CYBER

SECURITY
BY EDWARD AMOROSO
PURCHASE THIS BOOK

AN EXCERPT: CHAPTER 3 - THE EFFECTS OF CYBER ATTACKS

CHAPTER 3
THE EFFECTS OF CYBER ATTACKS

C OMPUTER SECURITY EXPERTS have a

favorite, albeit somewhat worn, joke question
that they never seem to tire of posing to unsus-
pecting victims. Here's how it goes:
With this consideration in mind, I will state that
to my knowledge no one has ever noticed catastrophic
problems for government or business infrastructure as
a result of cyber attack. Perhaps a massive e-catastro-
“So, have you ever been hacked?” asks the cyber phe is occurring right now under our noses, but its
security expert to the unknowing victim. effects have not yet been noticed. Again, you cannot
“Uh, no. We haven't been hacked,” goes the response. measure or even comment on what you do not notice;
The expert then raises an eyebrow. my point is that nothing of enormous consequence
“You mean, there haven't been any attacks that you've and reach has been noticed.
noticed.” Certainly, we have seen our share of cyber security-
The point here, in case you missed it, is that you related effects across a range of computer and
cannot measure what you do not observe. So, anytime network systems. Peter Neumann from SRI
someone says that they've never been hacked, you can International moderates a comprehensive list of
challenge their claim as outlined above (hopefully reported risks to the public from computer
without having to repeat this bad joke). malfunction and attack. A brief perusal of his list

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 2

(Internet search terms: Neumann, Risks) shows Theft: This involves something of value being
immediately that the effects of cyber security can be stolen. Network service providers worry quite a bit
considerable. about this problem, which they refer to as fraud. In the
Some familiar examples: Companies regularly get telecommunications industry, fraud protection has
hacked and their email services are corrupted, matured steadily over the past few years – primarily to
especially by phishing attacks. Government agencies avoid lost revenue.
experience breaches that disrupt the services they offer. Integrity: This threat involves an asset being
A school grading system is compromised by a thirteen- intentionally damaged. Examples include your PC
year-old who gives himself an 'A' in Earth Science. being corrupted, files being infected, or some system
Individuals have their PCs infected with viruses that attribute being changed. Any time a virus gets into your
make it hard to run applications normally. Networks computer and causes problems, that is an integrity
get infected with worms that cause volumes of packets threat.
to bring processing to a screeching halt. The list goes on Denial of Service: This is when some service is
and on. intentionally blocked. This usually involves the denial
In spite of these examples, we must acknowledge of authorized access to network service or telephony.
that while businesses, governments, and individuals Some experts believe this to be the most difficult of all
have felt the negative impact of cyber attack, no digital threats to deal with effectively.
Pearl Harbor cyber attack has been broadly noticed in As we will see, security in computing is thus not
any country or business. At the risk of beating a dead some monolithic notion, but rather a spectrum of
horse, we repeat that this does not mean that such damage that can occur with respect to computer and
attacks cannot ever occur. It just means that one network systems. “Bad things,” writes Ian Witten in a
probably hasn't happened yet – thankfully. classic 1987 essay about cyber security, “range from
minor but rankling irritations, through theft of

Four Types of information, to holding users ransom.”

For example, consider that the theft of someone's
Security Threats personal identity is quite different from the theft of
wartime logistic information – even though both
If you were enrolled in my graduate course on cyber would be referred to as security issues. Similarly,
security at the Stevens Institute of Technology, you'd blocked access to a financial Web site is quite different
learn during the first lecture that the effects of cyber from blocked access to a children's game site. In either
security attacks come in four flavors: disclosure, theft, case, a very different constituency (and age group)
integrity, and denial of service. Here is a brief list of would be targeted in the attack. Furthermore, different
what each entails: attack motivations and methods would be employed in
Disclosure: This is when secret information leaks the security solution.
to the bad guys. This information could be credit card To properly understand the true consequences of
numbers, government secrets, battle plans, or your cyber attack, we need to zero in on these four different
latest video rentals. The disclosure threat can cause a types of security threat – focusing on their history,
range of impacts from personal embarrassment to impacts, likelihood, and preventive measures. The
national security consequences. resultant insight will not only help the reader better

