Preventing Damage by Preventing Grade System Intrusions: Conclusion

Educational institutes such as colleges and schools have understandable reasons to desire use of electronic grading records. Such systems must be recognized for the dangers they pose as lucrative targets for hackers, crackers, and cheaters. The impact from unauthorized intrusions can be significant for the future of the students, even those whose records are not modified, as shown by Tyler Coyner graduating salutatorian. Coyner’s data manipulation stripped another student of their rightful honor as salutatorian (McMillan, 2011).

Defensive efforts must be made to address but the attack vectors to be utilized by intruders and the motivation driving the attack. Whenever possible, it is best to recognize the situations that may lead to an attack and defuse it in advance.

---

McMillan. (March 4, 2011). Top Student Charged With Fixing Grades for Cash. PCWorld. Retrieved from: http://www.pcworld.com/article/221442/studentcharged.html

Preventing Damage by Preventing Grade System Intrusions: Attacker Vectors

Social Engineering

Non-technical theft of account information is a people problem and can be solved through policy and enforcement of said policy. Back in the first case study it was discussed that the attacker was alleged to have used the same account information numerous time, 110 times to be exact (Lupkin, 2012), over the course of two years. Such a situation cannot happen if passwords do not stay valid for that long. If the superintendent had updated her password every three months then the attack would have quickly lost access.

Another policy that can prevent such account compromises is strict rules on how to protect account information. Since Lupkin (2012) did not mention any technical tactics used, it is likely that Venusto received the account information in a more direct way, such as the victim having the data written down at her computer or even having handed over the account for some reason. It can be convenient for an upper official to give their information to a secretary, say to schedule meetings, but that should always be considered a critical security violation.

Attack Vector: Malware Infection

Edwin Kim collected his required account information via a software keylogger that he had installed on a shared workstation (Gibbons, 2012). Security policies which required and enforced the principle of least privilege would have prevented this compromise. A common user, as an average student should be at a university, will not have the privilege to install software which runs outside of their own session. Any changes which can impact the running environment of other users should require an administrator to perform. Additionally, high value targets such as professors should avoid sharing hardware with students. A student that exchanges the expected keyboard with a ‘value-added’ look-alike can then log their keystrokes even without installation privileges.

Attack Vector: Physical Security

Palos Verdes High School’s intrusion was the result of poor physical security. Defense in depth should have prevented access. Altman (2012) makes no mention of how the teens entered the grounds or the building, so one has to assume that those steps were fairly trivial. Both should have been secured and surveilled with either recording devices or human guards. Once inside, the intruders collected a master key after picking the lock on the janitors’ office. An object of such value as the master key should not be available just behind a lock that itself can open. Clearly, the protections on the key were significantly lacking.

---

Altman, L. (January 26, 2012). 3 Palos Verdes High students arrested in grade-tampering plot. DailyBreeze.com. Retrieved from: http://www.dailybreeze.com/latestnews/ci_19829634

Gibbons, M. (February 8, 2012). Bucks college student fails in attempt at an easy A. phillyBurbs.com Retrieved from: http://www.phillyburbs.com/news/crime/bucks-college-student-fails-in-attempt-at-an-easy-a/article_175726b7-b2c5-56ce-93ab-bbfb6abddcc4.html

Lupkin, S. (July 19, 2012). Mom Arrested For Hacking School Computers to Change Kids' Grades. abc News. Retrieved from: http://abcnews.go.com/US/mom-charged-hacking-school-computers-change-childrens-grades/story?id=16812838#.UKhiZoevuIM

Preventing Damage by Preventing Grade System Intrusions: Attacker Motivation

the Hack

Intruders that are operating under just pure hacker motivations are the bored, the curious, and those searching for a challenge. Education institutes are uniquely qualified for defusing these intruders, as intellectual challenge and stimulation is the purpose of such bodies. This point is captured explicitly in the mission statement of Harvard University: education “...should liberate students to explore, to create, to challenge...” (Lewis, 1997). Boredom, curiosity, and lack of challenge can all be directly addressed through adjustments to curriculum and individualized development plans.

