Cyber Attacks. Protecting National Infrastructure Student Edition. Edward G. Amoroso

Transcription

1 Cyber Attacks Protecting National Infrastructure Student Edition Edward G. Amoroso ELSEVIER. AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SINGAPORE SYDNEY TOKYO Butterworth-Heinemann is an Imprint of Elsevier

2 CONTENTS V CONTENTS Preface Acknowledgments xi xv Chapter 1 Introduction 1 National CyberThreats, Vulnerabilities, and Attacks 4 Botnet Threat 7 National Cyber Security Methodology Components 9 Deception 11 Separation 13 Diversity 16 Consistency 17 Depth 19 Discretion 20 Collection 21 Correlation 23 Awareness 25 Response 26 Implementing the Principles Nationally 28 Protecting the Critical National Infrastructure Against Cyber Attacks 29 Summary 32 Chapter Review Questions/Exercises 33 Chapter 2 Deception 37 Scanning Stage 42 Deliberately Open Ports 43 Discovery Stage 45 Deceptive Documents 46 Exploitation Stage 48 ProcurementTricks 50 Exposing Stage 51 Interfaces Between Humans and Computers 53 National Deception Program 54

3 Vi CONTENTS The Deception Planning Process Against Cyber Attacks 55 Summary 57 Chapter Review Questions/Exercises 58 Chapter 3 Separation 63 What Is Separation? 65 Functional Separation 67 National Infrastructure Firewalls 69 DDOS Filtering 71 SCADA Separation Architecture 73 Physical Separation 75 Insider Separation 77 Asset Separation 80 Multilevel Security (MLS) 82 Protecting the Critical National Infrastructure Through Use of Separation 84 Summary 86 Chapter Review Questions/Exercises 87 Chapter 4 Diversity 91 Diversity andworm Propagation 93 Desktop Computer System Diversity 95 Diversity Paradox of Cloud Computing 98 NetworkTechnology Diversity 100 Physical Diversity 103 National Diversity Program 105 Critical Infrastructure Resilience and Diversity Initiative 106 Summary 108 Chapter Review Questions/Exercises 109 Chapter 5 Commonality 115 Meaningful Best Practices for Infrastructure Protection 119 Locally Relevant and Appropriate Security Policy 122 Culture of Security Protection 123 Infrastructure Simplification 126 Certification and Education 128 Career Path and Reward Structure 131 Responsible Past Security Practice 132 National Commonality Program 134

4 CONTENTS VII How Critical National Infrastructure Systems Demonstrate Commonality 135 Summary 137 Chapter Review Questions/Exercises 138 Chapter 6 Depth 141 Effectiveness of Depth 143 Layered Authentication 147 Layered Virus and Spam Protection 151 Layered Access Controls 152 Layered Encryption 154 Layered Intrusion Detection 156 National Program of Depth 158 Practical Ways for Achieving Information Assurance in Infrastructure Networked Environments 160 Summary 161 Chapter Review Questions/Exercises 162 Chapter 7 Discretion 167 Trusted Computing Base 168 Security Through Obscurity 171 Information Sharing 174 Information Reconnaissance 176 Obscurity Layers 178 Organizational Compartments 179 National Discretion Program 181 Top-Down and Bottom-Up Sharing of Sensitive Information 182 Summary 185 Chapter Review Questions/Exercises 186 Chapter 8 Collection 191 Collecting Network Data 194 Collecting System Data 196 Security Information and Event Management 200 Large-ScaleTrending 203 Tracking a Worm 205 National Collection Program 208 Data Collection Efforts: Systems and Assets 209 Summary 212 Chapter Review Questions/Exercises 213

5 VIII CONTENTS Chapter 9 Correlation 217 Conventional Security Correlation Methods 221 Quality and Reliability Issues in Data Correlation 223 Correlating Data to Detect a Worm 225 Correlating Data to Detect a Botnet 226 Large-Scale Correlation Process 228 National Correlation Program 230 Correlation Rules for Critical National Infrastructure Cyber Security 232 Summary 233 Chapter Review Questions/Exercises 234 Chapter 10 Awareness 239 Detecting Infrastructure Attacks 243 Managing Vulnerability Information 244 Cyber Security Intelligence Reports 246 Risk Management Process 248 Security Operations Centers 250 National Awareness Program 252 Connecting Current Cyber Security Operation Centers to Enhance Situational Awareness 254 Summary 256 Chapter Review Questions/Exercises 256 Chapter 11 Response 261 Pre-Versus Post-Attack Response 263 Indications and Warning 265 Incident Response Teams 266 Forensic Analysis 269 Law Enforcement Issues 271 Disaster Recovery 272 National Response Program 274 The Critical National Infrastructure Incident Response Framework 275 Transitioning from NIPP Steady State to Incident Response Management 276

6 CONTENTS IX Summary 278 Chapter Review Questions/Exercises 278 Appendix A: National Infrastructure Protection Criteria 283 Appendix B: Case Studies by John R. Vacca 291 Index 305