7 - Cyber Systems Flashcards
(173 cards)
1
Q
Standard Computer Capabilities and Characteristics
– Four
A
- Speed
- Accuracy
- Diligence
- Versatility
2
Q
Computer Speed
– Limits
– Comparison
A
- Fastest possible = Speed of Light
- Limited by algorithm efficiency
- Thousands of times faster than humans
3
Q
Computer Accuracy
A
- High accuracy
- Errors due to human error/inaccurate data
4
Q
Computer Diligence
A
- Computers don’t suffer fatigue, lapse in concentration, etc. regardless of number of calculations
5
Q
Computer Versatility
A
- Perform multiple tasks at once w/ multi-processing
- Perform various types of tasks
6
Q
Workstation
– Other names
– Types
A
- Personal computer/client workstation
- Two Types
– Thin Client
– Thick Client
7
Q
Thin Client
A
- Software or computer relying on another computer to do most of the work
- Acts as interface connecting to network server doing the actual processing
8
Q
Thick Client
A
- Functions independent of the server
- May pull some data from server or run without being connected at all
9
Q
Server
A
- Computer managing shared resources for other network systems
- Common Types
– Application
– Catalog
– Database
– DHCP
– File
– Mail
– Proxy
– Web
10
Q
Vulnerability
A
- Weakness in a computer system that is open to exploitation
11
Q
Threat
A
- Possible danger that may take advantage of a vulnerability
- Could be an individual, an event, etc.
12
Q
Risk
A
- Likelihood that a threat will take advantage of a vulnerability
13
Q
Virus
A
- Code that spreads from one computer to another by attaching itself to other files
14
Q
Worms
A
- Code that spreads from one computer to another on its own
- Does not attach to another file
15
Q
Logic Bombs
A
- Code that sits dormant on a target computer until it’s triggered by a specific event
- Ex: Specific date/time or starting specific process
16
Q
Spyware
A
- Stealthily installed malicious software
- Intended to track/report data defined by author from a target system
17
Q
Adware
A
- Software that automatically displays or downloads ads
- “Not all malicious”
18
Q
Rootkits
A
- Code intended to take full or partial control of a system at low levels
19
Q
Botnets
A
- Collection of software robots run by a C2 program, controlled by a person
20
Q
Common Vulnerability Causes
A
- Configuration / Familiarity
- Implementation
- Design
21
Q
Configuration / Familiarity (Vulnerability Cause)
A
-
Misconfigured system/app
– Ex: bad firewall rules - Using well-known software increases probability of vulnerability/exploit
– Ex: Default PW from application user manual
22
Q
Implementation (Vulnerability Cause)
A
-
Lack of input validation
– Program assumes all user input is safe, allowing attacks such as XSS or SQL injection
23
Q
Design (Vulnerability Cause)
A
- Inherent in a protocol, application, or architecture
– Ex: Using Telnet or FTP to administer a network
24
Q
Unstructured Threat
A
- “Script Kiddy”
-
Unfocused attack often by individuals w/ limited skills
– “Unfocused” - system isn’t specifically targeted
25
Structured Threat
- **"CWO"**
- **Focused attack** by individual(s) w/ **high skills** against **specific system**
- Tend to be **motivated by specific cause**
-- Money, politics, etc.
26
Internal Threat
- Originate from individuals who **have/had authorized access**
-- Disgruntled/opportunistic employee
27
External Threat
- Originate **outside the organization**, often through the **internet**
28
Common Vulnerability and Exposure (CVE)
- Developed by **MITRE** in 1999
-- Non-profit research and dev organization
- **List of vulnerabilities**, each containing:
-- ID number
-- Description
-- At least one public reference
- ID format: CVE-YYYY-NNNN
29
U.S. National Vulnerability Database (NVD)
- Launched by **NIST** in 2005
- **Vulnerability database** built upon and sychronized w/ CVE
- Provides **Common Vulnerability Scoring System** (CVSS)
30
Exploit Database
- Maintained by **Offensive Security**
- **Archive** of exploits, shellcode, and security papers
31
Motherboard
- Main electronic circuit board **housing other sub-components**
-- CPU
-- Chipsets
-- Bus
-- System Clock
-- Expansion Slots
-- BIOS
-- CMOS
32
CPU
- Brain of computer
- Controls number of simultaneous tasks and task completion speed
33
Chipsets
- Circuitry responsible for managing specific hardware components
34
Bus
- Controls speed at which data is transferred between hardware components
35
System Clock
- Synchronizes and controls timing of computer ops
36
Expansion Slots
- Small plastic slots used to install additional devices such as video or network cards
- 1-6 in long x 1/2 in wide
37
BIOS
- Translates processor requests into instructions
- Executes POST
38
CMOS
- Contains computer's inventory list and advanced setup options
- Stores data read by BIOS
39
Memory
**2 Types**
- Random Access Memory (RAM)
-- **Volatile**