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 3

understand cyber security, but will also highlight some preoccupied with the threat that the Russians would
serious public issues for the protection of critical use computers to peek at American military secrets.
infrastructure. Two creative researchers from the Mitre Cor-
poration, David Bell and Len LaPadula, were among
Disclosed Secrets the first to publish meaningful results in this area. They
examined how the United States military protected
paper documents. They looked at the process of docu-
The disclosure threat involves sensitive information
ment classification, which allowed the military to
falling into the hands of bad guys. In the context of
define which people could gain access to which types of
national cyber attack, bad guys are probably a given
information. They found that a document classified as
nation's hated enemies. For Americans, this could range
top-secret, for example, could only be read by someone
from al Qaeda terrorists, to organized cyber attack
with a top-secret clearance. Similarly, an unclassified
groups stealing information from sensitive government
document could be read by anyone.
or corporate systems.
Bell and LaPadula quickly realized that this
Ordinary individuals tend to worry about
disclosure concept could be applied to the multi-user,
disclosure in the context of their personal information.
shared computers that were coming into use at the
Imagine, for a moment, that you've left a copy of your
time. Their approach worked roughly as follows: All of
tax return papers on the copy machine at the office.
the information on a shared computer would be
You'd probably drive fifty miles in the dead of night to
marked to some security classification, such as secret or
retrieve it. The obvious problem is that when this sort
top-secret. Then, all users on that system would be
of information is available on-line, then all the driving
associated with clearances, generally based on their
in the dead of night will provide no protection
background or job function. The operating system on
whatsoever. Furthermore, an on-line attack doesn't
the computer would enforce the desired security policy.
require proximity.
In practice, things were more slightly complicated
One curious and rarely discussed aspect of people's
because the military partitions information into
private lives involves on-line browsing habits. If a
“need-to-know” categories. Thus, within the top-secret
person's browsing habits are mundane, then compro-
classification, data must be compartmentalized into
mise might be of no consequence. But for those who
more specialized groupings. To manage the complexity,
enjoy visiting more marginal sites, this information is
most classified government projects – then and now –
often best kept private. Your service provider, for
employ teams of people to keep the security scheme
example, should protect this information from prying
straight. Bell and LaPadula knew that the computer
eyes – including those of their own employees. “There's
version of this would require similar administration.
a fine line between customer service and stalking,”
Some Unix-based computer operating systems were
writes cryptography expert Bruce Schneier.
actually built in the 1980's to implement this type of
In the mid 1970's, United States government
military security policy. At AT&T, Chuck Flink led an
researchers began seriously studying the disclosure
effort aimed at trying to get the concept correct for
threat as it related to computers. This early research
Unix. The resulting system, referred to as multilevel
wasn't so much concerned with personal information as
secure, could enforce the familiar policy that highly
it was with traditional Cold War tensions. As a result,
cleared users could read any file in any directory, but
the vast majority of early disclosure research was
that lowly cleared users were restricted to less sensitive

