jvcomaha

Slide1 : Cyber Threat to Critical Infrastructure Special Agent Jim Christy (AFOSI) Law Enforcement & Counterintelligence Coordinator Defense-Wide Information Assurance Program Assistant Secretary of Defense Command, Control, Communications, and Intelligence (ASDC3I)


Slide2 : Overview - Crime Vs InfoWar - Legal Issues - Senate Hearings - Senate InfoSec Survey - Y2K Crisis - Cyber Intrusion Incident Response


Slide3 : DEPSECDEF CIO Council Director, Information Assurance Mr. Richard C. Schaeffer, Jr. National Manager Lt Gen Kenneth H. Minihan NSD-42 SECDEF DoD CIO Mr. Arthur L. Money DII Advisor LTG David A. Kelley DIAP Staff Director CAPT J. Katharine Burton, USN Services Joint Staff DISA NSA Other Defense Agencies Senior DIAP Steering Group Program Planning, Coordination, and Integration DIAP


Slide4 : Crime vs. InfoWar - The Legal Issues - Who is Perpetrator? - Criminal? Terrorist? State-Sponsored Terrorist? State? - Where is the Perpetrator? - US? International Waters/Airspace? Third Country? State of Perpetrator? - What is the Impact on the U.S.? Minor Disruption Damage to National Security - Who Should Respond (Stop the Attack)? - LE? Host Country? U.S. Military?


Slide5 : Perpetrator Location U.S. Impact Right to Respond *Criminal *Terrorist * State Sponsored Terrorist *State U.S International 3rd Party State Water/Air Country Minor Economic Minor Economic Major Economic Major Economic Damage to comms disruption comms disruption comms disruption comms disruption National with loss of life with loss of life Security U.S. Law Enforcement Host Country or Flag State Law Enforcement U.S. Military


Slide6 : Perpetrator Location U.S. Impact Right to Respond *Criminal *Terrorist * State Sponsored Terrorist *State U.S International 3rd Party State Water/Air Country Minor Economic Minor Economic Major Economic Major Economic Damage to comms disruption comms disruption comms disruption comms disruption National with loss of life with loss of life Security U.S. Law Enforcement Host Country or Flag State Law Enforcement U.S. Military U.S. Military if DOJ/FBI Cert & Pres Exec Order


Slide7 : Perpetrator Location U.S. Impact Right to Respond *Criminal *Terrorist * State Sponsored Terrorist *State U.S International 3rd Party State Water/Air Country Minor Economic Minor Economic Major Economic Major Economic Damage to comms disruption comms disruption comms disruption comms disruption National with loss of life with loss of life Security U.S. Law Enforcement Host Country or Flag State Law Enforcement U.S. Military if DOJ/FBI Cert & Pres Exec Order


Slide8 : Perpetrator Location U.S. Impact Right to Respond *Criminal *Terrorist * State Sponsored Terrorist *State U.S International 3rd Party State Water/Air Country Minor Economic Minor Economic Major Economic Major Economic Damage to comms disruption comms disruption comms disruption comms disruption National with loss of life with loss of life Security U.S. Law Enforcement Host Country or Flag State Law Enforcement U.S. Military W/NCA Permission


Slide9 : Host Country or Flag State Law Enforcement Perpetrator Location U.S. Impact Right to Respond *Criminal *Terrorist * State Sponsored Terrorist *State U.S International 3rd Party State Water/Air Country Minor Economic Minor Economic Major Economic Major Economic Damage to comms disruption comms disruption comms disruption comms disruption National with loss of life with loss of life Security U.S. Law Enforcement U.S. Military W/NCA Permission


Slide10 : Facts - We Will Face Competent Adversary - We Won’t Know the Perpetrator - We Won’t Know the Location of the Perpetrator - Law Enforcement Will Always Have Primary Jurisdiction Until Perpetrator & Location are Determined


Slide11 : Need to Prepare - New Adversaries - Virtual Organizations - Non-Traditional Threats


Slide12 : Number of Actual Incidents InfoWar Attacks Cyber Terrorism Attacks Criminal Incidents