-- **Temporary** data storage which may be **quickly accessed by CPU**
- Read Only Memory (ROM)
-- **Non-volatile**
-- Stores programs the same way RAM does, but once the data is stored it **cannot be changed** (hence, read only)
-- Stores **frequently used instructions and data**, often for things such as BIOS
40
Hard Drives
- Stores changing data in relatively permanent form
- Most popular drives today are SCSI, SAS, and SATA
41
Operating System
- Significant impact on overall performance
- Ex:
-- Windows
-- Red Hat
-- Solaris
42
Distributed System Architectures (2)
- Client-Server Model (Centralized Environment)
- Peer-to-Peer Model (Decentralized Environment
43
Client-Server Model
- Smart **clients contact server for data**, then format/display it for user
- Permanent changes at the client are committed back to the server
44
Peer-to-Peer Model
- **No special machines providing a service** or managing network resources
- All **responsibilities divided** among all machines
- Peers can be **both clients and servers**
45
CIA Triad
- Confidentiality - Protect data from being accessed by unauthorized parties
- Integrity - Ensure data authenticity
- Availability - Ensure data accessibility for authorized users
46
Enforce System Policies/Procedures
- Policy Statement
-- **Outlines a plan** for the user security component
- Standards
-- Defines **how to measure** the level of adherence to the policy
- Guidelines
-- **Recommendations or best practices** for how to meet the policy standard
- Procedures
-- **Step-by-step instructions** that detail how to implement the components of the policy
47
Four A's
- Authentication
-- Uniquely ID'ing a particular individual/entity
- Authorization
-- Determining what rights/privileges a particular entity has
- Access Control
-- Determining and assigning privileges to resources, data, etc.
- Auditing or Accounting
-- Tracking & recording system activities / resource access
48
System Hardening
- Eliminate as many security **risks** as possible
-- Disable unnecessary services/accounts
-- Protect management interfaces/apps
-- Password protection
49
Vulnerability Management
- **Ongoing, comprehensive process** or program that aims at managing an organization's vulnerabilities in a **holistic and continuous manner**
-- Asset Management - **devices**
-- Software Management - **software**
-- Vulnerability Assessment - **continuous vuln scans/remediation**
-- Patch Management - **obtaining, evaluating, testing, deploying new patches**
-- Change Management - **approving/executing change to assure CIA**
50
Due Care
- Describes **how individuals should use/maintain organization-issued hardware/software**
- Includes both using equipment **safely** and in an **approved manner**
51
Due Diligence
- **Investigating/researching all issues and options** relating to a particular subject
- **Ensure security policies/practices are effective**
- **Ensure no violation** of laws, statutes, or human rights
52
Due Process
- Organization does not assume an individual is guilty w/o due process
53
Operations Continuity Plan
Defines how an org will maintain normal day-to-day ops during disruption or crisis
54
Disaster Recovery Plan
- Defines how people and resources will be protected in the case of a natural or man-made disaster
55
Benefits of Websites
- Reduces communication costs
- Enhances communication and coordination
- Accelerates the distribution of knowledge
- Improves customer service and customer satisfaction
56
Database Capabilities and Benefits
- Improved data sharing
- Improved data security
- Effective data integration
- DBMS minimize data inconsistency
- Better access to data
- Increase in productivity of end user
- Quick decision making
57
10 Most Critical Security Risks
1. Injection
2. Broken Authentication
3. Sensitive Data Exposure
4. XML External Entities (XXE)
5. Broken Access Control
6. Security Misconfiguration
7. Cross-Site Scripting (XSS)
8. Insecure Deserialization
9. Using Components with Known Vulnerabilities
10. Insufficient Logging and Monitoring
58
Injection
- **Untrusted data sent** to an interpreter as part of **command or query**
- Tricks interpreter into **accessing data w/o proper authorization**
59
Broken Authentication
- Assuming another user's identity temporarily or permanently
60
Sensitive Data Exposure
- Lack of encryption for data at rest or in transit
61
XML External Entities (XXE)
- **Older** or **poorly configured XML**
- Ability to **upload hostile XML content**, exploiting vulnerable code or dependencies
62
Broken Access Control
- Exploitation of access control
- Failing to enforce authenticated user restrictions
63
Security Misconfiguration
- Exploiting Default configurations or unpatched flaws
64
Cross-Site Scripting (XSS)
- Insufficient input validation
- Attacker able to add malicious content to a website; content executed on other victim's browser
65
