Cyber Attacks

432 Pages·05.712 MB·English

by  Edward Amoroso

Cyber Attacks
Protecting National Infrastructure
Student Edition
Edward G. Amoroso

2
Acquiring Editor: Pam Chester
Development Editor: David Bevans
Project Manager: Paul Gottehrer
Designer: Alisa Andreola
Butterworth-Heinemann is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
Copyright © 2013 Elsevier Inc. All rights reserved
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying,
recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission,
further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center
and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in
research methods or professional practices, may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods
described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for
whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage
to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products,
instructions, or ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Amoroso, Edward G.
Cyber attacks : protecting national infrastructure / Edward Amoroso, John R. Vacca.–Student ed.
p. cm.
Summary: “Ten basic principles that will reduce the risk of cyber attack to national infrastructure in a substantive manner”–Provided by
publisher.
ISBN 978-0-12-391855-0 (hardback)
1. Cyberterrorism–United States–Prevention. 2. Computer networks–Security measures. 3. Cyberspace–Security measures. 4. Computer
crimes–United States–Prevention. 5. National security–United States. I. Vacca, John R. II. Title.
HV6773.2.A47 2012
363.325’90046780973–dc22
2012000035
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library
ISBN: 978-0-12-391855-0
Printed in the United States of America
12 13 14 15 16 10 9 8 7 6 5 4 3 2 1
3
For information on all BH publications visit our website at www.elsevierdirect.com/security

4
Preface

Man did not enter into society to become worse than he was before, nor to have fewer rights than he had
before, but to have those rights better secured.

Thomas Paine in Common Sense

Before you invest any of your time with this boo k, please take a moment and look over the following
points. They outline my basic philosophy of national infrastructure security. I think that your reaction to these
points will give you a pretty good idea of what your reaction will be to the book.
1. Citizens of free nations cannot hope to express or enjoy their freedoms if basic security protections are
not provided. Security does not suppress freedom—it makes freedom possible.
2. In virtually every modern nation, computers and networks power critical infrastructure elements. As a
result, cyber attackers can use computers and networks to damage or ruin the infrastructures that
citizens rely on.
3. Security protections, such as those in security books, were designed for small-scale environments such
as enterprise computing environments. These protections do not extrapolate to the protection of
massively complex infrastructure.
4. Effective national cyber protections will be driven largely by cooperation and coordination between
commercial, industrial, and government organizations. Thus, organizational management issues will
be as important to national defense as technical issues.
5. Security is a process of risk reduction, not risk removal. Therefore, concrete steps can and should be
taken to reduce, but not remove, the risk of cyber attack to national infrastructure.
6. The current risk of catastrophic cyber attack to national infrastructure must be viewed as extremely
high, by any realistic measure. Taking little or no action to reduce this risk would be a foolish national
decision.

The chapters of this book are organized around 10 basic principles that will reduce the risk of cyber
attack to national infrastructure in a substantive manner. They are driven by experiences gained managing the
security of one of the largest, most complex infrastructures in the world, by years of learning from various
commercial and government organizations, and by years of interaction with students and academic researchers
in the security field. They are also driven by personal experiences dealing with a wide range of successful and
unsuccessful cyber attacks, including ones directed at infrastructure of considerable value. The implementation
of the 10 principles in this book will require national resolve and changes to the way computing and
networking elements are designed, built, and operated in the context of national infrastructure. My hope is
that the suggestions offered in these pages will make this process easier.
5
6
Student Edition
To make it easier to teach these basic principles in the classroom, Cyber Attacks Student Edition adds new
material developed by John R. Vacca, Editor-in-Chief of Computer and Information Security Handbook
(Morgan Kaufmann Publishers) aimed specifically at enhancing the student experience, making it appropriate
as a core textbook for instructors teaching courses in cyber security, information security, digital security,
national security, intelligence studies, technology and infrastructure protection and similar courses.
Cyber Attacks Student Edition features the additio n of case studies to illustrate actual implementation
scenarios discussed in the text. The Student Edition also adds a host of new pedagogical elements to enhance
learning, including chapter outlines, chapter summaries, learning checklists, chapter-by-chapter study
questions, and more.
Instructor Support for Cyber Attacks Student Edition includes Test Bank, Lecture Slides, Lesson Plans,
and Solutions Manual available online at http://textbooks.elsevier.com/web/Manuals.aspx?
isbn=9780123918550.
• Test Bank—Compose, customize, and deliver exams using an online assessment package in a free
Windows-based authoring tool that makes it easy to build tests using the unique multiple choice and
true or false questions created for Cyber Attacks Student Edition. What’s more, this authoring tool
allows you to export customized exams directly to Blackboard, WebCT, eCollege, Angel, and other
leading systems. All test bank files are also conveniently offered in Word format.
• PowerPoint Lecture Slides—Reinforce key topics with focused PowerPoints, which provide a perfect
visual outline with which to augment your lecture. Each individual book chapter has its own dedicated
slideshow.
• Lesson Plans—Design your course around customized lesson plans. Each individual lesson plan acts
as separate syllabi containing content synopses, key terms, content synopses, directions to
supplementary websites, and more open-ended critical thinking questions designed to spur class
discussion. These lesson plans also delineate and connect chapter-based learning objectives to specific
teaching resources, making it easy to catalogue the resources at your disposal.

7
Acknowledgments

The cyber security experts in the AT&T Chief Security Office, my colleagues across AT&T Labs and the
AT&T Chief Technology Office, my colleagues across the entire AT&T business, and my graduate and
undergraduate students in the Computer Science Department at the Stevens Institute of Technology have had
a profound impact on my thinking and on the contents of this book. In addition, many prominent enterprise
customers of AT&T with whom I’ve had the pleasure of serving, especially those in the United States Federal
Government, have been great influencers in the preparation of this material.
I’d also like to extend a great thanks to my wife Lee, daughter Stephanie (17), son Matthew (15), and
daughter Alicia (9) for their collective patience with my busy schedule.

8
TABLE OF CONTENTS
Title

Copyright

Preface

Acknowledgments

1. Introduction

National Cyber Threats, Vulnerabilities, and Attacks

Botnet Threat

National Cyber Security Methodology Components

Deception

Separation

Diversity

Consistency

Depth

Discretion

Collection

Correlation

Awareness

Response

Implementing the Principles Nationally

Protecting the Critical National Infrastructure Against Cyber Attacks

Summary

Chapter Review Questions/Exercises

2. Deception
9
Scanning Stage

Deliberately Open Ports

Discovery Stage

Deceptive Documents

Exploitation Stage

Procurement Tricks

Exposing Stage

Interfaces Between Humans and Computers

National Deception Program

The Deception Planning Process Against Cyber Attacks

Summary

Chapter Review Questions/Exercises

3. Separation

What Is Separation?

Functional Separation

National Infrastructure Firewalls

DDOS Filtering

SCADA Separation Architecture

Physical Separation

Insider Separation

Asset Separation

Multilevel Security (MLS)

Protecting the Critical National Infrastructure Through Use of Separation

Summary

Chapter Review Questions/Exercises
10