Slide13 : Resources & Expertise


Slide14 : Resources & Expertise Law Enforcement & Counterintelligence DoD CERTS, CIA, DIA, J2, NSA InfoWar Centers


Slide15 : Assumptions - Intelligence Community Restricted in U.S. - The Vast Majority of Attacks Will Involve U.S. Systems (Civilian/Non-Gov) - Every Intrusion is a Crime - Over 95% DOD Information over PSN - Imperative to Trace Attacks Back to Source


Slide16 : Attack Profile - Will Probably Look Like Multiple Unrelated Incidents (All Criminal Incidents) Initially - Will Probably Attack Civilian Infrastructure, Not DOD - 20th Century Fox Project - “WorldWar3.com” - Launched from US or Allied Country


Slide17 : Opposite of Nuclear Attack


Slide18 : Opposite of Nuclear Attack


Slide19 : Criminal Violations: - 18 USC 1029, Access Device Fraud - 18 USC 1030, Computer Fraud Act - 18 USC 2511, Interception & Disclosure of Wire, Oral or Electronic Communication - 18 USC 2701, Stored Wire & Communication Access


Slide20 : Criminal Violations (cont’d): - 18 USC 785 - Threats - 18 USC 1343 - Wire Fraud - 18 USC 1363 - Malicious Mischief - 18 USC 1462 - Import of Obscene Matter - 18 USC 1465 - Transport of Obscene Matter - 18 USC 2252 - Sexual Exploitation of Minors - 18 USC 2314 - Transport of Stolen Property


Slide21 : Criminal Violations (cont’d): - 18 USC 2319 - Copyright Infringement - 18 USC 2320 - Trademark Goods - 18 USC 2510 thru 2521 - Wiretaps - 18 USC 2701 thru 2711 - Stored Electronic Comm - 18 USC 3121 - Pen Registers - 17 USC 506 - Copyright Infringement - 42 USC 2000aa - Privacy Protection


Slide22 : The Problem “18th Century Law & 20th Century Technology” Col. Bob Giovagnoni AFOSI, JA 1996


Slide23 : The First Problem Speed Counts!


Slide24 : The Second Problem The Legal Environment is Geo-Centric


Slide25 : The Law - Criminal Law - Law Dealing with Crime & Punishment - Procedural Law - Legal Procedures Required of a Law Enforcement Official for the Commencement of Legal Proceedings


Slide26 : Criminal Law - What is a Crime - What is Against the Law i.e. Rape, Murder, Fraud, Computer Intrusions, Narcotics Trafficking, etc..


Slide27 : Procedural Law - How to Collect Evidence - Wire Tap Court Orders - Search Warrants - Rights Advisements


Slide28 : Procedural Law Balance Between - Individual Rights of Privacy - Public Safety


Slide29 : International Cooperation - Each Country’s Legal Infrastructure - Sovereignty - Mutual Assistance Agreements


Slide30 : There’s a BIG Difference Between What You CAN DO & What You MAY DO Your 3rd Grade Teacher was Right


Slide31 : CAN - To Be Able to - To Have the Knowledge or Skill to - To Know How to - To Be Mentally Able to MAY - Have Permission to - Be Free to - Be Achieved Within a Democratic Framework Your 3rd Grade Teacher was Right WEBSTER’S Ninth New Collegiate Dictionary


Slide32 : Internet Incident


Slide33 : Hackers Loop & Weave to Prevent Detection & Identification AF Sys Tampa, FL GW University NY Times Latvian Gov Sys SUBJECT in NYC


Slide34 : Sandia Labs


Slide35 : U.S. Senate Permanent Subcommittee on Investigations Manhattan Cyber Project Manhattan Cyber Project


Slide36 : Subcommittee Hearings - Chaired by Senator Sam Nunn, GA - Investigate the Threat to the National Information Infrastructure from a Cyberspace Attack (Jan-Aug 96)


Slide37 : Subcommittee Hearings - Cyberspace Security - Staff Interviewed > 200 - U.S. & International - Government Leaders - Computer Security Experts - Law Enforcement Agencies - Private Sector