Insecure Deserialization
- Existing data structures used but content changed
- Serialization used for persistence/caching
66
Using Components w/ Known Vulnerabilities
- Using preconfigured client/server-side components
- Not understsanding component patch state
67
Insufficient Logging/Monitoring
- Not validating logging and monitoring capabilities
68
Website Components
- Web Page
- Web Content
- Websites
- Web Browser
- Web Application
- Browser Engine
69
Web Page
- **Computer file** suitable for the world wide web / a web browser
- Two types
-- Static - Flat/stationary page
-- Dynamic - Controlled by **Application Server** processing **server-side scripts** and **Client Web Browser** processing **client-side scripts**
70
Web Content
- Textual, visual, or aural content that is encountered as part of the user experience
71
Websites
- **Collection of related** web pages
- Common domain name
- Published on at least one web server
- Accessible by URL
72
Web Browser
- **Application** for accessing info on WWW
- Retrieves web page and content by distinct URLs
73
Web App
- **Client-server program** which **client runs** in a **web browser**
-- Ex: Webmail
74
Browser Engine
- **Core software component** of every major web browser
- Ex:
-- Blink - Used in Chrome and Chromium
-- EdgeHTML - Used in MS Edge and Universal Windows Platform
-- WebKit - Used in Safari and Adobe AIR apps
75
Data (database)
-- Definition
-- Characteristics
- Recorded facts and figures
- Characteristics
-- Persistent - Remains unchanged until acted upon
-- Integrated - Interacts and corresponds w/ other data
-- Shared - Ability to be accessed/manipulated by multiple users
76
Database
- **Collection** of meaningful information
- **Organized** for searching and retrieving info
77
Database System (Schema)
- **Logical layout** of the database
78
Database Management System (DBMS)
- **Set of programs/utilities** used to **create, process, and administer** a database
79
Major Database Components (4)
1. Data
- Known facts and implicit meaning
2. Hardware
- Equipment needed to maintain DB
3. Users
- Individuals **manipulating/maintaining** the DB
4. Software - DBMS and programs supporting it
80
Markup Languages
-- Definition
-- Categories (3)
-- Examples
- Modern system for **annotating a document** in a way **syntactically distinguishable from text**
- Three general categories
-- Presentational
-- Procedural
-- Descriptive
- Most Common Languages
-- HTML
-- XHTML
-- XML
81
Style Sheets
-- Definition
-- Examples
- Form of **separation of presentation and content** for web design
- Defines visual layout/style
- Example Languages
-- CSS
-- Extensible Stylesheet Language (XSLT)
82
Client-side Scripting Languages
- Computer programs on the web executed **client side** instead of server side
- Used to **turn static content into dynamic content**
- Ex
-- AJAX
-- DOM
-- ActionScript
-- JavaScript
-- VBScript
83
Server-side Scripting Languages
- Executed by **web server** when user requests a document
- Ex
-- ASP/ASP.NET
-- ColdFusion
-- JSP
-- Perl
-- PHP
-- Python
-- Ruby
84
DBMS Languages
- Retrieve data from database
- Often embedded in server side scripts
- Ex
-- MS-SQL
-- MySQL
-- Oracle
-- PostgrSQL
-- Derby
-- MongoDB
-- SQLite
85
Flat File Database
- **Only One** large table
- Contains records w/ **no structured relationships**
- Ex
-- Tables found in MS Excel and Apple Numbers
86
Relational Database
- **Numerous tables** containing rows and columns of data
- Tables **relate** to one another through **shared data values**
- Ex
-- Two separate tables of data (Pay Records and Course Grades) linked by SSN (used to find and retrieve data from both)
87
Relational Database **Tables**
-- 2 parts
- Entity (Table Name)
-- Refers to storing info about an object
-- Data on members associated w/ a "CPT"
-- "CPT" would be the entity/table name
- Attribute (Column Name)
-- Characteristic or property of the entity that will be stored
88
Define Security Requirements
- **Derive security reqs** from industry standards, applicable laws, and vulnerability history
89
Leverage Security Frameworks/Libraries
- **Guard against security-related design and implementation flaws** by covering for lack of sufficient developer knowledge/time/budget
90
Secure Database Access
- Secure access to all data stores
- Consider securing queries, configuration, authentication, and communication
91
Encode and Escape Data
- Defensive techniques meant to stop injection attacks
92
Validate All Inputs
- Programming technique
- Ensures only **properly formatted data** may enter a software system
93
Implement Digital Identity
- Using Authentication and Session Management
94
Enforce Access Controls (Authorization)
- **Granting or denying specific requests** from a user, program, or process
95
Protect Data Everywhere
- Protect sensitive data (passwords, health records, etc.)
