Chapter 13

Info iconThis preview shows page 1. Sign up to view the full content.

View Full Document Right Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: en a well-kno wn series o f hacker co nventio ns kno wn as the Black Hat co nf erence. K E Y TAK E AWAYS Computer security threats have moved beyond the curious teen with a PC and are now sourced from a number of motivations, including theft, leveraging compromised computing assets, extortion, espionage, warfare, terrorism, pranks, protest, and revenge. Threats can come from both within the firm as well as from the outside. Cybercriminals operate in an increasingly sophisticated ecosystem where data harvesters and tool peddlers leverage sophisticated online markets to sell to cash‐out fraudsters and other crooks. Technical and legal complexity make pursuit and prosecution difficult. Many law enforcement agencies are underfunded, underresourced, and underskilled to deal with the growing hacker threat. QU E S TI ONS AND E XE RC I S E S 1. What is a botnet? What sorts of exploits would use a botnet? Why would a botnet be useful to cybercriminals? 2. Why are threats to the power grid potentially so concerning? What are the implications of power‐grid failure and of property damage? Who might execute these kinds of attacks? What are the implications for firms and governments planning for the possibility of cyberwarfare and cyberterror? 3. Scan the trade press for examples of hacking that apply to the various motivations mentioned in this chapter. What happened to the hacker? Were they caught? What penalties do they face? 4. Why do cybercriminals execute attacks across national borders? What are the implications for pursuit, prosecution, and law enforcement? 5. Why do law enforcement agencies struggle to cope with computer crime? 6. A single rogue employee effectively held the city of San Francisco’s network hostage for ten days. What processes or controls might the city have created that could have prevented this kind of situation from taking place? 7. The Geneva Conventions are a set of international treaties that in part set standards for protecting citiz ens in and around a war z one. Should we have similar rules that set the limits of cyberwarfare? Would such limits even be effective? Why or why not? 8. What does the rise of cyberwarfare suggest for businesses and organiz ations? What sorts of contingencies should firms consider and possibly prepare for? How might considerations also impact a firm’s partners, customers, and suppliers? 13.3 Where Are Vulnerabilities? Understanding the Weaknesses L E A RN I N G OBJ E C T I V E S 1. Recogniz e the potential entry points for security compromise. 2. Understand infiltration techniques such as social engineering, phishing, malware, Web site compromises (such as SQL injection), and more. 3. I dentify various methods and techniques to thwart infiltration. Figure 1 3. 1 This diagram s hows only s ome of t he p ot ent ial weaknes s es t hat can comp romis e t he s ecurit y of an organizat ion’ s informat ion s ys t ems . Every p hys ical or net work “t ouch p oint ” is a p ot ent ial vulnerabilit y. Unders t anding whereweaknes s es may ex is t is a vit al s t ep t oward imp roved s ecurit y. Source: ht t p ://office. micros oft . com/en­us /clip art /default . as p x Mo dern inf o rmatio n systems have lo ts o f interrelated co mpo nents and if o ne o f these co mpo nents f ails, there might be a way in to the go o dies. This creates a large attack surf ace f o r po tential inf iltratio n and co mpro mise, as well as o ne that is simply vulnerable to unintentio nal damage and disruptio n. User and Administrator Threats Bad Apples While so me o f the mo re sensatio nal explo its invo lve criminal gangs, research f irm Gartner estimates that 70 percent o f lo ss-causing security incidents invo lve insiders.J. Mardesich, “Ensuring the Security o f Sto red Data,” CIO Strategy Center, 2009. Ro gue emplo yees can steal secrets, install malware, o r ho ld a f irm ho stage. Check pro cessing f irm Fidelity Natio nal Inf o rmatio n Services was betrayed when o ne o f its database administrato rs lif ted perso nal reco rds o n 2.3 millio n o f the f irm’s custo mers and illegally so ld them to direct marketers. And it’s no t just f irm emplo yees. Many f irms hire tempo rary staf f ers, co ntract emplo yees, o r o utso urce key co mpo nents o f their inf rastructure. Other f irms have been co mpro mised by members o f their cleaning o r security staf f . A co ntract emplo yee wo rking at Sentry Insurance sto le inf o rmatio n o n 110,000 o f the f irm’s clients.J. Vijayan, “So f tware Co nsultant Who Sto le Data o n 110,000 P eo ple Gets Five-Year Sentence,” Co mputerw o rld, July 10, 2007. Social Engineering As P . T. Barnum is repo rted to have said, “There’s a sucker bo rn every minute.” Co n games that trick emplo yees into revealing inf o rmatio n o r perf o rming o ther tasks that co mpro mise a f irm are kno wn as so cial engineering in security circles. In so me ways, cro o ks have never had easier access to backgro und inf o rmatio n that might be u...
View Full Document

This document was uploaded on 01/31/2014.

Ask a homework question - tutors are online