Slide38 : Subcommittee Hearings - Cyberspace Security - Set of 4 Hearings (22 May, 5 Jun, 25 Jun, 16 Jul 96) - Witnesses - Dir CIA - Dep Sec Def - Dep Attorney General - Senators Kyl & Leahy - Computer Security Experts - Subcommittee Staff


Slide39 : - Only Documented Computer Espionage Case - OSI & FBI - Five Hackers Levied by Soviet KGB - Drug & Financial Problems - Best Seller “The Cuckoo’s Egg” Hanover Hacker Case - 1986


Slide40 : Mar - May 1994 Rome Air Development Center Griffiss AFB, New York


Slide41 : Rome Labs Discovers Sniffers Rome Labs


Slide42 : Rome Labs AFCERT Deployed Teams from Kelly AFB


Slide43 : Rome Labs AFOSI Deployed Agents from Andrews AFB,


Slide44 : Rome Labs Investigative Team Assessed Situation Briefed Commander


Slide45 : Rome Labs Attacks Traced to Internet Provider in New York Commercial Internet Provider


Slide46 : Rome Labs Attacks Traced to Internet Provider in Seattle, WA Commercial Internet Provider Commercial Internet Provider


Slide47 : Rome Labs Internet Path Deadend-Attackers Using Phone Lines Commercial Internet Provider Commercial Internet Provider


Slide48 : Keystroke Monitoring @ Rome Labs Rome Labs Commercial Internet Provider Commercial Internet Provider


Slide49 : Rome Labs Limited Context Monitoring @ NY Internet Provider Commercial Internet Provider Commercial Internet Provider


Slide50 : Rome Labs Limited Context Monitoring @ WA Internet Provider Commercial Internet Provider Commercial Internet Provider


Slide51 : Rome Labs Handles of Hackers were Kuji & Datastream Commercial Internet Provider Commercial Internet Provider


Slide52 : Rome Labs Agents Requested Help from Informants Commercial Internet Provider Commercial Internet Provider


Slide53 : Rome Labs UK Informant Identifies Hacker from UK Commercial Commercial


Slide54 : Rome Labs UK Hacks .MIL Sites Because So Easy Commercial Commercial


Slide55 : Rome Labs UK Agents Call CCU Scotland Yard. Pen Registers Up Commercial Commercial


Slide56 : Rome Labs UK Colombia & Chile Scotland Yard Sees, Phreaking thru South America Commercial Commercial


Slide57 : Rome Labs UK Colombia & Chile Phreaking thru South America to New York Commercial Commercial


Slide58 : Rome Labs UK Colombia & Chile Defrauds Internet Provider Commercial Commercial


Slide59 : Rome Labs UK Colombia & Chile From NY Internet Provider Attacks Rome Labs Commercial Commercial


Slide60 : Rome Labs UK Colombia & Chile Same Scenario for Seattle, WA Internet Provider Commercial Commercial


Slide61 : Rome Labs UK Colombia & Chile Entered Rome from NYC or, Seattle, WA Commercial Commercial


Slide62 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Followed Contracts


Slide63 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Followed Contracts


Slide64 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Followed Contracts


Slide65 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Followed Contracts


Slide66 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Followed Contracts


Slide67 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Thru S. America to Seattle to HQ NATO


Slide68 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia Goddard SFC HQ NATO Thru S. America to Seattle to HQ NATO


Slide69 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Through S. America to Seattle to HQ NATO


Slide70 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Data From WPAFB


Slide71 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Data From WPAFB Going to Seattle


Slide72 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Data From WPAFB Going to Latvia?


Slide73 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Data From WPAFB Going to Latvia


Slide74 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC NASA Major Target


Slide75 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC NASA Major Target


Slide76 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC NASA Major Target


Slide77 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC NASA Major Target Goddard SFC, MD


Slide78 : HQ NATO Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia Goddard SFC NASA Major Target Goddard SFC & JPL


Slide79 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Scotland Yard Issued Search Warrant


Slide80 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Scotland Yard Issued Search Warrant


Slide81 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Waiting Until Online at Rome Labs


Slide82 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Identify Additional Downstream Victim


Slide83 : Rome Labs UK Colombia & Chile S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC Had Access to Korean Atomic Research Institution Data