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 4

information. Thus, a user would have to be cleared to Encryption has certainly been one method that
top-secret to open and read a top-secret document. So has been used at length to try to prevent disclosure
far, so good. problems. Encrypting data has always worked especial-
But the policy also stipulated that highly cleared ly well for information that is in transit. The military
users could not write information into lesser-classified encrypts voice, for instance, using special “secure”
documents. This ensured that classified information phones. To listen in, the enemy would have to tap and
didn't find its way into an unclassified document. An decrypt the information in real-time – a task that has
assumption was being made here that users logged into proven particularly difficult for good encryption
the system in “top-secret” mode, could only generate methods.
top-secret information. This is not a reasonable When information is stored, however, encryption
assumption, but it was made nevertheless. protection hasn't proven as dependable. One reason is
Furthermore, the policy allowed for lesser-cleared that the keys used to decrypt stored information must
individuals to write content to pretty much anything be stored. If these keys are lost or mishandled, the
they wanted. After all, what was the harm in unclassi- information could be lost forever. This leads to
fied information making its way into a classified baroque escrow schemes in which third parties keep
document? The result of this was the weird anomaly emergency copies of the key information. Law
that unclassified users could write information into a enforcement has taken the extra step of suggesting that
top-secret document, but could not then read or review such escrowed keys could be used to decipher
what they had written. This was called a blind write. encrypted conversations. As you might guess, this has
(Are you confused yet?) not been a popular suggestion.
The clumsiness and inconvenience of such In spite of all this, organizations have not stopped
operation, combined with a generally low concern for trying to create encryption schemes for protecting both
computer security across the globe at the time, dealt their in-transit and stored information. The payment
multilevel secure systems a painful blow. As the public card industry, for example, recently enacted a series of
Internet and the Web emerged, most computer users' privacy-oriented security requirements on its partici-
tolerance for restriction of information grew even pants. These requirements include provision for
lower. After all, what was the Internet for, other than to encrypting all customer sensitive data. This turns out
share, rather than restrict access to data? Products that to be especially difficult for legacy applications that
supported military disclosure functionality died slow include no support for such encryption.
and painful deaths. Ironically, many of the companies in this industry
Since that early research, very little progress has have wasted more time complaining about the
been made in the prevention of disclosure threats on problems implementing encryption than they have
computers. Some researchers have since created more actually trying to create a workable scheme. Time will
refined mathematical models of disclosure based on tell whether encryption of stored information has
how people deduce information. But to be honest, very much impact on prevention of privacy problems.1
few people in the computing community even noticed The potential disclosure of information in enter-
this work. It didn't help that most of these papers could prise networks run by organizations is often addressed
only be understood by people with PhD degrees in very poorly as well. Most companies tend to operate their
specialized branches of mathematics. entire network at one common security level – usually

1
By the way, disclosure issues, in a personal context, are referred to collectively as privacy.

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 5

something related to proprietary markings. In most

companies, the perimeter of the organizational
Theft
Intranet is the vehicle for such protection. So, if you are Suppose that a well-dressed young man hops aboard a
a legitimate employee, then you can see everything; southbound Amtrak train in Baltimore. It's very early
otherwise you aren't able to see anything – or at least in the morning, and hardly anyone else is on the train.
that's the intent. The conductor comes over to the passenger requesting
The perimeter protection of an Intranet is typical- a ticket, but the young man pleads for mercy.
ly accomplished using devices called firewalls. The sad “Sir, I don't have a ticket because I don't have
news is that firewalls can be penetrated or by-passed any money,” he explains. “I'm on my way to an inter-
quite easily in most environments. Furthermore, view in Washington. This is my big chance. Can you
Intranets are notorious for having unauthorized and please let me ride without paying?”
unknown connections to the outside through which The conductor frowns.
bad guys can gain access and peek at information “Please, sir,” the young man pleads. “There
(Hint: think WiFi). As a result, disclosure protections aren't many other passengers in this entire car. I'm not
in many organizations are little more than a sham. bothering anyone. My presence is having absolutely no
Suppose, for example, that you are an evil negative effect on the operation of this train. Can't you
criminal and you want to obtain intellectual property please let me ride down to my interview in Washington
and sensitive information from Bank XYZ. You could for free?”
try to hack your way in, but that might be messy. The conductor takes off his cap and scratches his
Perhaps a better approach would be to just apply for a head as he ponders this little dilemma. What harm, he
job at the bank. Then, once you're at your new job, you wonders, is this kid really causing? He knows that
build a volume of downloaded information from their Amtrak is a big company and if the young man is
Intranet (you're an employee, remember?). After you allowed to ride for free, maybe some good will come if
have what you want, you can quit and move on it. Maybe he will even bring the money back later, after
to the next bank. It's reasonably foolproof in most he gets his job.2
environments. This train conductor's dilemma is similar to the
For information stored on PCs, the disclosure fraud decisions that security engineers must make as
threat is addressed through mostly non-technical they ponder the impacts of theft. Service providers, in
means. Specifically, most people will try to delete what particular, have been forced to consider such scenarios
they do not think they need, such as their temporary in great detail. The services in question are most often
Internet files and any cookies that might reside on their telephony or Internet access, and the excuses for theft
hard drive. They will then protect the remaining files are just as creative and real as we saw with the young
and data by simply turning off the PC and, if it's a man riding the train to Washington.
laptop, storing it in the closet. You probably already know that theft of phone
We all know, however, that when PCs are connect- and Internet services is so common that some
ed to networks, they are immediately exposed to all youngsters believe it to be a socially acceptable activity.
sorts of security threats. This is not to say that every The early activist Abbie Hoffman urged his followers
time you connect your PC to the Internet hackers peek to rip off the phone company at every opportunity.
in at your checking account, but there are often no Today, the hacking community openly targets
controls to ensure that this cannot happen.
2
When I pose this scenario to my students, the responses are split between throwing the bum off and showing mercy.
I have no idea what this means other than that half are destined for upper management (I won't say which half ).

