Cyber Warfare

Revenge of the nerds is a film made in 1984 depicting the epic battle of mind versus muscle. That movie was the first thought in my head after hearing the word cyber warfare. The movie was mainly about a group of nerds that were always bullied by the jocks. The nerds, in their defense, would employ high tech warfare to defend themselves against the jocks. Now it seems like the world has caught on to the power of the mind. It seems that traditional methods of warfare is not the most efficient method. It appears now wars are being fought with minds, technology, and often from remote locations using the Internet. The United States has taken notice of such developments and are trying to establish their framework for dealing with cyber threats.

The United States Department of Defense (DOD) is in the process of developing their rules of conduct for dealing with cyber threats. The head of the United States cyber command and National security mentioned that they are working with the joint chiefs to establish a decision framework. The framework will identify threats and allow senior officials to share information easily. This framework will also implement a chain of command and control mechanism that makes for quick reply to any cyber threat.

Revenge of the Nerds : http://www.imdb.com/title/tt0088000/

http://www.infosecurity-magazine.com/view/24741/pentagon-developing-cyber-warfare-rules/

Young Employees and Data Security Risks

The most costly security breaches are the unauthorized access to sensitive information. The “Nitro” attack was a small-scale attack on industrial, aviation and chemical companies. Successful attacks were at a low count of 39 reported cases. The intention of the attack and the destination of the data stolen are unknown. Imagine your operation plans and trade secret of your company was stolen. This data ends up into the hands of your rivaling company. Imagine the damage that can be done to your company when this company knows what you will do and when. You have lost the element of surprise and your rival company gains an advantage over you. Security has improved and is capable of stopping and tracking the sources of attacks directly at the systems. Attackers are now relying more on human error to give them access to identities and further access to systems.

Cisco’s 2011 annual report displayed some alarming statistics on the practices of young adults age 18 – 23. The report showed these young adults had an alarming disconnect with safe technology practices. They often times believe that the Information Technology policies of companies are out dated and prevents them from doing their job. The reports showed that 1 in 4 college students have experienced identity theft. These young adults give friends and even strangers unsupervised and unrestricted use of their personal devices. Even though many have seen grave consequences, they still willingly partake in such activities. The report showed an alarming number of young employees admitting they break company IT policies, as they believe that protection of data is the responsibility of the corporation.

Worth the Read:

http://www.canadiansecuritymag.com/IT-Security/News/Cisco-report-Young-employees-present-data-security-risk.html#topart

Moving Target

There are many mission critical systems that remains vulnerable to attacks from motivated and well-resourced hackers. Successful attacks on these systems are not a result of lack of effort or security measures. These successful attacks are simply a result of dedicated and talented attackers coupled with the inability of traditional security systems to completely protect systems. One of the ideas being investigated is moving target systems. The system, in its design and implementation, has the ability to analyze various treat levels and adapt to protect itself. This is made possible through its architecture and the ability to assess and re-orientate itself. Trusted Dynamic Logical Heterogeneity Systems (Talent) is the code name for such systems. Through its assessment, the system will migrate mission critical application across platforms in real time. This is made possible by the heterogeneity of it s architectural design. During its operation, the system can assess attacks and create and attack graph. This attack graph is used to decide which counter attack measures to implement. Base on these decisions, the system re-orientates itself, which can be achieved by switching from one platform to another (Okhravi, Haines, & Ingols, 2011).

This system has caught the attention of the White House’s Networking and Information Technology Development (NRTD). The NRTD has since sponsored a symposium that is to be held in Maryland in June. The report explains that the government from this symposium is hoping to develop the idea moving target security systems. Thus enabling security professionals with the ability to create, analyze and deploy evolving systems. Additionally, deploying systems with strategies that increase the cost and complexity for attackers consequently increases system resiliency and limit its vulnerabilities. The main goal is demonstrating with scientific proof that the moving target systems are indeed an improvement in cyber security. However there are hopes of talks surrounding dynamic network services, virtual machines, cloud computing, moving target transparency, end-to-end security along with other topics.

Sources

Okhravi, D. H., Haines, J. W., & Ingols, K. (2011, May). Achieving Cyber Survivability in a Contested Environment Using a Cyber Moving Target. High Frontier , 9.

See this link also

http://www.infosecurity-magazine.com/view/24610/white-house-wants-feedback-on-moving-target-cybersecurity-techniques/

Innovation is the best form of Cyber Security

The SOPA act has been a controversial topic recently. The United States government, in its effort to stop infringement of intellectual properties are trying to pass laws that provides law enforcement the power shutdown these activities. The provisions of this act includes court orders to bar numerous activities, including barring advertisement from infringing websites and request of internet service providers to block traffic. There are many that believe this bill will cripple the Internet. Many hold the opinion that Internet was created as a mechanism for sharing and to promote free speech, which will be negated in this bill. For example, if a user posts something infringing on this blog they could potential shutdown the entire blogspot.com. The big players in the communication industry are voicing concern about this bill and suggesting that innovation is the way to improve cyber security rather a bill that might cripple the industry.

