C4 ISRchapter
C4 ISRchapter
C4 ISRchapter
net/publication/216485701
CITATIONS READS
2 3,109
4 authors, including:
Junaid Zubairi
State University of New York at Fredonia
67 PUBLICATIONS 380 CITATIONS
SEE PROFILE
Some of the authors of this publication are also working on these related projects:
All content following this page was uploaded by Junaid Zubairi on 23 August 2014.
Athar Mahboob
National University of Sciences & Technology, Pakistan
Senior Editorial Director: Kristin Klinger
Director of Book Publications: Julia Mosemann
Editorial Director: Lindsay Johnston
Acquisitions Editor: Erika Carter
Development Editor: Michael Killian
Production Editor: Sean Woznicki
Typesetters: Adrienne Freeland
Print Coordinator: Jamie Snavely
Cover Design: Nick Newcomer
Copyright © 2012 by IGI Global. All rights reserved. No part of this publication may be reproduced, stored or distributed in
any form or by any means, electronic or mechanical, including photocopying, without written permission from the publisher.
Product or company names used in this set are for identification purposes only. Inclusion of the names of the products or
companies does not indicate a claim of ownership by IGI Global of the trademark or registered trademark.
All work contributed to this book is new, previously-unpublished material. The views expressed in this book are those of the
authors, but not necessarily of the publisher.
Editorial Advisory Board
Kassem Saleh, Kuwait University
Sajjad Madani, COMSATS Institute
Badar Hussain, KCI Engineering
Omer Mahmoud, Int’l Islamic University
Panel of Reviewers
Alfredo Pironti, Politecnico di Torino, Torino, Italy
Athar Mahboob, National University of Sciences & Technology, Pakistan
Badar Hussain,
Davide Pozza, Politecnico di Torino, Torino, Italy
Junaid Ahmed Zubairi, State University of New York at Fredonia, New York, USA
Junaid Hussain, National University of Sciences & Technology, Pakistan
Kashif Latif, National University of Sciences & Technology, Pakistan
Morgan Henrie, Morgan Henrie Inc.
Omer Mahmoud, Int’l Islamic University
Riccardo Sisto, Politecnico di Torino - Dip. di Automatica e Informatica, Corso Duca degli Abruzzi,
Torino, Italy
Sajjad Ahmed Madani, COMSATS Institute of Information Technology, Abbotabad, Pakistan
Shakeel Ali
Sohail Sattar, NED University of Engineering & Technology, Karachi, Pakistan
Syed Ali Khayam, School of Electrical Engineering & Computer Science, National University of Sci-
ences & Technology, Pakistan
Wen Chen Hu, Dept. of Computer Science, University of North Dakota
Table of Contents
Foreword................................................................................................................................................ xi
Preface................................................................................................................................................... xii
Acknowledgment................................................................................................................................ xvii
Section 1
Mobile and Wireless Security
Chapter 1
Securing Wireless Ad Hoc Networks:State of the Art and Challenges.................................................... 1
Victor Pomponiu, University of Torino, Italy
Chapter 2
Smartphone Data Protection Using Mobile Usage Pattern Matching................................................... 23
Wen-Chen Hu, University of North Dakota, USA
Naima Kaabouch, University of North Dakota, USA
S. Hossein Mousavinezhad, Idaho State University, USA
Hung-Jen Yang, National Kaohsiung Normal University, Taiwan
Chapter 3
Conservation of Mobile Data and Usability Constraints....................................................................... 40
Rania Mokhtar, University Putra Malaysia (UPM), Malaysia
Rashid Saeed, International Islamic University Malaysia (IIUM), Malaysia
Section 2
Social Media, Botnets and Intrusion Detection
Chapter 4
Cyber Security and Privacy in the Age of Social Networks.................................................................. 57
Babar Bhatti, MutualMind, Inc., USA
Chapter 5
Botnets and Cyber Security:Battling Online Threats............................................................................. 75