the Grades

Cheater intruders can be defused by recognizing that the core of what they are doing is not actually changing their grades, they are instead taking control of their grades and future. These intruders can probably be successfully profiled under the hacker motivation of desiring power (Campbell & Kennedy, 2010). For whatever reason, they find themselves without the power to shape their situation through the legitimate channels. Ways to place students in control of their situation and convince them to downplay the grade portion of the grade include engaging them and their interests, challenging them appropriately, empowering them with a voice in directing what they learn, and recognizing their effort and competence (Stephens & Wangaard, nd).

the Money

There is no magic bullet to help reduce this motivation. These attackers are driven by straight criminal mindsets and desires. The solution here is to just address the technical issues to close the attack vectors. They will be back, the defenders just have to be persistent. If a psychological profile was to be considered covering these attackers, it would fall in line with the abnormal psychology of offline criminals (Campbell & Kennedy, 2010). Money as a motivator drives the attacker to get more money.

---

Campbell, Q., & Kennedy, D.M. (2009). The psychology of computer criminals. In Bosworth, et al (Eds.), Computer security handbook. New York, NY: John Wiley & Sons.

Lewis, H. R. (February 23, 1997). What is Harvard’s mission statement? Harvard University. Retrieved from: http://www.harvard.edu/faqs/mission-statement/

Stephens, J. M., & Wangaard, D. B., (nd). Teaching for integrity: Steps to prevent cheating in your classroom. The School for Ethical Education. Retrieved from: http://www.ethicsed.org/programs/integrity-works/pdf/teachingforintegrity.pdf

Selling their skills

Teenage crackers known to be involved in for-profit modification of electronic grade books (McMillan, 2011). McMillan describes Tyler Coyner, a student that inflated his GPA to 4.54 while also selling grade increases to his peers. Until he was arrested, Coyner spent two semesters performing attacks on the grade records in exchange for cash. He even graduated salutatorian based on his manipulations (McMillan, 2011).

Financial gain as a cyber crime motivator is not rare, although the monetization is achieved through other means. Attackers often harvest directly monetizable data such as credit card information and online banking credentials. Another method is extortion, or protection money, where a botnet operator threatens a distributed denial of service attack unless the victim pays the extortion cost (Dittrich & Himma, 2006). Extremely rare, relative to other financial cybercrimes, is mercenary attacks, like the kind Coyner was selling (McMillan, 2011).

---

Dittrich, D., & Himma, K. E. (2006). Hackers, Crackers, and Computer Criminals. Bidgoli, Hossein: Handbook of information security-Information warfare; social, legal and international issues, 154-171.

McMillan. (March 4, 2011). Top Student Charged With Fixing Grades for Cash. PCWorld. Retrieved from: http://www.pcworld.com/article/221442/studentcharged.html

Preventing Damage by Preventing Grade System Intrusions: Case Studies

Case Study: Northwestern Lehigh School District

Catherine Venusto allegedly manipulated the grade records of both her daughter and son while they attended Northwestern Lehigh School District. In 2010, while employed as an administrative office secretary, Venusto allegedly replaced a failing grade with a medical M grade. Access to the online grade book was accomplished by masquerading with the stolen network credentials of the superintendent. After having left her employment had ended, Venusto allegedly continued to utilize the stolen credentials to modify the grade of her son in 2012. The accused modification of the son’s grade could have been prevented through periodic password expiration policies (Lupkin, 2012).

Case Study: Temple University

In a more technically savvy attack, college student Edwin Kim accessed the electronic grade book of Temple University. A keylogger was installed by Kim on administrative office’s university computer to collect the credentials of professors that used the targeted system. Later, the keylogger was removed and cleaned up by Kim who was then left in the possession of his professors account information. Kim’s modifications were caught when his professors noticed the discrepancies by his changes. Kim himself was caught because the grade system logs were used to trace his connection sessions back to his workplace and home (Gibbons, 2012).

