This preview shows page 1. Sign up to view the full content.
Unformatted text preview: en a well-kno wn series o f hacker co nventio ns kno wn as the
Black Hat co nf erence. K E Y TAK E AWAYS
Computer security threats have moved beyond the curious teen with a PC and are now sourced
from a number of motivations, including theft, leveraging compromised computing assets,
extortion, espionage, warfare, terrorism, pranks, protest, and revenge.
Threats can come from both within the firm as well as from the outside.
Cybercriminals operate in an increasingly sophisticated ecosystem where data harvesters and
tool peddlers leverage sophisticated online markets to sell to cash‐out fraudsters and other
Technical and legal complexity make pursuit and prosecution difficult.
Many law enforcement agencies are underfunded, underresourced, and underskilled to deal
with the growing hacker threat. QU E S TI ONS AND E XE RC I S E S
1. What is a botnet? What sorts of exploits would use a botnet? Why would a botnet be useful to
2. Why are threats to the power grid potentially so concerning? What are the implications of
power‐grid failure and of property damage? Who might execute these kinds of attacks? What are the implications for firms and governments planning for the possibility of cyberwarfare and
3. Scan the trade press for examples of hacking that apply to the various motivations mentioned in
this chapter. What happened to the hacker? Were they caught? What penalties do they face?
4. Why do cybercriminals execute attacks across national borders? What are the implications for
pursuit, prosecution, and law enforcement?
5. Why do law enforcement agencies struggle to cope with computer crime?
6. A single rogue employee effectively held the city of San Francisco’s network hostage for ten
days. What processes or controls might the city have created that could have prevented this
kind of situation from taking place?
7. The Geneva Conventions are a set of international treaties that in part set standards for
protecting citiz ens in and around a war z one. Should we have similar rules that set the limits of
cyberwarfare? Would such limits even be effective? Why or why not?
8. What does the rise of cyberwarfare suggest for businesses and organiz ations? What sorts of
contingencies should firms consider and possibly prepare for? How might considerations also
impact a firm’s partners, customers, and suppliers? 13.3 Where Are Vulnerabilities? Understanding the
L E A RN I N G OBJ E C T I V E S
1. Recogniz e the potential entry points for security compromise.
2. Understand infiltration techniques such as social engineering, phishing, malware, Web site
compromises (such as SQL injection), and more.
3. I dentify various methods and techniques to thwart infiltration. Figure 1 3. 1 This diagram s hows only s ome of t he p ot ent ial weaknes s es t hat can comp romis e t he s ecurit y of an
organizat ion’ s informat ion s ys t ems . Every p hys ical or net work “t ouch p oint ” is a p ot ent ial
vulnerabilit y. Unders t anding whereweaknes s es may ex is t is a vit al s t ep t oward imp roved s ecurit y. Source: ht t p ://office. micros oft . com/enus /clip art /default . as p x Mo dern inf o rmatio n systems have lo ts o f interrelated co mpo nents and if o ne o f these co mpo nents
f ails, there might be a way in to the go o dies. This creates a large attack surf ace f o r po tential
inf iltratio n and co mpro mise, as well as o ne that is simply vulnerable to unintentio nal damage and
disruptio n. User and Administrator Threats
While so me o f the mo re sensatio nal explo its invo lve criminal gangs, research f irm Gartner
estimates that 70 percent o f lo ss-causing security incidents invo lve insiders.J. Mardesich,
“Ensuring the Security o f Sto red Data,” CIO Strategy Center, 2009. Ro gue emplo yees can steal
secrets, install malware, o r ho ld a f irm ho stage. Check pro cessing f irm Fidelity Natio nal Inf o rmatio n Services was betrayed when o ne o f its database administrato rs lif ted perso nal reco rds
o n 2.3 millio n o f the f irm’s custo mers and illegally so ld them to direct marketers. And it’s no t just f irm emplo yees. Many f irms hire tempo rary staf f ers, co ntract emplo yees, o r
o utso urce key co mpo nents o f their inf rastructure. Other f irms have been co mpro mised by
members o f their cleaning o r security staf f . A co ntract emplo yee wo rking at Sentry Insurance sto le
inf o rmatio n o n 110,000 o f the f irm’s clients.J. Vijayan, “So f tware Co nsultant Who Sto le Data o n
110,000 P eo ple Gets Five-Year Sentence,” Co mputerw o rld, July 10, 2007. Social Engineering
As P . T. Barnum is repo rted to have said, “There’s a sucker bo rn every minute.” Co n games that
trick emplo yees into revealing inf o rmatio n o r perf o rming o ther tasks that co mpro mise a f irm are
kno wn as so cial engineering in security circles. In so me ways, cro o ks have never had easier access
to backgro und inf o rmatio n that might be u...
View Full Document
This document was uploaded on 01/31/2014.
- Winter '14