Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

6 1. CYBER WARFARE: HERE AND NOWestimate that attributes a cyber attack to a certain group. In the guidelines listed below,suppose that security analysts studying cyber operation X have produced intelligence Yby analyzing the traffic of the malware. Y seemingly identifies organization Z as the perpetratorof the cyber attack. Considering a deception, the analysts should also considerthe following points:1. Does organization Z have the capability to conduct operation X?2. Does organization Z have a reason to conduct operation X?3. How likely is it that organization Z would have left intelligence Y indicating itsresponsibility?4. What other intelligence causes the analyst to believe that organization Z conducted cyberoperation X?5. Is there another organization (Q) that has the capability to conduct operation X?6. Is there another organization Q that would have a reason to conduct operation X andbenefit from misguiding the analyst into believing that Z was responsible?7. Is there another organization Q that would be savvy enough to plant intelligence Yindicating that organization Z was responsible?8. Is there another organization Q for which there exists some other intelligence (Y 0 )indicating that it conducted cyber operation X?Items 1-4 deal with determining the likelihood that a given piece of intelligence is accurate.Items 5-8 deal with determining the likelihood of a deception hypothesis. Again, wenote that using such techniques can only lead us to indicate who may have done the attack,but does not provide hard evidence. However, in the case of cyber warfare (as opposed to thestudy of cyber crime) often all we need is a good intelligence assessment as opposed to actualevidence.INFORMATION ASSURANCEIn the final part of this chapter, we review a popular model for studying informationassurance that is prevalent in the literature—the extended McCumber model. b;7 This modelwas then extended adding a fourth dimension 10 years later by Maconachy and hiscolleagues 8 :1. Information States: In a computer system, information is found in one of three states:storage, processing, or transmission.2. Security Services: A truly secure information system will guarantee the user of five securityservices: availability, integrity, authentication, confidentiality, and nonrepudiation.3. Security Countermeasures: In order to maintain the security of an information system,technology, operations, and people must be considered—vulnerability in any one of theseareas could lead to the entire system becoming vulnerable.b The original McCumber model for information assurance was introduced in 1991.