Cyber Security Trends and Challenges

Size: px

Start display at page:

Download "Cyber Security Trends and Challenges"

Meredith Washington
8 years ago
Views:

1 Cyber Security Trends and Challenges Prof. Heejo Lee Dept. of Computer Science and Engineering Korea University, June 23, 2015

2 Contents Introduction Cyber security attack trends Legal issues and investigation Research challenges Considerations for the future 2

3 INTRODUCTION 3

3% to reach $120 billion during 2011-2017 http://marketrealist.

4 Cyber Security Markets The cyber security market is expected to grow at a compounded annual growth rate of 11.3% to reach $120 billion during billion-cybersecurity-budget-a-7867/op-1 4

Incidents and Financial Impact Continue to Soar The detected security incidents in 2014 have increased 12 times compared to the security incidents in 2009 PwC survey from 9,700 CEOs/CSOs in154

5 Incidents and Financial Impact Continue to Soar The detected security incidents in 2014 have increased 12 times compared to the security incidents in 2009 PwC survey from 9,700 CEOs/CSOs in154 countries <Global state of information security survey, 2015> <Net Losses: Estimating the Global Cost of Cybercrime, June 2014> reports/rp-economic-impact-cybercrime2.pdf 5

survey, 2015> <Net Losses: Estimating the Global Cost of Cybercrime, June 2014> http://www.pwc.

6 CYBERSECURITY ATTACK TRENDS 6

7 Cyber Security Trends Sep 23, 2013 iphone 5s fingerprint vulnerability Nov 12, 2013 ISS attacked by virus epidemics Apr, 2014 Heartbleed, OpenSSL vulnerability Nov 24, 2014 Sony Pictures Entertainment hack Mar, 2015 Newer aircraft Wi-Fi vulnerability 7

Apr, 2014 Heartbleed, OpenSSL vulnerability Nov 24, 2014 Sony

sensors, so all the CCC needed to do was increase the resolution of its fake http://www.cnet.

8 iphone Fingerprint Authentication Vulnerability German hacker group Chaos Computer Club(CCC) hacked iphone with TouchID, Sep 23, 2013 A fingerprint of the phone user, photographed from a glass surface, is enough It simply has a higher resolution than previous sensors, so all the CCC needed to do was increase the resolution of its fake hone-5s-fingerprint-sensor-hacked-within-days-of-launch.html 8

AG or a type of Trojan virus GameThief.Win32.

9 Virus Epidemics in Space Nov 12, 2013 ISS attacked by virus epidemics Infected International Space Station(ISS) computers and laptops through the USB memory of the Russian cosmonaut brought a laptop Kaspersky guessed virus W32.Gammima.AG or a type of Trojan virus GameThief.Win32.Magania To enhance the security and reliability of the computer system, OS is changed from Windows XP to Linux 9

network equipments and security solutions were also vulnerable, including 75 Cisco routers and

10 OpenSSL HeartBleed Vulnerability A security bug for OpenSSL library disclosed in April 2014 Half a million of the Internet secure web servers were to be vulnerable Many other systems such as network equipments and security solutions were also vulnerable, including 75 Cisco routers and switches

11 Sony Pictures Hack Nov 24, Hacked by Guardians of Peace (GOP) The Interview the film believed to have been the reason The film s plot involving the CIA planning to kill the secretive nation s supreme leader Kim Jong-un The hackers have obtained some100 terabytes of data stolen from Sony Estimated that the cost to fix the breach will be in the region of $100 million The director of the FBI has defended his bureau s claim that the hacking attack was the work of the North Korean government 11

secretive nation s supreme leader Kim Jong-un The hackers have obtained some100 terabytes of data stolen from Sony Estimated that the cost to fix the

Newer Aircraft Vulnerable to Hacking Mar, 2015.

vulnerabilities The main plane computers and passenger internet area are physically networked Airplane Wi-Fi

12 Newer Aircraft Vulnerable to Hacking Mar, The planes include the Boeing 787 Dreamliner, the Airbus A350 and A380 aircraft were reported to have vulnerabilities The main plane computers and passenger internet area are physically networked Airplane Wi-Fi hacking could take full control of the plane Main computers including control, navigation and communication systems 12

13 LEGAL ISSUES AND INVESTIGATION 13

located http://www.cyberlawconsulting.com http://www.mondaq.

14 Legal Issues in Cloud Computing By storing the data to cloud, criminals can avoid the legal issues Organizations don t know where the data is located Protection+Privacy/Critical+Legal+Issues+In+Cloud+Agreeme nts 14

15 International Collaboration for Global Incidents Computer Security Incident Response Team (CSIRT) A reliable and trusted single point of contact for reporting computer security incidents worldwide Forum of Incident Response and Security Team (FIRST) A premier organization and recognized global leader in incident response Asia Pacific Computer Emergency Response Team (APCERT) Work to help create a safe, clean and reliable cyber space in the Asia Pacific Region through global collaboration 15

(FIRST) A premier organization and recognized global leader in incident response Asia Pacific Computer Emergency Response

16 RESEARCH CHALLENGES 16

17 DDoS Attacks (1/3) A Distributed denial-of-service (DDoS) attacks is an attempt to make a machine or network resource unavailable to its intended users One of the main threat to the cyber security <DDoS attack diagram> cyber-attacks-statistics-aggregated/ 17

users One of the main threat to the cyber security <DDoS attack diagram>

18 DDoS Attacks (2/3) Distributed reflection denial of service attack Using IP address spoofing, the source address is set to that of the targeted victim, which means all the replies will go to (and flood) the target 18

address is set to that of the targeted victim, which

19 DDoS Attacks (3/3) DDoS attacks continue to represent an insidious threat, with an alarming increase in the Simple Service Discovery Protocol reflection attacks <Arbor networks quarterly report on global DDoS attack data Q3 2014> 19

