Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

INFORMATION ASSURANCE74. Time: Temporal elements of the other three dimensions need to be considered. The state ofinformation changes from one form to another in a system. Security services must adapt toa constantly changing environment as new software and new requirements are put in placewithin an organization. Likewise, countermeasures also need to be updated as the threat isdynamic—new malware and enemy tactics, techniques, and procedures (TTPs) areconstantly introduced.As this book is primarily about cyber warfare and not information assurance, we will focus onthe first two dimensions because they allude to offensive cyber warfare (more purely defensiveoperations tend to fall into the realm of information assurance).The state of information is an important concept as it often dictates what type of TTPs anattacker may use when evaluating a target. As stated above, there are three such states: Storagerefers to the state when the information is written to a disk. Transmission refers to the informationbeing transmitted across a network. Finally, processing refers to the information beingloaded in the temporary memory (RAM) of a computer. The state of the information becomesmost important in the second part of this book where we explore cyber espionage and exploitation.For example, in Chapter 10, we describe how Kata’ib Hezbollah (KH) was able to successfullysteal the video feeds of Predator drones. KH stole this information while it was beingtransmitted from the drone to a ground station. By contrast, Operation Aurora, described inChapter 7, hackers, likely from China, stole sensitive intellectual property from Google—pilfering it from file servers. The information in question was in the storage state.The second point listed above (security services) is discussed throughout the book. One ofthese services is availability. This crucial service ensures that users are able to access the informationthey seek. For instance, if a Web server is down, it is not available to provide information.Distributed denial of service (DDoS) attacks—as described in every case study in the firstpart of this book—target this specific security service as they are designed to bring down computersystems, thereby denying individuals access to the information contained in thosesystems.Another service informs about the authenticity of the data. If the data have integrity, a usercan be sure that a third party did not alter it. Many of the attacks seen in the first part of thisbook were designed to cause users to question data integrity—specifically, Web site defacementsof groups like Hamas (Chapter 4) and Anonymous (Chapter 6). In the second part ofthis book, the integrity of the data was violated by virtue of a third party obtaining unfetteredaccess to a target system. The break-in of the Tibetan Government-in-Exile (Chapter 7) and thecutting-edge malware known as Duqu (Chapter 8) come to mind. Integrity violations canaffect industrial equipment as well. We give examples in Chapter 11 where we describehow the integrity of the Maroochy water facility was compromised. In Chapter 13, wepresent how Stuxnet manipulated the hardware and software that controlled Iraniancentrifuges—hence, violating the overall integrity of the system.The next security service is authentication. We primarily see examples where authenticationis violated in Chapter 7 when we describe several case studies of cyber espionage attributed toChinese hackers. Authentication was also a missing component in the unencrypted Predatordrone feeds that we will discuss in Chapter 10. Another role played by this security service isin industrial control systems—as many of these systems use protocols that rely on implicittrust relationships (Chapters 11–13).