Ahmed Mansour Manasrah, National Advanced IPv6 Center, Malaysia
Omar Amer Abouabdalla, National Advanced IPv6 Center, Malaysia
Moein Mayeh, National Advanced IPv6 Center, Malaysia
Nur Nadiyah Suppiah, National Advanced IPv6 Center, Malaysia
Chapter 6
Evaluation of Contemporary ADSs....................................................................................................... 90
Ayesha Binte Ashfaq, National University of Sciences & Technology (NUST), Pakistan
Syed Ali Khayam, National University of Sciences & Technology (NUST), Pakistan
Section 3
Formal Methods and Quantum Computing
Chapter 7
Practical Quantum Key Distribution.................................................................................................... 114
Sellami Ali, International Islamic University Malaysia (IIUM), Malaysia
Chapter 8
Automated Formal Methods for Security Protocol Engineering......................................................... 139
Alfredo Pironti, Politecnico di Torino, Italy
Davide Pozza, Politecnico di Torino, Italy
Riccardo Sisto, Politecnico di Torino, Italy
Section 4
Embedded Systems and SCADA Security
Chapter 9
Fault Tolerant Remote Terminal Units (RTUs) in SCADA Systems................................................... 169
Syed Misbahuddin, Sir Syed University of Engineering and Technology, Pakistan
Nizar Al-Holou, University of Detroit Mercy, USA
Chapter 10
Hardware and Embedded Systems Security........................................................................................ 180
Muhammad Farooq-i-Azam, COMSATS Institute of Information Technology, Pakistan
Muhammad Naeem Ayyaz, University of Engineering and Technology, Pakistan
Section 5
Industrial and Applications Security
Chapter 11
Cyber Security in Liquid Petroleum Pipelines..................................................................................... 201
Morgan Henrie, MH Consulting, Inc., USA
Chapter 12
Application of Cyber Security in Emerging C4ISR Systems and Related Technologies.................... 224
Ashfaq Ahmad Malik, National University of Sciences & Technology, Pakistan
Athar Mahboob, National University of Sciences & Technology, Pakistan
Adil Khan, National University of Sciences & Technology, Pakistan
Junaid Zubairi, State University of New York at Fredonia, USA
Chapter 13
Practical Web Application Security Audit Following Industry Standards and Compliance................ 260
Shakeel Ali, Cipher Storm Ltd, United Kingdom
Index.................................................................................................................................................... 311
224
Chapter 12
Application of Cyber Security
in Emerging C4ISR Systems
Ashfaq Ahmad Malik
National University of Sciences & Technology, Pakistan
Athar Mahboob
National University of Sciences & Technology, Pakistan
Adil Khan
National University of Sciences & Technology, Pakistan
Junaid Zubairi
State University of New York at Fredonia, USA
ABSTRACT
C4ISR stands for Command, Control, Communications, Computers, Intelligence, Surveillance &
Reconnaissance. C4ISR systems are primarily used by organizations in the defense sector. However,
they are also increasingly being used by civil sector organizations such as railways, airports, oil, and
gas exploration departments. The C4ISR system is a system of systems and it can also be termed as
network of networks and works on similar principles as the Internet. Hence it is vulnerable to similar
attacks called cyber attacks and warrants appropriate security measures to save it from these attacks
or to recover if the attack succeeds. All of the measures put in place to achieve this are called cyber
security of C4ISR systems. This chapter gives an overview of C4ISR systems focusing on the perspective
of cyber security warranting information assurance.
DOI: 10.4018/978-1-60960-851-4.ch012
Copyright © 2012, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited.
Application of Cyber Security in Emerging C4ISR Systems
225
Application of Cyber Security in Emerging C4ISR Systems
of leadership and are commonly known as C2. may require the plan to be updated or revised.
