Download PDF - Department of Navy Chief Information Officer - U.S. ...

And the really disheartening part? There aremore than 75,000 malware variants runningloose, so if you are depending solely on antivirussoftware to keep you safe I wish you goodluck. You will need it. (That’s giving away the answerto No. 6 a little early.)Beware of Geeks Bearing GiftsThe answer to No. 3 is b. It may look like a calculator.It may act like a calculator. But that cutecalculator application adorned with tiny flyingponies that you downloaded from the Internetin hopes of luring your 6 year-old into a state ofmathematical genius might really be a horse — a Trojan horse.While rootkits (discussed later) and spyware (discussed in thelast issue at www.chips.navy.mil/archives/08_Jul/web_pages/botnets.html)are not nice things to have on your computer, a Trojanhorse is a sweet candy coating for something infectious on theinside. Beware of anything you can get for free — it might beworth less than you paid for it.MP3 players are marginally less evil, but we can discuss theirinsidious effects the next time we look at forms of computermediatedaddiction.Trojan horses, like their mythical Greek namesake, rarely carryanything good. When that innocent-looking calculator applicationtriggers a security alert during installation, your computerwill ask for permission to complete the job. There is usually agood reason for the computer to ask because the applicationis asking the computer to let it change things deep in the computer’scerebral cortex.At this point, it is up to the operator to exercise good judgmentand question why a calculator application needs to makechanges to the Registry. Unfortunately, too many people inadvertentlyload bad stuff on their PCs, or use obsolete or unpatchedsoftware that allows malware on the system, thus contributingmore zombies to the botnet army.The first three questions should lead you to the answer to No.4. If you know what country has the largest organizational networks,uses massive amounts of information daily, and whosepopulace is easily distracted by bright shiny computer-like objects,then the only logical answer is a, the United States.Earlier this year, a company named SecureWorks publisheda report about the source of cyber attack attempts against itsclients. At the top of the list was the United States, which hosted20.6 million attack attempts. China was a distant second with 7.7million, followed in descending order by Brazil, South Korea, Poland,Japan, Russia, Taiwan, Germany and Canada, which rackedup between 100,000 and 200,000 each.However, the last eight together only totaled around 1.6 millionattacks, far short of either China or the United States, andmore attacks were launched from U.S. computers than the restof these nations combined. If you knew the answer to No. 4 thenI am hoping you also got No. 9 correct.The last of our multiple choice questions offers several strategiesof varying attractiveness.“Default Permit,” or "Everything, not explicitly forbidden, ispermitted," only works if you can identify every possible threatto your system. Like my earlier indictment of antivirus software,any new attack not in the profile list will walk right in and makeitself at home.“Penetrate and Patch” is a security approachused by many in the computer industry.We have been doing this for decades.We still do P&P, and therein is the problem. Ifit were an effective way to secure our systems,why do we still need to keep doing it?Even if we could find all the holes in aparticular system, as soon as we upgradeor replace software new groups of hiddenvulnerabilities emerge. Granted, penetrationtesting is useful, but only if you, or thepeople you hire, are more skilled than thepeople trying to compromise your system.“Educating Users” suffers from the same lack of results. Everyyear, millions of computer users in the United States take computersecurity training mandated by their organizations. Doesit help? Well, according to SecureWorks’ report, we have moreattacks coming from infected PCs here in the U.S. These infectedPCs serve as platforms (bots) that launch cyber attacks worldwide.So educating users, which is still something we should do,does not appear to be stemming the tide.That leaves “Whitelisting” which is how most secure computersoperate today. A whitelist is a list of accepted items or personsin a set. The list is inclusionary, confirming that the itembeing analyzed is acceptable. An e-mail whitelist is a list of contactsthat the user deems are acceptable to receive e-mail from.Spam filters that come with e-mail clients have both white andblacklists of senders and keywords to look for in e-mails.No one should be running in a mode where they can loadsoftware or change key system settings as a matter of routine.If you need to install new applications, turn off anything thatmight attract malware, log in as "admin" and make your changes,and then go back to running in a safer mode. This answers No. 7a little early, but running your PC in admin mode only makes youmore vulnerable to infection. Do not do it.If you want to see an early description of whitelisting I willwind up the Wayback Machine to an article on computer securitypublished in CHIPS almost 12 years ago at www.chips.navy.mil/archives/97_jan/file6.htm. It took many years for computersecurity to gain enough traction to be considered more than aninconvenience. For example, it was not until 2004 that most PCswere sold with the firewall turned on as a default setting insteadof leaving it up to the user. And yes, that is the answer to thebonus question.Got Root?Since we have already discussed the answers to No. 6 (False)and No. 7 (False), let us move on to No. 8, which is True. A rootkitis a useful application for someone trying to hack into a systemto gain control at the “root” level of a computer.Early rootkits were developed to allow Unix administrators totake control of unresponsive systems and gain root access to thesystem, thus the name. However, they quickly became tools forhackers who wanted to gain administrative privileges and hidetheir activities from a system’s legitimate owners. A rootkit canbe a tool or a weapon depending on how it is employed.Modern rootkits are like submarines: Their job is to disappearinto the system and become invisible. In addition, they can alsoconceal the activities of other programs, like botnet applicationsor spyware. Rootkits can be difficult to find, particularly ifCHIPS October – December 2008 67