96
Implement Security Logging and Monitoring
- Log security and app
- Monitor security and app logs
97
Handle All Errors and Exceptions
- Allowing an application to **respond to errors correctly**
- Critical to making code reliable and secure
98
Cyber Command and Control Mission System (C3MS)
- **Provides 24/7/365 awareness, management, and control** of the AF domain
- Ensures **unfettered access, mission assurance, and joint warfighter use** of networks and info processing systems to accomplish worldwide ops
- Provides **operational level C2 and SA** of AF cyberspace forces, networks, and mission systems
99
AF Cyber Security and Control System (CSCS)
- Provides **24/7/365 NetOps and Management functions**
- **Enables enterprise services** within AF unclassified and classified networks
- **Supports DCO** within those AF networks
100
AF Intranet Control (AFINC)
- Manages **top-level boundary** and **entry point** into the AFIN
- **Controls** flow of all **external and inter-base traffic** - **16 gateways**
- Consists of two Integrated Management Suites (IMS)
101
AF Cyberspace Defense (ACD)
- **Prevents, detects, responds to, and provides forensics** of intrusions into unclassified and classified AF networks
102
Cyberspace Defense Analysis (CDA)
- **Monitors, collects, analyzes, and reports on sensitive info released** from friendly unclassified systems
103
Cyberspace Vulnerability Assessment/Hunter (CVA/H)
- **Executes vulnerability, compliance, pen-testing, and hunter missions** on AF and DoD networks/systems
- Hunter ops characterize and then eliminate threats for the purpose of mission assurance
- Performs **defensive sorties** world-wide via **remote or on-site** access
104
Delivery Vector
- The primary path or method used by the adversary to cause an incident or event to occur
105
Reconnaissance (delivery vector)
-- Definition
-- Sub Categories (3)
- Accessible information used to **characterize systems, apps, networks, and users**
- Sub Categories
-- Information Gathering and Data Mining - Gather **publicly available** information
-- Network Scan - Targeting **multiple IP** addresses (horizontal scan)
-- System Scan - Target **single IP** address across **range of ports** (vertical scan)
106
Authorized User (delivery vector)
-- Description
-- Categories (2)
- User w/authorized access **took specific actions that resulted in jeopardizing systems or data**
- Sub Categories
-- Purposeful - Authorized user **knowingly** took specific actions
-- Accidental - Authorized user took actions that had **consequences over and above the intentions**
107
Social Engineering (delivery vector)
-- Definition
-- Categories (3)
- **Human interaction** (social skills) or **deception used to gain access**
- Sub Categories
-- E-mail - Used to **deliver malicious payload/gain access**
-- Website - Used to **deliver malicious payload/gain access**
-- Other - **Target deceived or manipulated** in a way **other than email/website**
108
Configuration Management (delivery vector)
-- Definition
-- Categories (3)
- Compromise resulting from **inadequate or improper config** of a system
- Sub Categories
-- Network - Improperly/inadequately configured **network system/service**
-- OS - **OS** improperly/inadequately configured
-- App - **App** improperly/inadequately conifgured
109
Software Flaw (delivery vector)
-- Description
-- Categories (2)
- **Vulnerability in the software** that allows for **unauthorized use of or access** to a system
- Sub Categories
-- Exploited new vulnerability - Vuln **unknown prior to event** or **w/o mechanism to prevent** it
-- Exploited known vulnerability - vuln **known prior to event** and w/ a **mechanism to prevent** it
110
Transitive Trust (delivery vector)
- Definition
- Categories (2)
- Compromise **resulting from** the **implicit or explicit trust relationship** between security domains
- Sub Categories
-- Other IS compromise - Compromise resulting from **access previously gained by another system**
-- Masquerading - Compromise resulting from the **unauthorized use of valid credentials**
111
Resource Exhaustion (delivery vector)
-- Definition
-- Categories (2)
- **Consumption of system resources** that **prevent legitimate users from accessing** resources
- Sub Categories
-- Non-Distributed Network Activity - Activity **from single IP** that overwhelms system
-- Distributed Network Activity - Activity **from multiple IP** that overwhelms system
112
Physical Access (delivery vector)
-- Definition
-- Categories (3)
- **Unauthorized physical access** to resources
- Sub Categories
-- Mishandled or Lost Resource - Equipment was **lost, stolen, or left accessible** to unauthorized parties
-- Local Access to System - Unauthorized user **provided local physical access** to a DoD information network resource