Slide84 : Rome Labs UK Colombia & Chile KUJI from Wales DATASTREAM from London S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC


Slide85 : Rome Labs UK Colombia & Chile Over 100 Downstream Victims From Rome S. Korean Atomic Research Inst Commercial Commercial AF Contractor AF Contractor JPL, NASA USBR Army WPAFB Latvia HQ NATO Goddard SFC


Slide86 : - 2 Hackers - 26 Days of Attacks - 20 Days of Monitoring - 7 Sniffers on Rome Systems - Over 150 Intrusions at ROME Labs from 10 Different Points of Origin - Victims - Many & Varied - Law Enforcement Agencies - Multiple - At Least 8 Countries Used as Conduit Rome Labs Summary


Slide88 : Promoting Our National Security In The Physical World


Slide89 : Promoting Our National Security In The Virtual World


Slide91 : Actor Hacker Disgruntled/Co-opted Insider Criminals Terrorist Commercial Organizations Nation States Objective Cyber-Joyrider For a Variety of Motives Personal/Financial Gain Advance Cause Industrial Espionage Espionage or Economic Advantage, InfoWar “Bad Actors”


Slide92 : Hearings, 16 July 96 - Witnesses - Jamie Gorelick & Dr John White - Announced the President Signed Exec Order 13010 to formulate Protection of Critical Infrastructures From Terrorism & Cyber Attacks - Created - Commission - Infrastructure Protection Task Force (IPTF)


Slide93 : Information Systems Security Survey Conducted by WarRoom Research, LLC Jul-Oct 96 U.S. Senate Permanent Subcommittee on Investigations


Slide94 : Information Security Survey - Collaborated with WarRoom Research - Conduct Information Systems Security Survey with Private Sector - Snapshot of InfoSec - Target Fortune 1000 Companies - Anonymous Survey Results


Slide95 : Information Security Survey - Surveys Sent, 18 Jul 96 - 500 Sent - Completed Surveys Received, 18 Oct 96 - 205 Qualified Responses (236)


Slide96 : Information Security Survey - Categories - General Information - Policy - Intrusions - Damage & Reporting - Financial Institutions Only


Slide97 : Information Security Survey - General Information - Positions in Organization - Security Responsibilities - Type of Industry - All Infrastructures Represented


Slide98 : Information Security Survey - Policy - 83% Did Have Written Policy - 67% Did Have Logon Warning Banners


Slide99 : Information Security Survey - Intrusions - 94% Consider Outside Security Firm - 27% No Capability to Detect


Slide100 : Information Security Survey - Intrusions - 58% Detected Attempts from Outside - 30% Don’t Know


Slide101 : Information Security Survey - Damage & Reporting - Cost for Each Intrusion - By Insiders - By Outsiders


Slide102 : Damage by Insiders Unknown - 12.7% - 26 $0 - 0.0% - 0 $1-1000 - 0.0% - 0 $1,001-5,000 - 1.5% - 3 $5,001-10,000 - 5.4% - 11 $10,001-50,000 - 11.2% - 23 $50,001-200,000 - 22.4% - 46 $200,001-500,000 - 20.0% - 41 $500,001-1,000,000 - 11.2% - 23 Over $1,000,000 - 15.6% - 32 205 Incidents


Slide103 : Damage by Outsiders Unknown - 21.0% - 43 $0 - 0.0% - 0 $1-1000 - 0.0% - 0 $1,001-5,000 - 0.0% - 0 $5,001-10,000 - 4.4% - 9 $10,001-50,000 - 8.3% - 17 $50,001-200,000 - 14.6% - 30 $200,001-500,000 - 19.0% - 39 $500,001-1,000,000 - 15.1% - 31 Over $1,000,000 - 17.6% - 36 206 Incidents


Slide104 : Information Security Survey - Intrusions Referred to Law Enforcement Out of 411 Incidents Only 4 ???


