6th European Conference - Academic Conferences

The Strategies for Critical Cyber Infrastructure (CCI) Protection
by Enhancing Software Assurance
Mecealus Cronkrite, John Szydlik and Joon Park
Syracuse University, USA
micronkr@syr.edu
jaszydli@syr.edu
jspark@syr.edu
Abstract: Modern organizations are becoming more reliant on complex, interdependent, integrated information
systems. Key national industries are the critical infrastructure (CI) and include telecommunications, energy,
healthcare, agriculture, and transportation. These CI industries are becoming more dependent on a critical cyber
infrastructure (CCI) of computer information systems and networks, which are vital to the continuity of the economy.
Organized attackers are increasing in number and power with more powerful computing resources that increasingly
threaten CCI software systems. The motivations for attacks range from terrorism, fraud, identity theft,
espionage, and political activism. Government and industry research have found that most cyber attacks exploited
known vulnerabilities and common software programming errors. Software publisher vendors have been
unable to agree or implement a secure coding standard for two main reasons. The on-technical consumer is ill
informed to demand secure quality products. These current conditions perpetuate preventable risk. As a result,
software vendors do not implement security unless specifically required by the customer, leaving many systems
full of gaps. Since most of exploited vulnerabilities are preventable, the implementation of a minimum level of
software quality is one of the key countermeasures for protecting the critical information infrastructure. Government
and industry can improve the resilience of the CI in an increasingly interdependent network of information
systems by protecting the CCI with stronger software assurance practices and policies and strengthening product
liability laws and fines for non-compliance. In this paper we discuss the increasing software and market risks to
CCI and address the strategies to protect the CCI through enhancing software assurance practices and policies.
Keywords: critical cyber infrastructure, secure programming quality, software assurance
1. Introduction
The first major Internet attack in 1988 by the Morris worm was a bad prank gone awry, but made it
clear, that for the first time, cyber security threats could escape physical boundaries. Cyber threats
could now spread rapidly through the Internet and impact different organizations and countries simultaneously.
In 2001, Code Red and Nimda were the first attacks to operate disrupt the commercial
internet affecting many business and ecommerce sites. (Gelbstien & Kamal, 2002) Next, the 2003
SQL Slammer worm caused major disruption of commercial and banking systems this attack used a
weakness that already had a solved by patch but had not been applied to enough of the consumer
base to cause damage to other companies because of internet slowdown. In 2003, the Sobig virus
temporarily shut down 23,000 miles of a railway system, arguably the first successful CI attack,
(McGuinn, 2004). However, the 2010 Stuxnet SCADA attack was undoubtedly the first of its kind to
disrupt CI operations. Its entry point was ultimately attributable to a hard coded SQL administrative
password (Falliere, et. al. 2010), a well-known bad development practice. In the twenty-two years
since Morris, damage from cyber security incidents have grown in frequency and impact.
Over the past ten years, especially, the numbers of successful CCI attacks have been increasing. The
profile of the creators of malware programs have changed since the days of the Morris worm. Today
malware is being developed and used primarily by criminal actors for financial gain and potentially by
other actors seeking to cause market instability and economic damage.
In the past computing attacks required access to high-end computing which was limited to wellfunded,
established entities that could support large data centres and computer clusters. However,
the introduction of the botnet has created a black-market for spam sending, decryption large-scale
brute force cracking activities, and Distributed Denial of Service (DDoS) attacks for hire for very cheap
prices scaled according to the target size. (OCED, 2008)
A “botnet” is criminal network of distributed computing, created by compromising victim devices, usually
through malware that exploits existing software weaknesses, and makes them a slave or “zombie”
to the larger criminal computer network called a “botnet.” As the computing power of non-secured
internet-connected devices increases so does the collective computing power of botnets. It is typical
68