The facilities used by commanders and leaders When the mission has achieved the required effects
in carrying out their assigned missions are large- the current set of command and control activities
ly dependent on communication and computers come to an end. The model distinguishes between
hence terms C3 and C4 are well known and ac- ‘command’ activities and ‘control’ activities.
cepted. The I of C4ISR represents Intelligence, Command comprises proactive, mission-driven,
i.e. the collecting of information which is required planning and co-ordination activities. Control
by leaders/commanders to carry out a mission. comprises reactive, event-driven monitoring and
Hence the terms C3I and C4I started coming into communication activities. The former implies the
use over a period of time. The information is transmission of mission intent whereas the latter
gathered through intelligence, surveillance and implies reactions to specific situations.
reconnaissance which is the reason for the ISR
part. The systematic observation of certain things Nowadays the trend of using the information,
is called surveillance whereas observations on communication and computer technologies has
specific occasions is defined as reconnaissance. increased manifolds. Their use in medical, defense,
Hence, the systems are now collectively termed banking, education, research etc., or we can say that
as C4ISR systems (Anthony, 2002). in every walk of life has quite obviously increased.
The overall purpose of a modern C4ISR System The use of PDAs, laptops, mobile phones, ipods,
is to achieve a better Command & Control of a gaming and communication devices in our day to
situation (i.e. in the battlefield, at sea, disaster day life has increased tremendously. Everyone is
management, etc.) through good and updated on-line and connected together through a network
ISR functions and using the latest computer and of computers. The use of similar technologies in
communication technologies effectively. A very defense sector has also increased in order to get the
brief and comprehensive C2 model which has benefit of improvement in operational capabilities
been basically derived from tactical level but also at less cost. Hence the information is shared with
fits in higher more strategic levels is described all stakeholders in the military chain of command
as bottom up approach for design of C2 systems through networking of equipment/systems of de-
(Anthony, 2002) (Stanton, et. al., 2008): cision makers, their implementers/effectors and
having information sources. There are different
It is proposed that the command and control ac- network oriented defense terminologies in use
tivities are triggered by events such as the receipt such as Network-Centric Warfare (NCW) by the
of orders or information, which provide a mission US-DoD (US-DoD, 2005), Network Enabled
and a description of the current situation of events Capability (NEC) by the UK (MoD, 2004) and
in the field. The gap between the mission and the Network-Based Defense (NBD) by the Swedish
current situation lead the command system to Military (Nilsson, 2003), for example. These
determine the effects that narrow that gap. This terms are also similar to C4ISR. Figure 2 shows
in turn requires the analysis of the resources and the network oriented defense concept in which
constraints in the given situation. From these the decision makers, the effectors and information
activities, plans are developed, evaluated and se- sources are interconnected in a common network.
lected. The chosen plans are then rehearsed before The services on the network are used by all stake-
being communicated to agents in the field. As the holders. C4ISR works on a similar concept.
plan is enacted, feedback from the field is sought Despite the fact that C4ISR systems have their
to check that events are unfolding as expected. origins in security centric organizations like the
Changes in the mission or the events in the field military, cyber security of these systems, for
226
Application of Cyber Security in Emerging C4ISR Systems
various reasons discussed later in this chapter, is col suite. TCP/IP development was also initiated
still an open question and an area which is and supported by the US-DoD. TCP/IP forms the
keenly being researched. In this chapter we shall foundation of all modern network applications and
provide an overview of the current state of cyber C4ISR systems are no exception. An appreciation
security of C4ISR systems. We shall provide of security vulnerabilities inherent in original TCP/
references to additional material which the IP protocols will put forward many cyber security
reader may access to get further details. Now we considerations for the C4ISR system design and
provide information on the organization of the uses. In section 7 we discuss the cyber security
remainder of our chapter. of various of C4ISR components including the
After this introduction, section 2 goes into operating systems, Electronic Mail systems, Com-
more details of the C4ISR system themselves. munication Systems from the end to end perspec-
This should provide sufficient frame of reference tive, communication data links and Identity and
for a reader not already familiar with the C4ISR Access Management Systems. In section 8 we
systems. In section 3 we provide the cyber security provide examples of many of the success stories
requirements of C4ISR systems and the threats and best practices for cyber security of C4ISR
to which these systems are exposed. In section system components. We emphasize on current
4 we provide various case studies of reported trends and approaches and, wherever possible,
cyber security breaches in C4ISR systems. The we provide examples of noteworthy projects and
sample of reported cases which we present should initiatives. In section 9 we discuss the increas-
justify the relevance and importance of the cyber ing use of open source information processing
security requirements of C4ISR systems. In sec- modules as building blocks for C4ISR systems.
