6th European Conference - Academic Conferences

Mecealus Cronkrite et al.
to see botnets with over ten thousand nodes or hosts at their command. (US-CERT, 2005) Very large
botnets such as Conflicker or Mariposa controlled millions of nodes.
Botnets can also do any distributed application criminals can imagine these are “Criminal Clouds” already
active and operational years ahead of industry. These rouge ad-hoc botnets have greatly
strengthened the computing arsenal of non-state criminal and terrorist organizations. (Council of
Europe Counterterrorism Task Force, 2007) Motivated attackers now have access to cheap, large
scale “stolen” computing grids. As a result, all the baseline security presumptions associated with securing
or encrypting data and the securing the data’s availability over the internet has greatly weakened.
2. Background
2.1 The relationship between the CI and the CCI
Figure 1: CCI IS stack by security control and influence
The US Department of Homeland Security Presidential Directive-7 (HSPD-7) defines the critical infrastructure
(CI) by the importance of an industry to society and the economy, e.g. transportation, agriculture,
energy, healthcare, telecommunications, and emergency services. The critical cyber infrastructure
(CCI) represents the information systems that support the operation of these key needs.
DHS’ National Cyber Command Division (NCCD) is responsible for protecting the CCI in the US, and
focuses on helping the CI industries, “conduct vulnerability assessments, develop training, and educate
the control systems community on cyber risks and mitigation solutions.” (Mcurk Testimony, 2010)
We can layer the components that intersect in a malware attack by their ability to control or influence
security processes, as in Figure 1. Developer knowledge and skill are the final arbiters of quality code
with the influence of the software publisher’s development methodology supervising those decisions.
Therefore, the ability to control and change the behaviour of security depends on the quality practices
of the software publisher and their developers. (Wang, et. al, 2008) The responsibility for security
software rests with the company that publishes software code, and the developers that participated in
IS system development because their knowledge of the system exceeds other spheres of influence.
2.2 The increasing risk to Critical Cyber Infrastructure (CCI)
Losses attributable to coding defects or weak configuration have increased in all industry sectors. The
impact from cyber attacks grows as the dependence on CCI systems designed with poor practices
continues. Up until the 2010, Stuxnet attack critical infrastructure systems were ‘siloed’ or separated
69