-- Abuse of Resources - **Physical destruction** of an information resource by an unauthorized party
113
Other (delivery vector)
- Delivery vector not covered by other methods
114
Unknown (delivery vector)
- Delivery vector could not be determined w/ info available
115
C3MS
- Operated By
- Sub Components (5)
**Operated By**
- JBSA-Lackland
-- 616th Ops Center (AD)
-- 854th Combat Ops Sq (R)
- McGhee Tyson
-- 119 COS (R)
**Sub Components**
- Situational Awareness
-- Produce a **cyber operational picture**
- ISR
-- Enable **integration of** cyberspace actionable **intel products** into other sub-components
- Planning
-- Leverage SA to **develop long and short term plans** to execute OCO, DCO, and DoDIN ops
- Execution
-- Ability to leverage plans to **generate and track Cyber Tasking Orders** (CTO)
- Integration
-- Provides ability to **integrate AF-generated cyber effects** w/ other C2 nodes
116
CSCS
- Operated By
- Sub Components (2)
**Operated By**
- Joint Base Langley-Eustis
-- 83 NOS (AD)
-- 860 NOS (R)
- Peterson
-- 561 NOS (AD)
-- 960 NOS (R)
- Pearl Harbor-Hickam
-- 690 COS (AD)
- Ramstein
-- 691 COS (AD)
- McConnell
-- 299 NOS (R)
**Sub Components**
- DoDIN Ops and Management
-- Activities designed to **maintain and protect base-level operational networks**
- Enterprise Services
-- Provides **network application hosting and storage management** w/in AF networks
117
AFINC
- Operated By
- Sub Components (4)
**Operated By**
- Gunter Annex
-- 26 NOS (AD)
**Sub Components**
- Defense-in-Depth
-- Delivers an **enterprise-wide layered approach** by integrating the gateway and boundary devices
- Situational Awareness
-- Delivers **network data flow, traffic patterns, utilization rates, and in-depth research** of historical traffic for anomaly resolution
- Proactive Defense
-- Conducts **continuous monitoring** of AF network traffic
- Network Standardization
-- Creates and maintains **standards and policies**
118
ACD
- Operated By
- Sub Discipline Areas (4)
**Operated By**
- JBSA-Lackland
-- 33 NWS (AD)
-- 426 NWS (R)
- Quonset ANGB
-- 102 NWS (R)
**Sub Discipline Areas**
- Incident Prevention
-- **Protecting** against malware by **assessing/mitigating known vulnerabilities**
- Incident Detection
-- **Monitoring** classified/unclassified AF **networks**
- Incident Response
-- **Determines extent of intrusions** and **develops COAs to mitigate** the threat
- Computer Forensics
-- **Conducting in-depth analysis** to **determine threats** from ID'd incidents
119
CDA
- Operated By
- Sub Discipline Areas (6)
**Operated By**
- JBSA-Lackland
-- 68 NWS (AD)
- Offutt
-- 860 NWF (AD)
-- 960 NWF (R)
**Sub Discipline Areas**
- Telephony
-- Monitor & assess **unclassified voice networks**
- Radio Frequency
-- Monitor and assess **various frequency bands**
- Email
-- Monitor and assess **email traffic w/in AFNet**
- Internet Based Capabilities
-- Monitor and assess info that **originated w/in AFNet** that is **posted to publicly accessible websites**
- Cyberspace Op Risk Assessment
-- Assess data **compromised through AFNet intrusion** and **determine Ops impact**
- Web Risk Assessment
-- Assess info **posted on unclassified AF**-owned, leased, or operated public and private **websites**
120
CVA/H
- Operated By
- Sub Components (4)
**Operated By**
- 6 AD Units
-- JBSA-Lackland
-- Scott
- 12 ANG Units
- 1 Reserve Unit
-- Scott
**Sub Components**
- Mobile Interceptor Platform (MIP)
-- Laptop
- Deployable Interceptor Platform (DIP)
-- 2 servers and 5 network sensors used for remote ops
- Garrison Interceptor Platform (GIP)
-- Security ops floor for remote ops
- Information Ops Platform (IOP) Flyaway Kit
-- Boundary defense device placed in-line w/ network traffic
121
AFNet
- Design
- Enclave
-- **Collection of computing environments** (including personnel and physical security) connected by one or more **internal networks**
-- Under control of **single authority**
-- Ex: NIPR, SIPR
122
NIPRNet
- **Private IP** network
- **Unclassified**
- Provides access to **internet, email, file storage, etc**
- Comprised of **routers and nodes** owned by the DoD
- **Largest private network** in the world
- Part of Defense Information System Network (DISN)
123
SIPRNet
- **SECRET private IP** network
- Provides access to DoD's **classified intranet services**
- Utilized outside the military
-- Ex: Department of State
124
Surveillance (DCO Tactical Mission Type)
- Objective
-- **Collect relevant data**/information in/on the AO
- Tasks
-- Collect/monitor **network infrastructure**
-- Collect/monitor network **user characteristics/trends**
-- Collect/monitor **data from individual systems**
125
Reconnaissance (DCO Tactical Mission Type)
- Objective
-- **Collect relevant data/information on threats** in the AO
- Tasks