tion 5 we discuss the cyber security aspects of Finally, we conclude our chapter by summa-
the standardized C4ISR architectures. Here we rizing the findings presented in the entire chapter
primarily focus on the DoDAF, a well accepted and highlight some directions for future research
C4ISR architectural framework. In section 6 we in cyber security of C4ISR systems.
discuss the security aspects of the TCP/IP proto-
227
Application of Cyber Security in Emerging C4ISR Systems
255
Application of Cyber Security in Emerging C4ISR Systems
Jenkins, D. P. Contributing author (2008). Mod- Walker, G. H., Stanton, N. A., Salmon, P. M.,
eling Command and Control: Event Analysis of & Jenkins, D. P. (2009). How can we support
Systemic Teamwork. Ashgate: Aldershot. the commander’s involvement in the planning
process? An exploratory study into remote and
Salmon, P. M., Stanton, N. A., Walker, G. H.,
co-located command planning. International
Jenkins, D. P., Ladva, D., Rafferty, L., & Young,
Journal of Industrial Ergonomics, 39(2), 456–464.
M. S. (2009). Measuring situation awareness in
doi:10.1016/j.ergon.2008.12.003
complex systems: Comparison of measures study.
International Journal of Industrial Ergonomics,
39(3), 490–500. doi:10.1016/j.ergon.2008.10.010
KEY TERMS AND DEFINITIONS
Walker, G. H., Stanton, N. A., Jenkins, D. P., &
Salmon, P. M. (2009). From telephones to iPhones: Active Attack: An attack in which the adver-
Applying systems thinking to networked, in- sary undertakes unauthorized modification of data
teroperable products. Applied Ergonomics, 40(2), or information system assets.
206–215. doi:10.1016/j.apergo.2008.04.003 Community of Interest (CoI): COI is a
Walker, G. H., Stanton, N. A., Salmon, P., Jenkins, collaborative grouping of users who share and
D. P., Monnan, S., & Handy, S. (2009). An evolu- exchange information in the pursuit of common
tionary approach to network enabled capability. goals or missions.
International Journal of Industrial Ergonomics, COMSEC: Communication Security mea-
39(2), 303–312. doi:10.1016/j.ergon.2008.02.016 sures include using encryption and ciphering
techniques for protecting the contents of data from
Walker, G. H., Stanton, N. A., Salmon, P. M., being deciphered, if intercepted by an intruder/
Jenkins, D., Revell, K., & Rafferty, L. (2009). eavesdropper.
Measuring Dimensions of Command and Control Cyber Security: Cyber security is coordinated
Using Social Network Analysis: Extending the actions in order to prevent, analyze and react in
NATO SAS-050 Model. International Journal case of cyber attacks.
of Command and Control, 3(2), 1–46. INFOSEC: Information Security are measures
Walker, G. H., Stanton, N. A., Salmon, P. M., which ensure the integrity, availability and confi-
Jenkins, D., Stewart, R., & Wells, L. (2009). Us- dentiality of data and IT related services.
ing an integrated methods approach to analyse Passive Attack: An attack in which the adver-
the emergent properties of military command and sary does not modify data or system is and only
control. Applied Ergonomics, 40(4), 636–647. observes data or system information or activity.
doi:10.1016/j.apergo.2008.05.003 TEMPEST: Transient Electromagnetic Pulse
Emanation Standard are the measures undertaken
Walker, G. H., Stanton, N. A., Salmon, P. M., & to ensure that the electromagnetic transmissions
Jenkins, D. P. (2008). A review of sociotechni- from equipment can’t be intercepted to derive
cal systems theory: A classic concept for new information about the equipment’s operation and
command and control paradigms. Theoretical the data it processes.
Issues in Ergonomics Science, 9(6), 479–499.
doi:10.1080/14639220701635470
256
Application of Cyber Security in Emerging C4ISR Systems
APPENDIX: ACRONYMS
257
Application of Cyber Security in Emerging C4ISR Systems
258
Application of Cyber Security in Emerging C4ISR Systems
259