Case Study: Palos Verdes High School

Rounding out the vulnerabilities to be addressed, Palos Verdes High School fellow victim to a three student team which targeted the physical security as their main vulnerability. The teenagers, unnamed by Altman (2012), broke into the school under cover of night to steal tests and install hardware keyloggers on their teachers machines. During subsequent break-ins, the keyloggers were collected and analyzed to extract their teachers credentials. This information was used to access the grading system and boost the intruders’ grades (Altman, 2012).

---

Altman, L. (January 26, 2012). 3 Palos Verdes High students arrested in grade-tampering plot. DailyBreeze.com. Retrieved from: http://www.dailybreeze.com/latestnews/ci_19829634

Gibbons, M. (February 8, 2012). Bucks college student fails in attempt at an easy A. phillyBurbs.com Retrieved from: http://www.phillyburbs.com/news/crime/bucks-college-student-fails-in-attempt-at-an-easy-a/article_175726b7-b2c5-56ce-93ab-bbfb6abddcc4.html

Lupkin, S. (July 19, 2012). Mom Arrested For Hacking School Computers to Change Kids' Grades. abc News. Retrieved from: http://abcnews.go.com/US/mom-charged-hacking-school-computers-change-childrens-grades/story?id=16812838#.UKhiZoevuIM

Preventing Damage by Preventing Grade System Intrusions: Introduction

Grades are important and so manipulating grades is valuable. Manual management of the recording, computing, weighting, and totaling of an individual students grades, not to mention an entire course and even an entire semester, is extremely tedious and error prone (Migliorino & Maiden, 2004). Automated grade management systems relieve educators from many of these burdens and can even provide easy access anywhere through powerful web applications (Thinkwave, 2012). Where problems arise is when the electronic grade book falls prey to unauthorized access or, worse, modification.

Being stored electronically on a network leaves the grades subject to remote manipulation. Those manipulable grades become a target to challenge hackers, to tempt cheaters, and to profit crackers. Controlling and shaping the rankings of a class of students feeds directly into the desire for power that is a commonly self-reported motivation to hackers (Campbell & Kennedy, 2010). Cheaters gain direct academic boosts by inflating their own grades, as is covered in case studies below. Grade manipulation is a marketable good, as crackers can be paid to modify the customers’ or a third parties records.

---

Campbell, Q., & Kennedy, D.M. (2009). The psychology of computer criminals. In Bosworth, et al (Eds.), Computer security handbook. New York, NY: John Wiley & Sons.

Migliorino, N. J., & Maiden, J. (2004). Educator Attitudes Toward Electronic Grading Software. Journal Of Research On Technology In Education, 36(3), 193-212.

Thinkwave. (2012). Free Online Gradebook. Retrieved from: http://www.thinkwave.com/educator.html

Preventing Damage by Preventing Grade System Intrusions: Actors

Simplistically, those who would access, without authorization, a grade management system could be labeled as hackers or crackers. These two groups, according to Dittrich and Himma (2006), are computer users who engage in unauthorized system accesses; though they are differentiated by motivation. Where hackers are driven by arguably noble or ethically neutral purposes, crackers are driven by malice or profit. Describing possible manipulators in the introduction, the author separated out a subset of crackers as cheaters. This paper will be discussing crackers as intruders driven by malice or financial profit and cheaters as driven by academic profit.

When the target is an education institution’s grading system, the pool of potential hackers, crackers, and cheaters draws primarily from stakeholders relating to the grades stored in the specific target system. (Altman, 2012; Borja, 2006; Gibbons, 2012; Lupkin, 2012) Stakeholders are not limited to the grade-holding students but also can include relatives or contracted third parties.

---

Altman, L. (January 26, 2012). 3 Palos Verdes High students arrested in grade-tampering plot. DailyBreeze.com. Retrieved from: http://www.dailybreeze.com/latestnews/ci_19829634

Borja, R. R. (2006). Cyber-Security Concerns Mount as Student Hacking Hits Schools: Districts Straining to Safeguard Online Networks. Education Week, 25(19), 1,.