-- **Find and track** specified enemies, adversaries, and threats
-- **Understand and characterize** specified enemies, adversaries, and threats
126
Access (DCO Tactical Mission Type)
- Objective
-- **Provide sufficient access** for supported cyber forces
- Tasks
-- **Configure firewall** rules/policies
-- **Routing config** changes
-- Provision/**configure accounts**
-- **Configuring permissions**
127
Strike (DCO Mission Type)
- Objective
-- **Damage or destroy** an objective or capability
- Tasks
-- **Destroying resident adversary/malicious code** or other assigned artifacts
-- **Quarantining malicious code** and/or **preventing code execution**
-- Manipulating, denying, degrading, or disrupting **adversary network traffic**
128
Escort (DCO Tactical Mission Type)
- Objective
-- **Provide defensive support** to cyber weapon systems or mission partners conducting primary missions in the AO
- Tasks
-- **Deploy countermeasures**
-- **Ensure** all required forces have the **necessary level of access** to assigned AO during mission vulnerability window
129
SCAR (DCO Tactical Mission Type)
- Objective
-- **Conduct strike coordination and reconnaissance** in **response** to adversary activity w/in the AO
- Tasks
-- **Patrolling** the AO, or a portion of the AO
-- **Conduct or support strike and/or** follow-on Intelligence Preparation of the Environment (**IPOE**) missions
130
Secure (DCO Tactical Mission Type)
- Objective
-- **Enhance the Defenses** of the assigned AO in response to **active threats**
- Tasks
-- **Enhance defense** of cyber key terrain
-- **Reconfigure network appliances** to a more secure config in response to **active threats**
131
Threat Emulation (DCO Tactical Mission Type)
- Objective
-- **Replicate realistic TTP** of **specific cyber threats** to evaluate cyber defenses
- Tasks
-- **Emulate** known **adversary TTP**
-- Identify **unmitigated vulnerabilities**
-- **Assesses defensive posture** and processes
132
Public Switched Telephone Network
- **Worldwide collection** of **interconnected public telephone networks**
- **Circuit-switching** to allow users to make **landline** telephone calls
133
Voice over IP (VoIP)
- Able to **deliver voice communications/multimedia** over the **internet**
- **Packet-switched** network to allow users to make calls
134
Defense Switched Network (DSN)
- **World-wide** non-secure voice, secure voice, data, facsimile, and video teleconferencing services for **DoD C2 elements**
- Assures **non-blocking service** for users w/ flash and flash override precedence capabilities
135
Cellular Networks
- Communication network w/ last link being wireless
- Able to connect to PSTN and Internet
136
Phreaking
- PSTN vulnerability
- **Reverse engineering** the system of tones used to route long-distance calls
- **Recreate tones** to route **free calls**
137
War Dialing
- PSTN Vulnerability
- Technique to **automatically scan a list of telephone numbers**
- Usually dialing every number in a local area code to **search for modems**
138
Dialup Modems
- PSTN Vulnerability
- Overlooked **"backdoor" through a PSTN** into **another IT network**
- Used by admins to **remote into Control System** equipment
139
Registration Server Hijacking
- VoIP Vulnerability
- **Rogue device** registers as Registration Server by **impersonating a valid user**
140
Session Initiation Protocol (SIP) Attack Vectors
- VoIP Vulnerability
- Enumeration
-- Means to **ID SIP systems**
- Fuzzing
-- Type of DoS attack used to **send malformed data packets to crash** the SIP system
- Man-in-the-Middle
-- Attacker **intercepts** SIP call-signaling traffic
-- Attacker **masquerades** as both calling and called parties
-- **Hijacks** calls via redirection server
141
Tower Hijacking
- Cellular Network Vulnerability
- Attack ID's bug in **Base Transceiver Station** software services
- Attacker **exploits vulnerability and takes over** the tower transceiver
142
Mobile Device Software
- Cellular Network Vulnerability
- Incorrect **system permission settings** granting great access to other areas of the device
- **Exposed internal communication protocols** that pass messages internally within the device to itself or other apps
143
PSTN Components
- Class 4 (Toll Office)
-- Connects to multiple Class 5 offices
-- Connects to other Class 4 offices and Class 1 (Regional Center) office
- Class 5 (End Office)
-- **ONLY** office that **connects to individual or business** subscribers
-- Connects to other Class 5 offices and Class 4 office
- Local Loop ("Last Mile")
-- Physical connection between a carrier's Class 5 and the subscribers' premises
- Private Branch Exchange (PBX)
-- Telephone exchange typically owned by the customer
-- Calls made within PBX are at no cost
144
VoIP Components
- IP Phone/Software (Skype, etc.)