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 6

telecommunications in their mischievous explorations. credit cards; or it could end up in the hands of
In response, most phone companies today have estab- criminals who sell identities on underground Web
lished large security and fraud divisions that deal on a sites; or it could be placed in the hands of a cyber
day-to-day basis with people trying to steal service. criminal using this information to establish anonymous
It turns out that stopping fraud on the Internet is a on-line accounts. All of these are frightening prospects.
bit more difficult than with traditional voice services. Unfortunately, few good solutions exist to stop
The identity and location of end points, for example, phishing. A recent study in the State of New York
are tough to accurately determine on the Internet. showed a that sizeable percentage of employees sent a
Furthermore, the motivation to stop Internet theft is test phish, went ahead and took the bait. Many took
somewhat more complex than with voice service. For the bait again, after being warned that the original
example, if someone is stealing expensive minutes on phish was a test! So while end-user education and
your long distance service, then it pays to stop this. But awareness campaigns are necessary, they don't always
if someone is stealing time on an Internet or voice work too well.
account that is already flat rate for unlimited use, then One promising technique that has been discussed
what's the problem? Would you even notice if someone involves using stronger forms of authentication for any
was occasionally borrowing your on-line account to type of interaction between, say, a bank and its
browse the Web? customers. The idea is that you would be issued
Identity theft is the newest form of cyber theft, and something like a hardware token by the bank when you
it is rather alarming in its potential consequences. The agree to do on-line banking. Thus, even if your
most common identity theft method involves the use identity were stolen via a phishing attack, the thieves
of a technique known as phishing. In a typical phishing would not be able to clean out your checking account
scam, email notifications are sent to unsuspecting users unless they also had your hardware security token. This
that they must take some immediate action, such as may be a good approach, but it has sizeable cost
re-enrolling for their Internet service by supplying implications.
personal information. Bogus Web sites on hacked With the recent rush of phishing attacks, compa-
systems are often established to support such theft nies have now begun to take serious notice of the
operations. threat. While many companies remain ambivalent
“Warning,” such messages might start, “to ensure about employees being caught in identity theft scams,
the fine quality of service you are used to, you must as phishing scams have expanded in scope, organiza-
immediately go to the following Web site (the link tions now realize that viruses can be delivered to the
would be embedded) to verify your account informa- enterprise via this technique.
tion. We'll need your email password, your mother's The paradoxical result is that companies are now
maiden name, and your social security number. Failure being forced to address fraud, not so much to protect
to take this action immediately will result in your the personal information of their employees, but rather
account being terminated.” to preserve the integrity of their corporate computer
Once the unsuspecting user visits the Web site and and network systems. Regardless of the motivation,
provides this private information, the thieves grab it, one should expect the risk of identity theft and
catalogue it, and sell it. Such information might end up phishing problems to diminish for those who access the
in the hands of people who will charge items to your Internet from an organizational Intranet.