Service Discovery Protocol reflection attacks <Arbor

20 Defense Strategies and Cyber Shelter for DDoS Attacks (1/4) Broader DDoS Solutions No single effective solution Network topology, server design, attack filtering Resilient topology & DNS load balancing Dependable server design URL splitting ISP on-demand filtering URL rate limiting 20

design, attack filtering Resilient topology & DNS load balancing

21 Defense Strategies and Cyber Shelter for DDoS Attacks (2/4) Dependable Servers Servers are more susceptible to DDoS than networks Even though DDoS traffic filtered, a server can be suffered from unfiltered attack traffic URL splitting Light weight first page in one server, redirect to next page in a different server Load sharing with multiple servers 21

22 Defense Strategies and Cyber Shelter for DDoS Attacks (3/4) Resilient Topology Resiliency of network topology Avoid single point of failures via link congestion Disperse replicated servers Once a server crashed, then the other can continue to provide the same services 22

23 Defense Strategies and Cyber Shelter for DDoS Attacks (4/4) DDoS Shelter Service Reroutes attack traffic Destined for the targeted website to the Shelter and cleans it All traffic to the website will be collected by the Shelter to cope with the attack for a certain period of time 23

24 Malware in Documents Hangul Document Exploit Put the shell code to heap area in the document for exploiting the vulnerability of HWP word processor OS shut down after a while and print the message Who Am I? <Attack simulation in.hwp vulnerability> 24

Discovering Android Malware using Behavior Signature Detecting Android malware variants by family signature New approach using CodeGraph system and android API Jonghoon Kwon, Jihwan Jeong, Jehyun

25 Discovering Android Malware using Behavior Signature Detecting Android malware variants by family signature New approach using CodeGraph system and android API Jonghoon Kwon, Jihwan Jeong, Jehyun Lee, Heejo Lee, DroidGraph: Discovering Android Malware by Analyzing Semantic Behavior", IEEE Conf. on Communications and Network Security (IEEE CNS), Oct Suyeon Lee, Jehyun Lee, Heejo Lee, "Screening Smartphone Applications using Behavioral Signatures", IFIP Int'l Information Security and Privacy Conference (IFIP SEC), Vol. 405, pp , Jul

26 Detecting Repackaged Malapps using Software-based Attestation MysteryChecker Verifier randomly generates an attestation module Verifier transfers a new attestation module to target, and the target replies an attestation result Chanyoung Lee, Dongwon Seo, Jihwan Jeong, Jonghoon Kwon, Heejo Lee, MysteryChecker: Unpredictable Attestation to Detect Repackaged Malicious Applications in Android, IEEE Conf. on Malicious and Unwanted Software (IEEE Malware), Oct

27 CONSIDERATION FOR THE FUTURES 27

28 Security Awareness (1/2) Almost 40% of adults rarely protect themselves against cyber crooks National Crime Agency (NCA) has started a security awareness campaign <August 13, 2014> 40-of-adults-rarely-protect-themselves-against-cyber-crooks 28

Security Awareness (1/2) NCA is urging you to be careful when using the internet Device s software up-to-date Not opening files on a website or email from suspicious

29 Security Awareness (1/2) NCA is urging you to be careful when using the internet Device s software up-to-date Not opening files on a website or from suspicious sources Being cautious when putting USB sticks and CDs into computer Cyber Streetwise campaign provides easy tips so that users stay safe online 29

30 Security Awareness Training V School Is held annually by AhnLab since 2006 Is corporate social activities as a talent donation Youth IT security camp Is held by MSIP since 2012 Plants the security awareness in young people 30

31 Human Resource Development (1/2) Best of Best (BOB) program Is started from 2012 A stepped mentoring program with top security experts A practice education and project of utility knowledge-based continuous support to white hackers for entering the workforce 31

32 Human Resource Development (2/2) CODE GATE (Hacking conference) Is the world-class global event on information protection to foster the global experts Capture the flag (CTF) sample problem INCOGNITO (Hacking conference) Is a name for the Korean university computer security club union created in 2012 The members are 12 universities including Korea Univ, POSTECH, KAIST, and SNU. 32

33 CSIRT Training Program APISC Security Training Course Since 2005 KISA has been implementing the Asia-Pacific Information Security Training Course (APISC) Program 1-day on Information Security in Korea 1-day for economy update by participants 3-days of TRANSITS course on CSIRT building and operation 33

34 HRD Programs in Information Security(1/2) Undergraduate and graduate course for information security Information security departments in undergraduate course are established in 2002 from KCC of IT resources development project Graduate course 21 courses in general graduate school 11 courses in special graduate school Universities Students Graduate (2014) Undergraduate degree program Graduate degree program 36 5, ,

forensics, cyber security Collaborative projects with enterprises Korea university

35 HRD Programs in Information Security(2/2) Selection of information security specialized university in Korea, June 2015 Curriculum operation: incident response, digital forensics, cyber security Collaborative projects with enterprises Korea university Seoul women s university Ajou university 35

36 THANK YOU 36

Anthony J. Keane, MSc, PhD and Jason Flood, MSc Information Security & Digital Forensics Research Group Institute of Technology Blanchardstown

Anthony J. Keane, MSc, PhD and Jason Flood, MSc Information Security & Digital Forensics Research Group Institute of Technology Blanchardstown 1 Protected networks are continuously being successfully attacked