9 - DCO Flashcards
1
Q
Insider Threat
– Definition
A
- Current or former employee, contractor, or business partner who has or had authorized access to an organization’s network, system, or data and used that access to affect CIA of data or information systems
2
Q
Insider Threat
– Negative Impacts
A
- Financial losses
- Negative publicity
- Loss of man-hours
- Disruption of ops
- Disruption of critical services
- Mission downtime
- Mission failure
3
Q
Insider Threat
– Methods
– Prevention/Detection Challenges
A
- Methods
– Logic bombs
– Backdoors
– Steal sensitive data
– Attack internal resources - Prevention/Detection Challenges
– Human behaviour/action is unpredictable
– Not detected by traditional security measures
4
Q
Insider Threat
– Warning Signs
– Behavioural Indicators
A
- Warning Signs
– Greed
– Abnormal introversion
– Financial hardship
– Vulnerability to blackmail
– Reduced loyalty to US
– Destructive, narcissistic, or passive aggressive behaviour - Behavioural Indicators
– Workers coming in at unusual times w/o authorization/need
– Accessing network at odd times
– Unnecessarily copying classified materials
– Signs of vulnerability to blackmail (drug abuse, excessive gambling, other illegal activities)
5
Q
Insider Threat
– Detection and prevention techniques
A
- Encryption
- Data Loss Prevention
– Provides information about how sensitive data is used/transferred - Data Access Monitoring
– ID who is accessing what
– Correlate network activity to certain user
– ID user trends/software usage - Log Analysis
- Data Redaction
- Data Access Control
6
Q
Data Access Control Types
A
- Discretionary (DAC) - Owner specifies who has read/write/execute rights
- Mandatory (MAC) - Access control policy determined by central authority; owner cannot change access rights
- Role-Based (RBAC) - Access rights determined by user’s roles within an organization
7
Q
External Threats
– Definition
– Examples
A
- Attack originating from outside the organization’s network
Examples
- Ransomware
– One of the fastest growing malware threats - E-mail/Spear-phishing
– Focused attack on specific, usually high-interest person
– Requires minimal cost/skill to execute - Unauthorized Media
– CDs, DVDs, USB, etc. - Unauthorized Physical Access
- Direct Remote Attacks
– Attacks delivered via WiFi, Ethernet, RF, Bluetooth - Botnets
- Web-Based Threats
– Drive-By Attack - attack delivered through seemingly legitimate website; attack of opportunity targeting vulnerabilities in browser/device
– Watering Hole Attack - Focused drive-by attack w/ specific target
– IFrame Redirect - Malicious content embedded in a webpage
– Fake Login Pages
– Browser Plug-in and Script-Based exploits
– SQL Injection - OS/Application based exploits
- DNS Cache Poisoning
- Pass-the-Hash
- Remote Access Tools (RAT)
- Zero-Day Exploits
- N-Day Exploits
8
Q
China (State Sponsored Threat)
A
- Noisiest threat actor
- Large attack volume
- Lack sophistication/creativity, but effective
9
Q
North Korea (State Sponsored Threat)
A
- Cyber attacks are means to “level the playing ground” against more advanced forces
- Common attacks
– Spear-phishing
– Watering hole
– Intel gathering
10
Q
Russia (State Sponsored Threat)
A
- Home to many advanced researchers
- TTPs:
– Weaponized email attachments
– Varied attack patterns, exploits, exfil methods
– Extremely effective detection evasion
– HUMINT - Attributed malware
– Zeus
– Gozi
– SpyEye
– SpyZeus
– Ligats Trojans
11
Q
Middle East (State Sponsored Threats)
A
- Often creative, deceptive, or novel attack methods due to lack of sophistication/brute force capes
12
Q
Iran (State Sponsored Threats)
A
- Cutting Sword of Justice used “Shamoon” virus to attack Saudi oil company Aramco
- Operation Ababil - DDoS attacks against US financial institutions, including NY Stock Exchange
13
Q
Syria (State Sponsored Threats)
A
- Syrian Electronic Army (SEA)
- Loyal to Syrian President
- Conducts DDoS, phishing, pro-Assad defacements, and spamming campaigns
- Hacked AP, BBC, Financial Times, Guardian, NY Times, Twitter, etc.
