author(s) - open.michigan · 2016-10-05 · public domain – government: works that are produced...
TRANSCRIPT
![Page 1: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/1.jpg)
Author(s): Don M. Blumenthal, 2010
License: Unless otherwise noted, this material is made available under the terms of the Attribution – Non-commercial – Share Alike 3.0 license http://creativecommons.org/licenses/by-nc-sa/3.0/
We have reviewed this material in accordance with U.S. Copyright Law and have tried to maximize your ability to use, share, and adapt it. The citation key on the following slide provides information about how you may share and adapt this material.
Copyright holders of content included in this material should contact [email protected] with any questions, corrections, or clarification regarding the use of content.
For more information about how to cite these materials visit http://open.umich.edu/education/about/terms-of-use.
Any medical information in this material is intended to inform and educate and is not a tool for self-diagnosis or a replacement for medical evaluation, advice, diagnosis or treatment by a healthcare professional. Please speak to your physician if you have questions about your medical condition.
Viewer discretion is advised: Some medical content is graphic and may not be suitable for all viewers.
![Page 2: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/2.jpg)
Citation Key for more information see: http://open.umich.edu/wiki/CitationPolicy
Use + Share + Adapt
Make Your Own Assessment
Creative Commons – Attribution License
Creative Commons – Attribution Share Alike License
Creative Commons – Attribution Noncommercial License
Creative Commons – Attribution Noncommercial Share Alike License
GNU – Free Documentation License
Creative Commons – Zero Waiver
Public Domain – Ineligible: Works that are ineligible for copyright protection in the U.S. (USC 17 § 102(b)) *laws in your jurisdiction may differ
Public Domain – Expired: Works that are no longer protected due to an expired copyright term.
Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105)
Public Domain – Self Dedicated: Works that a copyright holder has dedicated to the public domain.
Fair Use: Use of works that is determined to be Fair consistent with the U.S. Copyright Act. (USC 17 § 107) *laws in your jurisdiction may differ
Our determination DOES NOT mean that all uses of this 3rd-party content are Fair Uses and we DO NOT guarantee that your use of the content is Fair.
To use this content you should do your own independent analysis to determine whether or not your use will be Fair.
{ Content the copyright holder, author, or law permits you to use, share and adapt. }
{ Content Open.Michigan believes can be used, shared, and adapted because it is ineligible for copyright. }
{ Content Open.Michigan has used under a Fair Use determination. }
![Page 3: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/3.jpg)
System Hacks and Attacks
510 - Data Security and Privacy: Legal, Policy, and Enterprise Issues University of Michigan School of Information Week 5
![Page 4: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/4.jpg)
Purposes Crime Malice/vandalism Glory within community Political terrorism – “hacktivism” Espionage
Nations or commercial interests Nations against commercial interests
State-state warfare Some question its existence
![Page 5: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/5.jpg)
Information Security Predictions Super Worms
Spread faster More malicious Mutate
Exploit auto update features Attacks against routing or domain name
structure Simultaneous cyber and physical attack
![Page 6: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/6.jpg)
More InfoSec Predictions
Stealthier malware Polymorphic code Anti-forensics Tunnel Kernel level root kits Sniffing back doors Sniffing PC activity; e.g., keystroke logger Reflected bounce attacks
![Page 7: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/7.jpg)
Prescient
InfoSec book on the mark for most part Even where techniques didn’t exist yet
Fell short in understating Phishing existed
Targeted spear phishing, aimed at individuals Whaling, aimed at upper executives
E-blackmail (blackemail?)– pay or we’ll wipe your computer
![Page 8: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/8.jpg)
Not Addressed
Organized crime has change landscape Scale Ability to wait to use stolen information
Mules Old term now used for people who accept
shipments of goods bought with stolen info Range of frauds Proliferation of “bots” for sending spam
and committing attacks
![Page 9: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/9.jpg)
Critical Infrastructure (CII)
Broader concepts than cybercrime Essential to minimal operations of
government and economy Physical and electronic Countries define differently Consequential infrastructure if not CII All share dependency on computer based
communications and control systems
![Page 10: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/10.jpg)
Responsibilities
Overall and individual categories help set lines of responsibility and communities of shared interest
Public/private essential; private owns much of infrastructure
Need to protect network, apps, OS, data
![Page 11: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/11.jpg)
Framework
Laws and regulations Government directives and policies Private and public standards and
procedures
![Page 12: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/12.jpg)
Considerations
National security Economic security Public safety Duty to customers and shareholders
![Page 13: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/13.jpg)
Processes and Methods
Study that set concepts and drew attention Presidential designation of leadership Plan drafted after discussions with all
affected sectors Legislation Information sharing Public education
![Page 14: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/14.jpg)
Risks and Potentials
“Newer” economies more at risk Estonia uses Internet in economy much more
than US Much less brick and mortar backup
Joint cyber-physical attack Russia-Georgia
![Page 15: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/15.jpg)
Proof Significant Issue
Proof of sponsorship and even origin Some question if Estonia or cyber part of
Russia-Georgia conflict were state sponsored
Did Chinese government or private sector attack US/Google/et al recently
June attacks on US and South Korea supposedly from North Korea may have come from London
![Page 16: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/16.jpg)
US Reactions
Cybercime statutes such as Computer Fraud and Abuse Act
Federal and state statutes regarding information security and privacy
Info warfare “live fire exercise” (official term) during Clinton administration Similar exercises ongoing
Permanent US Cyber Command established mid-2009
![Page 17: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/17.jpg)
Recent Federal Activity
Commission on Cybersecurity for the 44th Presidency http://csis.org/program/commission-
cybersecurity-44th-presidency Obama administration created cyber
security czar position to coordinate agencies’ activities
![Page 18: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/18.jpg)
Pending Legislation
S. 773 – Cybersecurity Act of 2009 Information gathering and coordination Standards setting Scholarships and competitions
H.R. 4461 - Cybersecurity Enhancement Act of 2009 Similar but narrower on standards setting
S. 1490 - Personal Data Privacy and Security Act of 2009 (discussed earlier)
![Page 19: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/19.jpg)
Non-US Government Examples
Council of Europe Convention on Cybercrime holds management primarily responsible when company targeted successfully
Model cybercrime toolkit at http://www.itu.int/ITU-D/cyb/cybersecurity/projects/cyberlaw.html
![Page 20: Author(s) - Open.Michigan · 2016-10-05 · Public Domain – Government: Works that are produced by the U.S. Government. (USC 17 § 105) Public Domain – Self Dedicated: Works that](https://reader034.vdocument.in/reader034/viewer/2022050309/5f717338d3e671479b66166e/html5/thumbnails/20.jpg)
Private Sector
Still has role Tort Contract Shareholder
Public education By private or public sector