-- Uses VoIP tech allowing telephone calls to be made over an IP network
- Registration Server
-- Entity that **receives registrations** from a **UAC**
-- **Extracts info** about current location and stores it (IP address, port, username)
- Proxy Server
-- **Forwards requests** on behalf of the endpoint by consulting the registrar
-- Handles **Session Initiation Protocol** (SIP) requests for the User Agent
- Redirect Server
-- Accepts a request, maps the address, and returns to the client
-- **DOES NOT** pass the request on to other servers
- Call Manager
-- Provides **consolidated services**
-- **Sets up and monitors** calls, **maintains** the dial plan, **performs** phone number translations
- Media Gateway
-- **Interfacing IP network** based voice communications w/ traditional circuit-switched network
145
DSN Components
- DSN Backbone Switches
-- **Route calls** to other nodal switches
-- Multifunction switch, similar to PSTN Class 4 and 5 combined
- Installation Switches
-- Switches at bases, posts, camps, and stations
- End Office (EO)
-- **Primary Switch** for **long distance services** for either an installation or group of installations in a **geographic area**
- Small End Office (SMEO)
-- Switch that serves as primary switch
-- Used at **smaller DoD installations**
-- Will **not** serve installations with **critical missions**
- Private Branch Exchange (PBX)
-- PBX-1 - Switches w/ MLPP capabilities
-- PBX-2 - Switches **without** MLPP capabilities
- Remote Switch Unit (RSU)
-- **Switching capability** that is **connected to a host** as a remote
-- **Dependent upon the host switch** for software control
146
Cellular Network Components
- Base Transceiver Station (BTS)
-- Considered the "Radio Tower" with "RF"
- Base Station Controller (BSC)
-- Controls one or more BTS
-- Think of as a **cell**
- Base station System (BSS)
-- Acts like a PTSN Local Loop for Cell Networks
-- Combines the BTS and BSC
- Mobile Switching Center (MSC)
-- Connects to a Base Station Controller
-- Acts like a PTSN Class 5 but for Cell Networks
- Mobile Telephone Switching Office (MTSO)
-- Considered the PTSN Central Office equivalent
-- Each carrier in each city runs one office
147
PTSN Design
- Local Access and Transport (LATA)
-- Represents an area within which a **divested Regional Bell Operating Company** (RBOC)
-- Permitted to **offer exchange telecommunications** and exchange access services
- North American Numbering Plan (NANP)
-- System used to **direct telephone calls** to a **particular region**
-- Provides telephone **numbering scheme**
---- Three-digit area code
---- Seven-digit telephone number
148
VoIP Design
- Session Initiation Protocol (SIP)
-- Call set up (INVITE) and terminate/transfer (BYE)
-- Two types of messages (request and response)
-- Port 5060
-- Similar to TCP three-way handshake, but more steps
- Realtime Transport Protocol (RTP)
-- Media protocol
-- Describes the packet format for the actual data
149
Cell Network Design
- GSM (Global System for Mobile Communication)
-- World standard
-- Subscriber ID Module (SIM) cards used for different providers in different countries
- TDMA (Time Division Multiplexing)
-- American Standard
-- Assigns each call a certain portion of time on a designated frequency
- CDMA (Code Division Multiple Access)
-- American Standard
-- Gives a unique code to each call and spreads it over available frequencies
- Network Data Technologies
-- 1G
-- 2G
-- 3G
-- 4G (Long Term Evolution, LTE)
-- 5G
150
PSTN Security
- Physical Security
- Network Security
151
VoIP Security
- Physical Security
- Layer-2 Network Segregation
- Layer-3 IP Segregation
**Encryption**
- Voice over Secure IP (VoSIP)
-- Unencrypted voice over encrypted network
- Secure VoIP
-- Encrypted voice over non-secure network
- Secure Voice over Secure IP (SVoSIP)
- Encrypted voice over Encrypted network
152
Cell Network Security
- Physical Security
- Mobile Device
-- Patch Management
-- Treat it like a computer
-- Encryption
-- Two-factor auth
---- Preferably not SMS due to ease of spoofing
153
Supervisory Control and Data Acquisition (SCADA)
- Computerized system that is capable of **gathering and processing** data and **applying operational controls** over long distances
- Used to control **dispersed assets**
- Designed to **collect field information**, transfer it to central computer facility, and display to operator
- Allows operator to monitor or control an entire system
154
Distributed Control System (DCS)
- Control achieved by intelligence that is distributed about the process to be controlled
- Used to **control production systems** within the same geographic location
-- Usually process control or discrete part control systems
155
ICS Industrial Sectors/Interdependencies
**Manufacturing Industries**
- Process-based
-- Continuous manufacturing process
---- **Runs continuously**, often w/ transitions for different product grades
-- Batch Manufacturing Process
---- **Distinct processing steps**
- Discrete-based
-- **Series of steps** on a single device to create an end product
- Manufacturing systems usually located w/in **confined area**
-- LAN
**Distribution Industries**
- Used to control geographically dispersed assets
-- Water distribution, gas pipelines, etc.