Dittrich, D., & Himma, K. E. (2006). Hackers, Crackers, and Computer Criminals. Bidgoli, Hossein: Handbook of information security-Information warfare; social, legal and international issues, 154-171.

Gibbons, M. (February 8, 2012). Bucks college student fails in attempt at an easy A. phillyBurbs.com Retrieved from: http://www.phillyburbs.com/news/crime/bucks-college-student-fails-in-attempt-at-an-easy-a/article_175726b7-b2c5-56ce-93ab-bbfb6abddcc4.html

Lupkin, S. (July 19, 2012). Mom Arrested For Hacking School Computers to Change Kids' Grades. abc News. Retrieved from: http://abcnews.go.com/US/mom-charged-hacking-school-computers-change-childrens-grades/story?id=16812838#.UKhiZoevuIM

Intruding because they can

Curiosity, intellectual challenge, boredom; these are factors that motivate exceptional technical minds to delve into the ethically grey area of non-malicious cyber intrusions (Dittrich & Himma, 2006). Those exceptional minds tend to fall into the category of gifted students whom schools have difficulties providing appropriate challenges (Gallagher & And, 1997). Stemming from the difficulty of challenging these students is that they, according to Gallagher and And (1997), perceive their courses to be “a crushing bore.”

Combining all three elements, brilliant minds, boredom, and a ready made challenge to puzzle out, provides an ideal situation for student hackers to target the grading system. Behind that technical wall is a collection of information pertaining to their peers, which has the ability to appeal to the bored student’s non-technical curiosity. Just like cyber convict Adrian Lamos attributing his corporate network jaunts to looking for a relief to boredom, the students may try to just look around the grade system (Dittrich & Himma, 2006).

---

Dittrich, D., & Himma, K. E. (2006). Hackers, Crackers, and Computer Criminals. Bidgoli, Hossein: Handbook of information security-Information warfare; social, legal and international issues, 154-171.

Gallagher, J., & And, O. (1997). Challenge or Boredom? Gifted Students' Views on Their Schooling. Roeper Review, 19(3), 132-36.

Just Trying to Get Ahead

Secondary and collegiate schools both have had issues with electronic grade book modifications. The above described cheaters are the intruders which target the systems for academic advancement. Grades to be modified can be their own or their rivals, but the end goal is improvement of their relative standing. Additionally, there are instances of relatives who accessed and modified recorded grades to the benefit of the student whose grades were targeted (Lupkin, 2012).

---

Cheaters motivation to modify, or to have modified, their grades stems from the importance placed on the values and the impact which they have on the participants future. Moore (2006) writes about the weight that high school grade point average (GPA) have on admissions decisions for incoming college freshmen. Thus, but inflating their GPA, cheaters are able to qualify for more desirable post-high school opportunities. Again in 2006, Moore addresses the fact that GPA admission requirements do not always go away in college, but that professional colleges often have GPA standards that must be met to enroll in junior- and senior-level courses.

---

Lupkin, S. (July 19, 2012). Mom Arrested For Hacking School Computers to Change Kids' Grades. abc News. Retrieved from: http://abcnews.go.com/US/mom-charged-hacking-school-computers-change-childrens-grades/story?id=16812838#.UKhiZoevuIM

Moore, W. K. (2006). Advising Students about Required Grade-Point Averages. NACADA Journal, 26(2), 39-47

Preventing Damage by Preventing Grade System Intrusions: Defense

Successful defense against grade book intrusions requires identification of both the motivation of the attackers and the attack vector utilized. Addressing only the motivation results in the exploited vulnerability to still exist for future attackers, whereas addressed only the vulnerability means that the mind which worked out the known attack is just going to keep looking for other ways in.

Mitigating an insider threat

Topic - One of the biggest risks that companies face is advanced persistent threats. Discuss the most effective way to implement policies that mitigate the chance of an insider either taking part in or facilitating an advanced persistent threat. Integrate the concept of separation of duties into your discussion.

