to issue visas to known terrorists Ø Create fake documents — IRS investigating personal lives members Congress Ø Leak fakes to media + send fake compromising photographs 34 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Critical Infrastructure Protection (1999. 11) Information Technology Association of America (ITAA) Statement of Principles Ø Importance protecting national information infrastructure Ø Private industry: primary authority Ø Lowest possible government regulation in critical infrastructure protection Ø Call for distinctions among cyber-mischief, cybercrime, cyberwar Ø Appropriate law enforcement agencies take charge specific cases qminimal jurisdictional confusion qassurance clear legal basis for prosecution 36 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

German Government Plans Net Defenses Ø German plans for early-warning of hacker attacks (2001. 05) Ø Build Computer Emergency Response Teams throughout country Ø Increased cooperation should permit rapid response to hacker attacks 38 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Republic of Korea warns of Cyber Attacks Ø ROK Ministry of Information and Communication issues warnings (2001. 05) Ø Concern about US & (PRC) Chinese hackers using Korea as staging ground for INFOWAR Ø KISA launched special task force against US and Chinese attacks Ø Instructed Korean Internet-site operators to report unusual traffic at any time 39 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

US Warns of Military Response to Cyberattacks Ø Richard Clarke tells Senate Judiciary Committee of plans for retaliation (2002. 02) Ø White House Technology Advisor says that cyberattack would be met “in any appropriate way: through covert action, through military action, any one of the tools available to the president. ”* Ø In 2003. 02, President Bush signed an order authorizing development of guidelines on unilateral or retaliatory cyberattacks against foreign computers and networks *Question: HOW DO YOU KNOW FOR SURE WHO IS ATTACKING YOU? 40 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

STRATCOM focuses on Cyberwar Ø U. S. Strategic Command (Stratcom) will focus on computer network attack (2003. 02) Ø Stratcom now in charge of global command, control, communications, computer, intelligence, surveillance and reconnaissance (C 4 ISR) capabilities Ø “All pieces of the enemy's system of systems that are valid military targets [are] on the table as we go about war planning. ” Ø “…Unimportant whether we take out a computer center with a bomb or a denial-of-service program. If it's critical to the enemy and we go to war, it will be in our sights. ” 41 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Cyberwar Games for US Military Cadets Ø West Point Cyber Defense Exercise pits military students against NSA experts (2004. 04) Ø 4 -day exercise in April 2004 Ø NSA Red Team (“Red Cell”) attacked networks q. No hackback q. No sabotage Ø USMMA (Merchant Marine Academy) team won contest by maintaining services and recovering faster from attacks 42 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Cyberattack. Implications Studied 43 ØCyberterror impact, defense under scrutiny (2004. 08) ØCoordinated cyberattack against U. S. could qtopple parts of Internet, qsilence communications and commerce, qparalyze federal agencies and businesses qdisrupt $M in financial transactions, qhang up air traffic control systems, qdeny access to emergency 911 services, 13: 15 -15: 15 Copyright © 2005 M. E. Kabay. All rights reserved.

North Korea Ready for Cyberwar? Ø North Korea ready to launch cyber war (2004. 10) North Korea has trained more than 500 computer hackers capable of launching cyber warfare against the United States, South Korea's defense ministry says. In a report to the National Assembly's National Defense Committee, the ministry said that hackers from North Korea were among the best in the world. --Agence France Presse 44 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Cyberterrorism by 2006? Ø Cyberterrorism a possibility in two years (2004. 10) Cyberterrorism could become a reality in 2006, a leading UK information security expert has said. Speaking at the SC Magazine Conference in London on Thursday, October 21, director of information security for Royal Mail David Lacey said that the world would witness cyberterrorism within two years. Lacey said, “there is a lot of consistency in research that shows many of the real risks won't come to a crescendo until then. We know a lot about some of the trends coming. Real terrorists have not had the capability to carry out threats. But that will change as the stakes get higher. “ --ZDNet (UK) 45 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

New Cyberwar Command Center Ø Cyber warriors anticipate center (2005 -02) Personnel in the military's new cyberdefense organization hope to operate a new command center by late spring. The facility will include new hardware and software to help workers of the Joint Task Force. Global Network Operations (JTF-GNO) operate, manage and defend the military's 10 computer networks. "It will be a state-of-the-art facility, " said Army Brig. Gen. Dennis Via, deputy commander of the JTF-GNO. He spoke Wednesday, February 23 at the Department of Defense Global Information Grid Enterprise Services conference held by the Association for Enterprise Integration, an industry trade group. The opening of the new command center coincides with JTF-GNO becoming fully operational. --Federal Computer Week 46 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15

Chinese Cyberwar From South America? Ø U. S. officials warn of Chinese intelligence and cyberwarfare roles in Latin America (2005. 04) U. S. officials … warned about Chinese intentions to establish an intelligence and cyberwarfare beachhead in the [S. America]. Roger Noriega, assistant secretary of state for Latin America, and Rogelio Pardo−Maurer, the top Defense Department official for the Western Hemisphere, testified before a House panel [and] said China's interests in Latin America were mostly on the economic side, but warned that Beijing could also have an intelligence agenda as it increased trade with Latin America. Pardo−Maurer said that “we need to be alert to rapidly advancing Chinese capabilities, particularly in the fields of intelligence, communications and cyberwarfare, and their possible application in the region. ” --Miami Herald 47 Copyright © 2005 M. E. Kabay. All rights reserved. 13: 15 -15: 15