- Distribution systems spread over **large area**
-- WAN, wireless, RF
156
ICS Critical Infrastructure
- System of Systems
-- **multiple, independent systems** combined to form larger more complex system
- **Interconnected** and **mutually dependent** in complex ways
-- Both physically and through info/comms
- Cascading failure in electric power grid
157
ICS Components
**Control Loops**
- Utilizes **sensors, actuators, and controllers** to manipulate some controlled process
-- Sensors **measure a physical property**
-- Controllers **interpret the signal** and **generate corresponding variables**
-- Actuators (valves, switches, motors, etc.) **directly manipulate** the controlled process
**Human-Machine Interface (HMI)**
- **Used by operators/engineers** to **monitor/configure** elements of controllers/actuators
- **Displays process status** info and historical info
**Remote Diagnostics**
- Used to **prevent, ID, and recover** from abnormal operation/failure
158
ICS Design Considerations (7)
- Control timing Requirements
-- Wide range of time-related reqs
-- Human reliability/consistency vs automated controllers
-- Computation proximity to sensor (as close as possible)
- Geographic Distribution
-- Varying degrees of distribution
-- Small local process control vs wide area/mobile comms
- Hierarchy
-- Provides human operators w/ comprehensive view
- Control Complexity
-- Reliance on controllers and preset algorithms
-- Higher complexity requires human operators (such as ATC)
- Availability
-- High up-time reqs = more redundancy
- Impact of failures
-- What's affected if system fails
-- Higher impacts require continued ops through redundancy/degraded state ops
- Safety
-- Systems need ability to detect unsafe conditions
-- Human oversight in safety critical ops
159
SCADA Hardware
- Control Center
- Comm Equipment
- Remote Terminal Units (RTUs)
- Programmable Logic Controllers (PLC)
160
Programmable Logic Controllers (PLC)
- **Primary controller** in smaller control system configs, used to control discrete processes
-- Ex: automobile assembly lines
- Generally **lack a central control server/HMI**
-- **closed-loop control** w/o human involvement
161
ICS vs IT systems
- ICS control physical world
- IT systems manage data
- Different risks/priorities
- Different performance/reliability reqs
- ICS may use OSs and apps that may be unconventional in typical IT network
162
ICS Network Segmentation and Segregation
- One of the **most effective architectural concepts** to protect ICS
- Determine **critical parts** of network that **need segregation**
- Goal is to **minimize access** to sensitive info
- **No** system should be **dual-NIC'd**
- Methods
-- Logical Network Separation (**minimum separation**) (VLANs, VPNs, unidirectional gateways)
-- Physical Network Separation
-- Network Traffic Filtering (IP/route, ports, protocols, applications, etc.)
163
ICS Boundary Protection
- Transfer of info between domains = Risk
- Boundary devices are key to enforcement of security policies
- Can be used to isolate ICS and enterprise components
-- Limits unauthorized info flow
- Includes
-- Gateways, routers, firewalls, IDS, etc.
164
ICS Firewalls
- Control flow of traffic between networks
- Typically deployed between ICS and enterprise networks
- All connections between networks should go through firewall
- Special considerations:
-- Possible addition of delay to ICS comms
-- Lack of experience in the design of rule sets for ICS
165
ICS Defense in Depth
- Single security product can't do it all
- Utilize **overlapping security mechanisms**
-- Firewall, DMZ, IDS, etc
-- Policies, training, incident response, physical security
- Requires a **thorough understanding** of adversary tactics
166
General Firewall Policies (ICS)
- Deny all except for traffic absolutely required
-- Difficult to implement in reality
-- Basic premise
- Best Practices (examples)
-- Base rule set - deny all, permit none
-- All "permit" rules should be address and port specific
-- All rules should restrict traffic to specific IP or range
167
Recommended Firewall Rules (ICS)
- Disallow DNS requests
- Disallow HTTP from public/corporate to the control network
- Block TFTP, allow FTP for outbound sessions only
- Use SSH over Telnet
168
ICS Fireall Issues
- Data Historians
- Remote Support Access
- Multicast Traffic
- Unidirectional Gateways
- Single Points of Failure
- Redundancy and Fault Tolerance
- Preventing Man-in-the-Middle Attacks
- Authentication and Authorization
- Monitoring, Logging, and Auditing
- Incident Detection, Response, and System Recovery
169
ICS Policy and Procedure and Predisposing Conditions (Vulnerabilities)
- Introduced because of incomplete, inappropriate, or nonexistent security policy
- Ex:
-- Inadequate security policy for ICS
-- No formal ICS security training/awareness program
-- Lack of redundancy for critical components
170
ICS System and Predisposing Conditions (vulnerabilities)
- Can occur in hardware, firmware, and software
- Can occur in large complex systems and networks
- Sources:
-- Design Flaws
-- Development Flaws
-- Misconfigurations
-- Poor Maintenance
-- Poor Administration
-- Connections w/ other systems and networks
171
ICS Vulnerabilities
- Architecture and Design
-- Insecure architecture allowed to evolve; no security perimeter defined
- Configuration and Maintenance
-- Inadequate testing of security changes, data unprotected
- Physical
-- Unauthorized personnel have physical access
- Software Development
-- Improper Data Validation
- Comm and Network Config
-- Firewalls nonexistent or improperly configured
172
Example ICS Adversarial Incidents
- Denial of Control Action
- Control Devices Reprogrammed
- Spoofed System Status Info
- Control Logic Manipulation
- Safety Systems Modified
- Malware on Control Systems
173
Documented ICS Incidents
- Adversarial Events
-- Worcester Air Traffic Communications
-- Stuxnet Worm
- Structural Events
-- CSX Train Signaling System
-- Browns Ferry-3 PLC Failure
- Environmental Events
-- Fukushima Daiichi Nuclear Disaster
- Accidental Events
-- Vulnerability Scanner Incidents
-- Penetration Testing Incident