Separation of duties requires that there be limits on access and checks on actions. When one person is responsible for overseeing their own work then there is not any oversight. A failure to sufficiently implement this principle fails to prevent a situation such that “a single individual cannot subvert a critical process”(Swanson & Guttman, 1996, p 27).

In the event that an inside actor has the ability to avoid or compromise procedural safeguards, they have a great deal of power to impact any of the three major security traits: confidentiality, integrity, or availability. Kabay and Robertson tell about a disgruntled system administrator that resigned from UBS Paine Webber, but before he left he released a malicious logic bomb of his creation (2002). Since the malicious code deleted files and generally caused chaos in the network, it damaged both the integrity of the data on the network and interfered with the availability of the systems it disrupted.

Such an attack could have been entirely prevented if the saboteur had his accesses properly compartmentalized with mandatory oversight. Disallowing him the ability to both generate code and to release it onto the production systems would have forced an accomplice to be involved, or stolen credentials. Gregg et al recommend not even having compilers available on production systems, which prevent the creation of low level malware on them. (2012) This is not a perfect protection by a long stretch because interpreted scripting languages, like Python, Perl, or Bash, can be used to create malicious scripts directly on the live systems.

---

Gregg, J., Nam, M., Northcutt, S. & Pokladnik, M. (May 5th, 2012) Separation of Duties in Information Technology. Sans Security Laboratory. Retrieved from http://www.sans.edu/research/security-laboratory/article/it-separation-duties

Kabay, M. E. & Robertson, B. (2002). Employment Practices and Policies. In Bosworth et al (Eds.), Computer security handbook. New York, NY: John Wiley & Sons, Inc.

Swanson, M., & Guttman, B. (1996). Generally accepted principles and practices for securing information technology systems (pp. 800-14).

Airline Cybersecurity

Personal post written to the class. I had posted this because I felt it needed sharing, so I am saving it here too. From February 16, 2012.
Here is the paper for which this was research.

Well, today I learned that an important thing for airline cybersecurity is that a cyber-threat tipline needs to be available.

I was looking at airport websites as research and discovered a SQL Injection into an upcoming flights database. Upon verifying and documenting the vunerability, I went looking for a contact that I should send my report to and the only thing I could find was a minor TSA contact email. I ended up on the phone with a low level police information desk person and sent the report to both him and the TSA email, hoping it finds its way to the people that need the report.

The police information desk was definately not the best person to be talking to and I had to back pedel and re-explain that I was a Cybersecurity student after he asked, in a very accusing tone, "Are you a hacker?" Does he regularly have black hats calling him to report vulnerabilities? It was an Airport Police (Information / Assistance) number available on the state aviation administration contact page. I tried.

I don't have much faith in the TSA email either as I got back an auto generated response that implied that most of their incoming email is about what can and can't be carried onto a plane.

Matthew

---

Update: The airport in question has replaced the page in question, so this vulnerability has been corrected.

Think like a Hacker

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic – Think like a Hacker
Select an e-business. Thinking like a hacker, describe a hypothetical scenario on how you go about breaking into their system and acquire assets.
Next, describe how the attack could have been prevented.
From March 16, 2012.

I enjoy music, especially when I can get it cheap, like from iTunes or the Amazon Cloud.

First, I will select a busy area with free wi-fi, like a Starbucks at lunch time. (Starbucks, 2011) Next, use a tool like Arpspoof to establish a man-in-the-middle session with each user attached to the network by pretending to be the network gateway. (Arpspoof) I monitor traffic for email addresses, especially email addresses used as logins and the associated password. Any email addresses I get will be sent phishing emails with attached document exploits to install keyloggers that call back to a server I have set up. Any email, password pairs will be used to attempt to log into various services. I will use a script to test the pair against numerous social networking sites like Facebook, MySpace, Linkedin and others. Successful access will be used to spread my keyloggers. I will continue this pattern until I net an email, password pair that successfully log into either iTunes or the Amazon Cloud. Once successful, I will use the access to download all the purchased music on the account. If there is an outstanding balance on the account, I will buy digital goods with it and download that too. All direct access to the victim business will be performed through a proxy, probably one of the machines I am keylogging.