14
Q
Advanced Persistent Threat
– Definition
A
- Anyone conducting cyber ops on behalf of a government body
- Among the most dangerous cyber threats
- Often large scale hacking campaigns
- Receive funding/resources from gov
15
Q
APT29
– Description
– Associated Malware
– Targets
A
- Russia
- Hides activity on victim’s network, communicating infrequently and resembling network traffic
- Monitors network defender activity
- Uses compromised servers for C2
- Counters attack remediation attempts
- Fast malware dev cycle to hinder detection
- Associated Malware
– Hammertoss
– Uploader
– tDiscoverer - Targets
– Western European governments
– Foreign policy groups
– Orgs w/ valuable info for Russia
16
Q
APT28
– Description
– Associated Malware
– Targets
A
- Russia
- Tsar Team (FireEye)
- Skilled devs/operators collecting intel on defense/geopolitical issues
- Gain insider info related to governments, military, and security orgs
- Associated Malware
– Chopstick
– Sourface - Targets
– Georgia and eastern European countries
– NATO
17
Q
Ordinary Citizens
A
- Most common threat
– “Layer 8 Issue” - Weakest link
- Home end-users, employees, etc.
- Mostly passive
18
Q
Script Kiddies
A
- Vandals/graffiti artists of the internet
- Inferior knowledge of programming/security
- Motivated by short-term ego-gratification
- Uses existing, well-known exploits/pre-made scripts
- Little thought/concern about consequences
19
Q
Hackers
A
- Deeper knowledge/understanding of computer tech
- Concerned w/ subtle details of OSs, algorithms, config files
- Few in number, highly ambitious
20
Q
Patriot Hackers
A
- Motive - aid or support own nation-state in ongoing conflict
- Common among Chinese hackers
21
Q
Cyber Terrorists
A
- Use computer/network technologies to carry out attacks and cause public fear
Ex: Islamic State Hacking Division
22
Q
Malware Authors
A
- Specialized black-hat
- Dev original malware
- Highly skilled in computer programming/detection evasion
- Uses malware “creation kits” for custom malware
23
Q
Cyber Militia
A
- Group of volunteers using cyber attacks to achieve political goal
- Uses common comm channels (social media, forums, etc.)
- No monetary rewards for service
24
Q
Cyber Hacktivists
A
- Cyber militias that can, in some sense, be seen as cyberspace equivalent to Greenpeace activists or other groups carrying out acts of civil disobedience
- Ex: Anonymous
- Methods:
– Web site defacement
– Internet resource redirect
– DoS
– Info theft
– Web site parodies
– Virtual sit-ins
– Cyber sabotage
25
Q
Criminal Syndicates
A
- Most active in Eastern Europe and West Africa
- Common in areas w/ high unemployment and low salaries
- Motivated by money/power
26
Q
BGP Threat
A
- BGP can be manipulated to route traffic from one country to another
27
Q
Supply Chain Threat
A
- Threats exist in both production and distribution
- Affect information and communication technology devices which are manufactured, assembled, and distributed from multiple individual components and numerous distributors
- Affect hardware, software, and firmware components
28
Q
Advanced Computing Technologies
A
- High Performing Computing (HPC)
– Russia has 6 HPC systems - Quantum Computing
29
Q
Cyber Intelligence Reports
A
- Provide timely access to relevant, actionable threat intelligence, including:
– IOCs
– TTPs
– Recommended actions/counter attacks
30
Q
Cyber Threat Information
A
- Any information that can help an organization identify, assess, monitor, and respond to cyber threats
31
Q
Cyber Threat Bulletin
A
- Bi-weekly report from 616th Operations Center
- Designed to keep AF members up to date
- Strengthens SA of threats
- Can be accessed through AF portal
32
Q
Mandiant’s Annual Cyber Threat Report
A
- Annual report using insights, statistics, and case studies to show how TTPs of APTs have evolved since 2014
- Contains threat intel from millions of VMs
- Aimed at better arming the public against cyber attackers
- Includes global and regional threat intel
33
Q
Symantec’s Security Response Publications
A
- Worldwide team develops a variety of content on the latest threats
- Publications include:
– Annual Threat Report
– Monthly Threat Report
– White Papers on an array of security topics
34
Q
Government Agency Reports
A
- DHS Publications
- FBI Internet Crime Complaint Center (IC3) Report
-
DHS and FBI Joint Analysis Report (JAR-16-20296A)
– Provides technical details regarding tools and infrastructure used by Russia
– GRIZZLY STEPPE
