Cybersecurity: Difference between revisions

From Cyberlaw: Difficult Issues Winter 2010
Jump to navigation Jump to search
No edit summary
 
(47 intermediate revisions by 21 users not shown)
Line 1: Line 1:
== SCOPE OF THE PROBLEM ==
https://www.friendsoffrontenac.com/profile/doctor-strange-in-the-multiverse-of-madness-online-full-free/profile
 
https://www.friendsoffrontenac.com/profile/doctor-strange-in-the-multiverse-of-madness-watch-free-easyflix/profile
According to the U.S. federal government, threats to cyberspace pose one of the most serious economic and national security challenges of the 21st Century.<ref name=DNIAnnual">[http://www.dni.gov/testimonies/20090310_testimony.pdf]Dennis Blair, Director of National Intelligence, ''Annual Threat Assessment of the Intelligence Services Committee, Statement for the Record,'' March 10, 2009, at 39.</ref> An increasing number of state and non-state actors are now capable of targeting U.S. citizens, financial institutions, critical infrastructure, and government organizations. The Commission on Cybersecurity, established to advice President Obama in his new administration, stated the challenge: "America's failure to protect cyberspace is one of the most urgent security problems facing the new administration."<ref name=CSIS">[http://csis.org/files/media/csis/pubs/081208_securingcyberspace_44.pdf]CSIS Commission on Cybersecurity, ''Security Cyberspace for the 44th Presidency,'' Dec. 2008.</ref> In fact, the intelligence community assessment is that already a number of nations have the capability to conduct crippling attacks against the U.S.<ref name=DNIAnnual">[http://www.dni.gov/testimonies/20090310_testimony.pdf]Dennis Blair, Director of National Intelligence, ''Annual Threat Assessment of the Intelligence Services Committee, Statement for the Record,'' March 10, 2009, at 39.</ref>
https://www.friendsoffrontenac.com/profile/doctor-strange-2-online-full-free/profile
 
https://www.friendsoffrontenac.com/profile/doctor-strange-2-watch-free-easyflix/profile
One reason cybersecurity poses such a security threat is that the term 'cybersecurity' applies to almost everything. The White House Cyberspace Policy Review that analyzes the current cybersecurity threat defines the term broadly:
https://www.friendsoffrontenac.com/profile/kgf-chapter-2-online-full-free/profile
 
https://www.friendsoffrontenac.com/profile/kgf-chapter-2-watch-free-easyflix/profile
<blockquote>Cybersecurity policy as used in this document includes strategy, policy, and standards regarding the security of and operations in cyberspace, and encompasses the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as they relate to the security and stability of the global information and communications infrastructure. The scope does not include other information and communications policy unrelated to national security or securing the infrastructure.<ref name="WhiteHouseReview">[http://www.whitehouse.gov/assets/documents/Cyberspace_Policy_Review_final.pdf] White House Cyberspace Policy Review, p2 (March, 2009).</ref></blockquote>
https://www.friendsoffrontenac.com/profile/sonic-the-hedgehog-2-online-full-free/profile
 
https://www.friendsoffrontenac.com/profile/sonic-the-hedgehog-2-watch-free-easyflix/profile
Summarizing, the Policy Review notes that “Cyberspace touches practically everything and everyone.”<ref name="WhiteHouseReview" />  Given this definition, it is no wonder that cybersecurity is perceived as an almost insurmountable problem.  In order to begin approaching solutions, therefore, we will first begin by breaking down our understanding of what cybersecurity means.
https://www.friendsoffrontenac.com/profile/the-northman-online-full-free/profile
 
https://www.friendsoffrontenac.com/profile/the-northman-watch-free-easyflix/profile
 
https://www.friendsoffrontenac.com/profile/turning-red-online-full-free/profile
== ASSESSING VULNERABILITY ==
https://www.friendsoffrontenac.com/profile/turning-red-watch-free-easyflix/profile
 