This type of attacker would be considered a "Script kiddy" as it requires little to no direct technical knowledge and can just use tools downloaded off the internet. (Vacca, 2009, p 296). It can easily be protected against by not utilizing unsecured wireless networks, especially public ones and by not reusing passwords. It can be protected against, somewhat, by the victim company by not using email addresses as the user name, which both Amazon and iTunes do. Anything further the company could do to protect against this will interfere with the ease of use of the site, which makes users less likely to choose their service.

---

Arpspoof retrieved from http://arpspoof.sourceforge.net/

Starbucks. (2011) Wi-Fi(United States) Retrieved from http://www.starbucks.com/coffeehouse/wireless-internet

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufmann.

Think like an Industrial Spy

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic – Think like an Industrial Spy
Select a company. Thinking like a industrial spy, describe a hypothetical scenario on how you go about attacking their system and acquiring intellectual property.
Next, describe how the attack could have been prevented.
From March 15, 2012.

Wanting to steal intellectual property, I would search for a high gain, low effort target. Small businesses which do R&D seem like good targets to meet this criteria, since their business model relies on developing intellectual property yet they do not have the employees or likely the budget to perform extensive cybersecurity. To select my target, I read about the Small Business Innovation Research, SBIA, Program which provides grants from the Small Business Administration to companies that meet the following criteria: American-owned and independently operated, For-profit, Principal researcher employed by business, Company size limited to 500 employees. Their criteria for giving grants lines up perfectly with my criteria for targets, and their list of recipients is public record. (SBA)

I able to find a list of FY2011 recipients of the SBIR awards from the Environmental Protection Agency with a breakdown of recipients by environmental category of research. I decided to select a company whose category of research was Homeland Security and so I selected Operational Technologies Corporation of San Antonio, Texas. (EPA, 2012)

To collect intellectual property, I need access to their network. The first step after choosing the company is some minor reconnaissance that is checking over their website. There is a Contact Us page with direct email addresses and names for three employees as well as an information email. The direct person contacts will be the best for a well crafted phish, but the info email has the benefit of having a very small chance of being opened outside of the company network. (OTCorp, 2008)

To gain my actual access I will use Metasploit to craft malicious doc and pdf files containing Poison Ivy RAT payloads. (Vacca, 2009, p 55) Once the documents are opened on a vulnerable computer, the remote administration tool is dropped and executed and it calls back to the server I set up. Once that connection is established, I can browse the internal network at my leisure using the full control of the target system that the Poison Ivy gives me. (Codius, 2007)

This attack could have been prevented by intensive scanning of emailed documents and also by using hard to target workstations. The exploits I would be using are targeting Microsoft Office and Adobe Reader on Windows. If alternative software like FoxIt Reader and Openoffice were used then the exploits would fail to land. Likewise, Linux or Mac workstations would prevent the attack too.

---

Codius. (2007) Poison Ivy Remote Administration Tool Retrieved from http://www.poisonivy-rat.com/index.php?link=dev

EPA. (2012) Small Business Innovative Research:FY11 Awards: Full List Retrieved from http://cfpub.epa.gov/ncer_abstracts/index.cfm/fuseaction/outlinks.sbir/fullList/Yes/showYear/current

OTCorp. (2008) Contact Us Retrieved from http://www.otcorp.com/home/index.php?option=com_content&task=view&id=19&Itemid=34

SBA. Small Business Innovation Research Program Retrieved from http://www.sba.gov/content/small-business-innovation-research-program-sbir-0

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufmann.

Thinking like a criminal...

Tonight I will be publishing two archive posts from my previous course: Think like an Industrial Spy and Think like a Hacker.