– APT28 used spear phishing/stolen creds to compromise US political party
35
Q
Adversary Activity
– Requirements/resources
– Results
A
- Hardware, software, data, manpower
- Results:
– Resources used
– TTPs captured
– Intel gained
36
Q
Categories of Activity
A
- Standard Operations - Activities performed consistently on a day-to-day basis to support multiple ongoing ops
- Target Operations - Activities performed in support of an operation guided by a tasking
37
Q
5 Adversarial Phases
A
- Phase 0: Administer - Intent and resource development
- Phase 1: Prepare - Reconnaissance and staging
- Phase 2: Engage - Delivery and exploitation (and C2)
- Phase 3: Propagate - Internal recon, lateral movement, persistence
- Phase 4: Effect - Exfil and attack
38
Q
Phase 0: Administer
A
- Day to day/standard ops
- Provides resources to drive targeted ops
- National strategy + requirements = intent
- Resource development
- Tasking in preparation of ops
39
Q
Phase 1: Prepare
A
- Research on target
- Infrastructure/capabilities set up
- Various types of recon/scanning/staging
40
Q
Phase 2: Engage
A
- Adversary action to gain initial access
- Delivery
- Exploitation
- C2
- Covering Tracks
- Beacon
- Covert Channels
41
Q
Phase 3: Propagate
A
- Guarantee ongoing/robust access
- Propagate and achieve maintained persistence
- Internal recon
- Hashdumping
- Lateral movement
- Network persistence
- Covering tracks
42
Q
Phase 4: Effect
A
- Manipulation, DoS, destruction of systems
- Exfil data
- Data manipulation
43
Q
Primary DCO Missions (3)
A
- Defend networks, systems, and information
- Prepare to defend the US and its interests against cyberattacks of significant consequence
- Provide integrated cyber capabilities to support mil ops and contingency plans
44
Q
Defend networks, systems, and information (DCO Mission)
A
- Conduct ongoing defensive ops to securely operate the DoDIN
- Quick response to indications of hostile activity
- Majority of DoD’s ops in cyberspace
45
Q
Prepare to Defend the US and its interests (DCO Missions)
A
- If directed by POTUS/SECDEF, counter imminent/ongoing attacks
- Synchronize capabilities w/ other gov agencies (Law enforcement, intel agencies)
46
Q
Provide Integrated cyber capabilities ISO mil ops and contingencies (DCO Missions)
A
- Ensure internet remains open, secure, and prosperous and conduct ops under doctrine of restraint to protect human lives and prevent destruction of property
- Conduct cyber ops to deter or defeat strategic threats in other domains
47
Q
Five Strategic Goals for DCO
A
- Build and maintain ready forces and capabilities
- Defend the DoDIN, secure DoD data, and mitigate risks
- Prepare to defend US homeland and interests from cyber attacks
- Build and maintain viable cyber options and plan to use those options to control conflict escalation and shape conflict environment
- Build and maintain robust international alliances to deter shared threats/increase international security
48
Q
Build and maintain ready forces and capabilities (Strategic Goals for DCO)
A
- Build the cyber workforce
- Build technical capabilities
- Validate and refine adaptive C2
- Cyber modeling and simulation capabilities
- Assess Cyber Mission Force capabilities
49
Q
Defend the DoDIN, secure DoD data/mitigate risks (Strategic Goals for DCO)
A
- Build Joint Information Environment architecture
- Assess and ensure JFHQ effectiveness
- Mitigate known vulnerabilities
- Assess DoD’s cyber defense forces
- Improve Computer Network Defense Service effectiveness
- Plan network defense and resilience
- Red team DoD network defenses
- Mitigate risk of insider threat
- Exercise Defense Support of Civil Authorities
- Strengthen procurement and acquisition
- Build collaboration and respond to data loss
- Use counterintel to defend against intrusions
- Support whole-of-government policies and capes
50
Q
Be prepared to defend the US Homeland and interests (Strategic Goals for DCO)
A
- Develop intel and warning capabilities
- Develop and exercise capes to defend the nation
- Develop innovative approaches to defense
- Develop automated info sharing tools
- Assess cyber deterrence posture and strategy
51
Q
Build and maintain robust international alliances and partnerships (Strategic Goals for DCO)
A
- Build partner capacity in key regions
- Counter proliferation of malware
- Work w/ international partners to plan/train for cyber ops
- Strengthen cyber dialogue w/ China
52
Q
Encryption Classes (2)
A
- Symmetric (Shared Key)
- Asymmetric (Public Key)