https://geany.org/p/VkWZw/
The [http://en.wikipedia.org/wiki/Internet internet] is a large-scale decentralized network of generative computers. (For an introduction to how the internet works, read the first two pages of [http://www.informs-sim.org/wsc04papers/038.pdf ''BGP Attack''].) This network is vulnerable to attack at several different key points, each with a different result and security concern. The taxonomy below breaks down the security issues according to what part of the network is under attack. Real life examples of attacks are then provided to illustrate the danger of attacks, and the application of this knowledge to [http://en.wikipedia.org/wiki/Cyberwarfare cyberwarfare] is then considered.
http://cpp.sh/5zueq
 
https://geany.org/p/0sEqT/
If you need background on how the internet works and is related, watch [http://www.youtube.com/watch?v=NN95GE4mOIw JZ's background video about internet and law].
http://cpp.sh/3isgzz
 
https://rextester.com/ORYOP29569
In order to help us understand cybersecurity, we can break down our analysis of vulnerable points in cyberspace by separating out the point of attack.
https://coliru.stacked-crooked.com/a/fb0143ef2041e7af
 
https://yamcode.com/for-better-sleep-borrow-the-bedtime-routine-of-a-toddler
===I. Vulnerability in the Network Itself===
https://paste2.org/NcDvGUAH
 
https://ideone.com/Sg89a2
This vulnerability considers attacks upon the network itself. A clever hacker could shut down the internet itself in an extreme case, or more conservatively can re-route the internet to prevent users from getting where they need to go. 
https://pasteio.com/xeEd2rJZd0Fh
 
https://paste.tbee-clan.de/t8nnJ
The internet is a large-scale decentralized network.  A packet sent from one computer to another may cross multiple networking administrative domains (called Autonomous Systems [AS]).  Internet routing includes two different systems: an intra-domain routing system and an inter-domain routing system. AS routes traffic within its infrastructure any way it likes, but all of the AS's coordinate inter-domain routing by running a [http://en.wikipedia.org/wiki/Border_Gateway_Protocol Border Gateway Protocol] (BGP) on routers that connect the AS's. The BGP computes routes between every AS and every IP address.<ref name=BGP Background">[http://www.informs-sim.org/wsc04papers/038.pdf]J. Kim et al., A BGP Attack Against Traffic Engineering, PROCEEDINGS OF THE 2004 WINTER SIMULATION CONFERENCE 318 (2004).</ref>
https://controlc.com/b5a22a7e
 
https://p.teknik.io/kKrux
To attack the network itself, however, it is then possible to cause a disconnect in the BGP-AS connection. The best example of an attack on internet as a network is such a BGP  attack: this kind of attack gained publicity through the recent incident in which Pakistan accidentally took down YouTube. See this [http://www.ripe.net/news/study-youtube-hijacking.html case study on Pakistan & Youtube] and this [http://www.wired.com/threatlevel/2008/08/revealed-the-in/ comment on the threat of BGP hijacking] for more details.
https://apaste.info/0gJH
 
https://notes.io/qw3ja
===II. Vulnerability in the Network Endpoints===
https://paiza.io/projects/DYYWyl-TSTQxZzP7Yi0wTw
 
https://ide.geeksforgeeks.org/291eeaf8-39ad-4b0d-9897-57d786025eaa
The internet as a network joins together numerous end point computers.  These endpoints are all vulnerable targets in and of themselves, though the nature of the end point changes some of the ramifications of its attack.
http://cpp.sh/4dsj2
 
https://bitbin.it/slLd0cDD/
====A. SCADA Systems====
https://pastelink.net/sevl2t6m
 
https://paste.rs/LPp
[http://en.wikipedia.org/wiki/SCADA SCADA] systems (SCADA stands for supervisory control and data acquisition) are computer systems that oversee industrial computer systems. Generally the term is used to refer to governmental systems such as the computer systems that regulate dams, traffic lights, and other components of civilian infrastructure. One of the most public issues has been concern that a hacker could shut down public power grids or that terrorists could utilize the SCADA systems to destroy infrastructure. See [[SCADA System Attacks Examples]] for more in-depth discussion.  
https://dotnetfiddle.net/WXCoU9
 
http://allabouturanch.com/forum/topics/for-better-sleep-borrow-the-bedtime-routine-of-a-toddler
====B. Servers====
http://beterhbo.ning.com/forum/topics/for-better-sleep-borrow-the-bedtime-routine-of-a-toddler
 