I am very proud of how these posts turned out, but they are well thought out briefs on engaging in cyber crime. A small part of me is leary of posting them publicly unredacted, but I will be. The bigger part of me keeps remembering that those likely to perform a crime like the ones I describe are also as likely to already know what I posted about.

The people that my posts will be most interesting to are the ignorant innocents whom are likely to be the targets. The table below will contain direct links to both posts. Enjoy!

Thinking like a criminal...
Think like an Industrial Spy
Think like a Hacker

Cyberspace and Cybersecurity: Archive Post 3

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic - Network Security Best Practices
Discuss the best practices for securing wired and/or wireless networks.
From February 24, 2012.

The best practice in securing a wired network is to properly identify and authenticate users, and the way to do so properly is through multi factor authentication. The traditional factor used for authenticating users in most networks is through the use of a password or passcode, this is an instance of something that the user knows. Other factors that can be used is something that the user is, that is a biometric feature like retinal image or fingerprint, or something that the user has, like a magnetic card or even a physical key. "Authentication methods that depend on more than one factor are more difficult to compromise than single-factor methods. Accordingly, properly designed and implemented multi factor authentication methods are more reliable and stronger fraud deterrents" (Wihenly, 2005, pg 3).

At present, a common and cost-effective method of implementing two factor authentication remotely is through a combination of password and a "hardware token-generated random PIN" (Vacca, 2009, pg 139) which demonstrates possession of the token generating hardware.

The hardware token PINs are used alongside the username and password combination to log into a secure system or VPN, with the user submitting the PIN that is shown on their token at the time of login. The appropriate PIN for the username is generated by the server and compared to the submission to confirm that the user possesses the required token. (RSA, 2010)

This method of two factor authentication is only effective as long as the seed information to each token is kept secret. If an attacker is able to steal the seed information, they can generate the appropriate PIN the same way that the server does. An example of this was demonstrated when the spoils of an intrusion against RSA was used to compromise Lockheed Martin. (Drew & Markoff, 2011)

---

Wihenly, (2005). Authentication in an Internet Banking Environment. Retrieved from http://www.ffiec.gov/pdf/authentication_guidance.pdf

Vacca, J. R. (2009). Computer and information security handbook. Burlington, MA: Morgan Kaufmann.

RSA. (2010). RSA SecureID Two-factor Authentication. Retrieved from https://www.rsa.com/products/securid/sb/10695_SIDTFA_SB_0210.pdf

Drew, C. & Markoff, J. (2011) Data Breach at Security Firm Linked to Attack on Lockheed. Retrieved from https://www.nytimes.com/2011/05/28/business/28hack.html?_r=1

Week 1 Graded submission, part 3

This question requires a little background. Adagia Telecom is a fictional company that on the launch day of a much hyped value-add web service they had severe network problems and the launch fully flopped. Server logs looked at after the fact suggest a DDoS attack.

Topic – How would compliance have prevented the attack against Adagia Telecom? Should Adagia report this attack to law enforcement? Why or Why not? If the crime is reported, what challenges might law enforcement have in finding the perpetrator and prosecuting the case?

As the initial question of the topic is vague and relies on a prior understanding of compliance, I am first going to address what it is. According to page 22 in UMUC, compliance centers around having a solid set of administrative controls regulating process and defining who has specific responsibilities related to said controls. Relevant to the Adagia situation are the controls of solid training and procedures and responsibilities of risk determination and the creation of appropriate procedures.

Successful effective compliance in instances of the stated examples could have helped reduce or even eliminate the impact that the alleged distributed denial of service (DDoS) caused. With appropriate levels of training about system defense and scalability, the system administrators could have identified the beginning of the incoming DDoS and reacted effectively. Proper training and established procedures in preparation for this contingency could have possibly resulted in the administrators engaging is successful congestion control and packet filtering. (Xiang, 2006, p 560) Such preparation and creation of the requisite procedures are not possible if the system’s risks were not effectively identified, though.