Slide105 : Information Security Survey Reasons Not Referred to Law Enforcement 14.3% - Didn’t Want LE in Their System 14.3% - Lose Productivity 12.1% - LE have Access to Sensitive Data 20.9% - Crime Would Become Public 19.8% - Loss of Client Confidence 8.8% - Loss of Competitive Status 9.8% - Other


Slide106 : Information Security Survey Circumstances - Willing to Report to LE 6.8% - Anytime Detected 30.2% - If Could Report Anonymously 21.7% - Only If Everyone Else Reported 37.4% - Only If Mandatory by Law 3.9% - Other


Slide107 : Information Security Survey Financial Institutions Only - Avg. EFTs per Day? - What % Misrouted? - What % Misrouted Recovered? - Annual Loss from Unreconciled EFTs? - What % EFTs Lost to Criminal Activity? - Have You Reported Losses to FINCEN?


Slide108 : Information Security Survey Financial Institutions Only NO Financial Institution Answered Any of These Questions ?????????


Slide109 : Year 2000 Crisis AKA: Y2K a Snow Ski ??


Slide110 : Just a Software Problem? - It’s the Hardware Too! - 286, 386, 486 Processors - An Estimated 200 Million RISC & 86 Microprocessors Shipped in 1995, Over Half in Embedded Systems (and Weapon Systems) - 93% of All Chips Prior to 1997 - Not Compliant - 50% of All Chips Sold in 1997 - Not Compliant


Slide111 : Where is this Hardware? - What Could be Effected? - Gas Pumps - Elevators - VCRs - Cell Phones - Microwave Ovens - Cameras - Pagers - Radios - Pace Makers - Store Cash Registers - Brake Systems - Body Wires - Ignition Systems - HVAC - Entry Control Systems - Weapon Systems


Slide112 : DoD Cyber Incident Response Goal: Situational Awareness


Slide113 : Critical Process DETECTION REPORTING ANALYSIS COA RESPONSE ALERT/ DISSEMINATION Central Reporting Facility Incident Certified Central Decision Authority Determination Inputs to Event Detected 24x7 C/S/A organization 4 hours


Slide114 : DIO Organizations and Activities Study 35 Organizations Assessed Joint Task Force - Computer Network Defense US Space Command National Infrastructure Protection Center Air Force Information Warfare Center Land Information Warfare Activity Naval Information Warfare Activity Fleet Information Warfare Center Information Operations Technology Center Air Force Network Operations Center Army Network Systems Operations Center Naval Computer and Telecommunications Command Global Network Operations Security Center Air Force Computer Emergency Response Team Army Computer Emergency Response Team Navy Computer Incident Response Team Defense Logistics Agency CERT National Security Agency (XGroup) DoD CERT Carnegie Mellon University CERT/CC Joint Staff - J2 Defense Intelligence Agency Air Intelligence Agency Air Force Office of Special Investigations US Army Criminal Investigation Directorate US Army Military Intelligence Naval Criminal Investigation Service Defense Criminal Investigative Service DoD Computer Forensics Lab Joint Command and Control Warfare Center Joint Spectrum Center Defense Advanced Research Projects Agency Joint C4ISR Battle Center Army Research Lab National Aeronautics and Space Administration Joint Warfare Analysis Center Protection CERTs Network Operations Support IW LE/CI Intelligence Other


Slide115 : Preliminary Mapping of CERT Support to JTF-CND


Slide116 : DoD Fusion Center NCA CJCS NIPC IC PEACE ------------------- CRISIS ------------------ WAR DoD LE/CI CINCs USSPACECOM JTF CND


Slide117 : DoD Fusion Center NCA CJCS NIPC IC PEACE ------------------- CRISIS ------------------ WAR DoD LE/CI CINCs USSPACECOM JTF CND


Slide118 : DefCon 7 - Annual International Hacker Convention - Here in Las Vegas Every July - Grown to Over 2500 - “Bad Guys” - “Good Guys” - Share New Tools & Techniques Stay Close to Your Friends & Closer to Your Enemies


Slide119 : Special Agent Jim Christy Law Enforcement & Counterintelligence Coordinator Defense-Wide Information Assurance Program Assistant Secretary of Defense Command, Control, Communications, and Intelligence (ASDC3I/DIAP) Voice: 703-602-9982, DSN 332-9982 Pager: 800-915-1245 Email: James.Christy@osd.pentagon.mil