https://caribbeanfever.com/photo/albums/fgbrjyja
Rather than targeting individual computers, attackers can target servers and providers. Once a server is infected, it propagates the infection and compromises other internal computers and sensitive servers incorrectly thought to be protected from unauthorized access by external entities. This infection can also result in servers being shut down by regulators in order to prevent the spread of infection, thereby effectively stopping business at that site.  This can have significant implications depending on the nature of the site. See a more in-depth discussion of this at [[Chuckroast Server Attack Example]].
http://playit4ward-sanantonio.ning.com/photo/albums/krdtgta
 
http://ptits.net/boards/t/81331/gbrhsefa.aspx
====C. Personal Computers====
https://pantip.com/topic/41438245
 
https://vocus.cc/article/62859c05fd897800011f97b0
The term personal computers is meant broadly to apply to individual computers rather than larger servers or systems. However, the use of these computers - whether for government application, industrial business, or private personal use - has a significant impact on the nature of the security concern. One of the vulnerabilities that all types of personal computers share, however, is that all the computers are [http://www.thefreedictionary.com/generative generative], having the power to create. This very generativity adds to the potential vulnerability of the computers.
https://www.twblogs.net/a/62859d6748e6ffd9e00d10d9
 
https://ameblo.jp/sgcergas/entry-12743569299.html
In his book, [http://yupnet.org/zittrain/archives/11 The Future of the Internet and How To Stop It (Chapter 3)] on generativity and cybersecurity, Zittrain describes the [http://en.wikipedia.org/wiki/Morris_worm Morris Worm Attack] - the first virus attack (1988) and how the changing nature of the internet made that attack possible:  
https://gamerch.com/gabrials/entry/355219
 
https://writeonwall.com/for-better-sleep-borrow-the-bedtime-routine-of-a-toddler/
<blockquote>[T]he Morris worm really was not perceived as a network problem, thanks to the intentional conceptual separation of network and endpoint. The Morris worm used the network to spread but did not attack it beyond slowing it down as the worm multiplied and continued to transmit itself. The worm’s targets were the network’s endpoints: the computers attached to it. The modularity that inspired the Internet’s design meant that computer programming enthusiasts could write software for computers without having to know anything about the network that would carry the resulting data, while network geeks could devise new protocols with a willful ignorance of what programs would run on the devices hooked up to it, and what data would result from them. Such ignorance may have led those overseeing network protocols and operation unduly to believe that the worm was not something they could have prevented, since it was not thought to be within their design responsibility.
https://ctftime.org/task/21443
...
 
Even without...flaws, the machines were intentionally designed to be operated at a distance, and to receive and run software sent from a distance. They were powered on and attached to the network continuously, even when not in active use by their owners. Moreover, many administrators of these machines were lazy about installing available fixes to known software vulnerabilities, and often utterly predictable in choosing passwords to protect entry to their computer accounts. Since the endpoint computers infected by the worm were run and managed by disparate groups who answered to no single authority for their use, there was no way to secure them all against attack.</blockquote>
 
The computers could not be secured because each computer could incorporate the code, use it and further distribute it.  
 
<blockquote>Whether through a sneaky vector like the one Morris used, or through the front door, when a trusting user elects to install something that looks interesting without fully understanding it, opportunities for accidents and mischief abound. A hobbyist computer that crashes might be a curiosity, but when a home or office PC with years’ worth of vital correspondence and papers is compromised, it can be a crisis. And when thousands or millions of individual, business, research, and government computers are subject to attack, we may find ourselves faced with a fundamentally new and harrowing scenario. As the unsustainable nature of the current state of affairs becomes more apparent, we are left with a dilemma that cannot be ignored. How do we preserve the extraordinary benefits of generativity, while addressing the growing vulnerabilities that are innate to it?</blockquote>
 
ref = http://bostonreview.net/BR33.2/zittrain.php
 
 
 
http://www.ericjohnolson.com/blog/2007/08/31/saving-the-web-should-we-sacrifice-generativity-for-safety-and-security/  
 
http://www.temple.edu/lawschool/dpost/Zittrain.pdf
 
http://www.emergentchaos.com/archives/2008/04/generativity_emergent_cha.html
 
=====1. Government Computers=====
 
[[Government Computer Attack Examples]]
 