Adagia should notify the FBI and share their logs, if for no other reason than to provide law enforcement visibility into the fact that the attack occurred. Criminal DDoS attacks typically consist of an attacker controlling large numbers of compromised computers, with those systems being the ones actually communicating with the victim. This indirection, especially combined with intentional anonymizing actions the attack may use like proxies, means that an after the fact investigation is unlikely to lead back to the source attacker. Even if law enforcement is able to locate the system, there could be significant legal roadblocks before prosecution, like jurisdiction issues and an inability to connect the attacking system with the attacking user.

Matthew

UMUC (2010). Human Aspects in Cybersecurity: Ethics, Legal Issues, and Psychology. Retrieved 26 September 2012 from: http://tychousa9.umuc.edu/CSEC620/1102/csec620_01/assets/csec620_01.pdf

Xiang Y., Zhou W., (2006) "Protecting web applications from DDoS attacks by an active distributed defense system", International Journal of Web Information Systems, Vol. 2 Iss: 1, pp.37 - 44 Retrieved 26 September 2012 from: http://research.mercubuana.ac.id/proceeding/iiWAS2004(586-595).pdf

Week 1 Graded submission, part 1

Topic - Many cyber security professionals believe the likely application of ‘cyber terrorism’ to be an asymmetric attack against some portion of this nation’s critical infrastructure. Which critical infrastructure do you think to be a likely target and why? Who should be responsible for protecting that infrastructure and why? Would this vary based on who the attacker is – if it is a state actor, a non-government organization, or an individual?

The electric grid is a very visible target and the loss of it is very noticeable. Just this past summer those of us in Maryland got to experience a (natural) disruption to the grid. No air conditioning, no lights, no traffic lights (come on, Maryland. No traffic light means a four way stop, not ‘Ehmagawd!’) and no refrigeration. Obviously an attack on the grid is significant.

An attack on the grid is even possible, at least for those well funded shops that can afford to spend the time and manpower to research industrial equipment. Critical infrastructure has been under assault since before late 2010 when Fleming reported on Stuxnet sabotaging Iranian centrifuges.(2010) The worm is reported to target Siemens SCADA (supervisory control and data acquisition) systems. A look at job postings for Baltimore Gas and Electric (BGE) shows that they use SCADA systems, “...integration of the various BGE Supervisory Control and Data Acquisition (SCADA) systems such ...” (BGE, 2011) If Iranian SCADA systems are targetable, it stands to reason our electric grid ones could be to.

Who should be responsible for protection is a complicated issue. As our utilities are run by private companies, the current responsibility falls to the utility companies to protect their infrastructure. They have to protect their infrastructure because it is protecting their investment and their bottom line profitability. On the other hand, a disruption of the electric grid may hurt the utility company’s bottom line, but it literally means life and death for the diabetic customer that needs to keep their insulin refrigerated during a heatwave. When it comes to protecting the general populace from bodily injury and death, that responsibility falls to the government. Outsourcing the security concerns to DHS though would provide such a budgetary windfall to the utilities though that the reasonable next step would be full government control over the utility in question. That option is rarely considered a good idea with the US population.

Since an interruption of power would be so devastatingly disruptive, it would most definitely be a target for a military, or nation state organization supporting the military, to attack as an immediate lead-up to a kinetic action.

If the goal was to just be human death, which is the likely goal of an infrastructure attack from an independent actor or organization, then [thoughts on a specific way that cyber mass murder could be possible]. If, like Stuxnet, the compromises also affected the monitoring reports, then it wouldn’t get caught until the first few victims showed symptoms. Which would be far too late for many others. (Fleming, 2010)

Matthew

BGE (June, 7 2011) BGE Job Descriptions. Retrieved 26 September 2012 from: http://www.bge.com/myaccount/billsrates/ratestariffs/Documents/BGEJobDescriptions.pdf

Fleming, R. (December 2, 2010). Bits before bombs: How Stuxnet crippled Iran’s nuclear dreams. Retrieved 26 September 2012 from: http://www.digitaltrends.com/computing/bits-before-bombs-how-stuxnet-crippled-irans-nuclear-dreams/