The US telecom executives recently stressed that incentives for innovation and sharing of information are steps that should be taking towards cyber security. Their general consensus is that the approach the government is under taking would do more harm than good. They even speculated that with the implementations the government plans to put in place, a hacker can easily gain access to all communications systems if they can find away into the system the government has setup. They encourage that flexibility is that key to continuous progress in business and technology. Therefore, rather than utilizing a large-scale method to control the way the internet is used, the government should advocate for a investments towards innovations in cyber security.

Articles worth the read:

Sopa: http://en.wikipedia.org/wiki/Stop_Online_Piracy_Act

Innovation : http://www.infosecurity-magazine.com/view/24443/telecom-execs-warn-congress-about-excessive-regulation-in-cyber-bills/

Speed vs Security

Firewalls were originally designed to protect against threats to systems and networks. The first generation of firewalls relied on stateful packet inspection or stateful inspection. The firewalls form a perimeter around your system, similar to patrolling a country's boarders and only allowing legitimate traffic into the country. With evolving virus schemes, malwares and spywares, we must improve our security systems. In many businesses, it is not easy to form a perimeter around critical data. Many employees connect to work related information from mobile devices, broadband and public wireless hotspots. These connections are made through of multitude of media rich connections. Firewalls will have to protect no just the systems, but also the data irrespective of how it is being transmitted. Additionally, firewalls will have to provide this protection in a robust, comprehensive manner without sacrificing performance. This ultimately results in the introduction of Deep Packet Inspection systems.

Deep Packet Inpsection (DPI) systems has be suggested as an extension to current firewall systems. The goal of DPI is to provide users with protection of critical data while using multiple devices in a media rich content environment. This security system requests the data to be sent for inspection of threats before establishing connections. There are two methods of DPI: proxy based and stream based. Stream based is safer, while proxy based is faster. However, while both provide robust security in the network environment, proxy based DPI requires less resources but a more elaborate scheme on protection. Both methods of DPI suffer in terms of latency on the network. For example, in large files, the latency on the network is going to be high and therefore resulting in slower speed. This begs the question of Quick System or a Safe System? How much of one do I sacrifice for the other.

Original Article:

http://www.infosecurity-magazine.com/view/24130/comment-dont-compromise-on-visibility-speed-or-security/

Bad internal information security practices can lead to theft of confidential information.

Data collected on customers by companies is continuously increasing. The collected information are sometimes in hard copy format, which can be scanned or copied by employees within the company. Additionally, multiple function network printers in the workplace often have no secure passwords, and employees with access to confidential information can easily send jobs to these printers, making information available in hard copy that can easily be scanned or photocopied by unauthorized employees. Therefore, internal methods of data security are just as important as prevention of external access to information.

"Ignorance is bliss" is a dangerous practice that leads to unauthorized access of private and confidential information. There should be a precise information privacy policy regarding access and use of private and confidential information. Collecting large databases of private and confidential information on customers and securing that information from unauthorized access of only half the solution. Even with layered access to information within the organization, the improper use of technology can still be dangerous. For example, preparing sensitive information for your superiors and printing it on a network printer will allow an employee with unauthorized access to read the information as it is printed. Therefore, a staff that has no method of disposing of confidential information can lead to leakage of this information.

Article:

http://www.infosecurity-magazine.com/view/23982/is-ignorance-bliss-majority-of-employees-dont-know-or-follow-it-security-policies/

Google's new privacy policy

According to reports, Google's new privacy policy being rolled out by March 1 is an act to consolidate services. While this is an economical decision for the company, their services are built around the use of personal information. Users often utilize different sets of services from Google, which can be stored separately in large databases. The consolidation of all services will allow record linking across all databases, enabling one service from Google to track the use of all their services and establish a pattern on use. For example, Google have multiple advertisements displayed on many websites. By linking all its products, Google will be able to track their users' pattern of Internet usage based on the sites accessed, which allows them to identify their users.

However, Google is taking measures to inform their users of potential privacy violations. They are notifying users of this change and providing them ample time to decide whether or not to continue using their services. On the other hand, the lack of similar services and the effort involved in switching services may ultimately result in users accepting potential privacy violations in favor of the convenience provided by Google. This allows Google to control the type of information stored and the pattern of Internet usage from their users. However, Google is a corporate giant and must keep its shareholders' trust; therefore, will ultimately have to make decisions according to the company's interest and not the interest of its users.

These articles are worth the read.

http://www.infosecurity-magazine.com/view/23825/privacy-group-sues-ftc-over-googles-privacy-changes/

http://www.infosecurity-magazine.com/view/23500/googles-revised-privacy-policy-not-sitting-well-with-some