=====2. Industrial Computers=====
 
[[Industrial / Financial Computer Attack Examples]]
 
=====3. Private Individual Computers=====
 
===Application in Cyberwarfare===
 
== NEXT STEPS ==
 
 
=== White House Action Plans===
 
[[Image:Near_Term_Action_Plan.PNG|White House Cyber Security Review Near Term Action Plan]]<ref name="WhiteHouseReviewTables">[http://www.whitehouse.gov/assets/documents/Cyberspace_Policy_Review_final.pdf] White House Cyberspace Policy Review, p37-38 (March, 2009).</ref>
 
[[Image:Mid-Term_Action_Plan.PNG|White House Cyber Security Review Mid-Term Action Plan]]<ref name="WhiteHouseReviewTables" />
 
==REFERENCES==
<references/>

Latest revision as of 21:41, 18 May 2022

https://www.friendsoffrontenac.com/profile/doctor-strange-in-the-multiverse-of-madness-online-full-free/profile https://www.friendsoffrontenac.com/profile/doctor-strange-in-the-multiverse-of-madness-watch-free-easyflix/profile https://www.friendsoffrontenac.com/profile/doctor-strange-2-online-full-free/profile https://www.friendsoffrontenac.com/profile/doctor-strange-2-watch-free-easyflix/profile https://www.friendsoffrontenac.com/profile/kgf-chapter-2-online-full-free/profile https://www.friendsoffrontenac.com/profile/kgf-chapter-2-watch-free-easyflix/profile https://www.friendsoffrontenac.com/profile/sonic-the-hedgehog-2-online-full-free/profile https://www.friendsoffrontenac.com/profile/sonic-the-hedgehog-2-watch-free-easyflix/profile https://www.friendsoffrontenac.com/profile/the-northman-online-full-free/profile https://www.friendsoffrontenac.com/profile/the-northman-watch-free-easyflix/profile https://www.friendsoffrontenac.com/profile/turning-red-online-full-free/profile https://www.friendsoffrontenac.com/profile/turning-red-watch-free-easyflix/profile https://geany.org/p/VkWZw/ http://cpp.sh/5zueq https://geany.org/p/0sEqT/ http://cpp.sh/3isgzz https://rextester.com/ORYOP29569 https://coliru.stacked-crooked.com/a/fb0143ef2041e7af https://yamcode.com/for-better-sleep-borrow-the-bedtime-routine-of-a-toddler https://paste2.org/NcDvGUAH https://ideone.com/Sg89a2 https://pasteio.com/xeEd2rJZd0Fh https://paste.tbee-clan.de/t8nnJ https://controlc.com/b5a22a7e https://p.teknik.io/kKrux https://apaste.info/0gJH https://notes.io/qw3ja https://paiza.io/projects/DYYWyl-TSTQxZzP7Yi0wTw https://ide.geeksforgeeks.org/291eeaf8-39ad-4b0d-9897-57d786025eaa http://cpp.sh/4dsj2 https://bitbin.it/slLd0cDD/ https://pastelink.net/sevl2t6m https://paste.rs/LPp https://dotnetfiddle.net/WXCoU9 http://allabouturanch.com/forum/topics/for-better-sleep-borrow-the-bedtime-routine-of-a-toddler http://beterhbo.ning.com/forum/topics/for-better-sleep-borrow-the-bedtime-routine-of-a-toddler https://caribbeanfever.com/photo/albums/fgbrjyja http://playit4ward-sanantonio.ning.com/photo/albums/krdtgta http://ptits.net/boards/t/81331/gbrhsefa.aspx https://pantip.com/topic/41438245 https://vocus.cc/article/62859c05fd897800011f97b0 https://www.twblogs.net/a/62859d6748e6ffd9e00d10d9 https://ameblo.jp/sgcergas/entry-12743569299.html https://gamerch.com/gabrials/entry/355219 https://writeonwall.com/for-better-sleep-borrow-the-bedtime-routine-of-a-toddler/ https://ctftime.org/task/21443

Retrieved from "http://cyber.harvard.edu/cyberlaw_winter10/?title=Cybersecurity&oldid=56191"