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 7

For normal citizens, one already sees service This law firm might have protected themselves
providers beginning to accept the task of protecting from such an attack by a few simple steps. Treating
their users from these types of scams. Certainly, their employees with respect would have been a good
extensions to anti-virus and anti-Spam software start, since removing the motivation for an attack is
packages exist to help identify theft situations in always the best approach. But functional strategies do
various types of malware, but the truth is that people exist for ensuring integrity in a business-computing
remain pretty gullible. The only protection many environment. They could have had back-ups; they
Internet users will ever have is if some omnipotent could have had a change-tracking system; they could
provider steps in and makes the problem go away. This have been monitoring audit trails; they could have had
is not easy, but the benefit is significant enough that we access controls on the document to prevent unautho-
should expect broadband providers to begin working rized change; they could have had business controls on
this more aggressively. dealing with fired employees; the list goes on and on.
In the meantime, my advice is that if you receive But the truth is that most companies and groups
an email asking you to supply any sort of personal do not have decent protections from this integrity
information, even if it appears to be coming from threat. Most organizations rarely back up anything but
someone you trust, please reach for the delete key and the most critical information. How often does the
just say, “no.” typical computer user, for instance, back up the routine
files on their PC? Once a day? Once a week? Ever?

Destroying and Furthermore, unlike the disclosure threat, which

received considerable attention in the early years of
Deleting Assets computer security, the integrity threat has been largely
ignored by researchers and funding authorities.
Several years ago, a team of young New York paralegals Back in the 1970's, a Mitre researcher named Ken
had just finished working days and nights preparing a Biba was studying the integrity problem, largely from
lengthy legal document. They'd worked like dogs the perspective of protecting military systems. He came
getting every sentence perfect and every punctuation to the conclusion that integrity, unlike disclosure, was
mark just so. After all, even a minor error in this really just a measure of one's expectation. A person of
document could change its meaning and cost the firm high integrity, for example, is someone you can trust,
millions. someone who lives up to a high expectation. Similarly,
Just before the document was to be printed and a high integrity document is one that is correct, has
delivered to the court, the paralegals were all called into value, and has not been tampered with.
a room and fired. While they were packing to leave, Biba also observed that people with high integrity
however, one person decided to take some revenge. He routinely avoided documents of low integrity. This is
went back to the computer and made a few creative why we prevent children from viewing low integrity
adjustments in the document – ones that would be materials, like certain magazines and Web sites. If we
tough to find. In computer security terms, we would did not take this preventive measure, then our children
say that the integrity of the overall document was would be presumably corrupted and their integrity
degraded. Its validity was now in question and its would be irrevocably reduced. Some people joke that
contents could no longer be trusted. exposure to low integrity materials causes us all to start

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 8

life with the highest level of integrity – and then how this model could be used to improve integrity
throughout our life, we embark on a constant process protection on computer systems.
of ever-dropping integrity. The model is based on the observation that the
Low integrity individuals are also routinely integrity of computing environments could benefit
prevented from contributing to high integrity docu- most from the types of things that businesses do to
ments. It's sort of like stopping a profane, vulgar person make sure their financial books remain in order. They
from changing passages in an important religious explained that performing tasks such as ensuring valid
document. The information entered by the low integri- transactions, logging all activity, ensuring good
ty individual would have the effect of lowering the back-ups, and allowing only certain people to access
integrity of the document. A much better approach, of certain important assets, would prove useful to
course, is to prevent this from occurring in the first engineers trying to ensure integrity.
place. The basis for the model is similar to how your
Biba tried to apply these observations to checking account works. Every transaction you log in
computer systems and interesting results emerged. One your checking account starts with all entries in a valid
interesting Unix system developed at Bell Labs in the state (you hope). Once you complete a transaction,
1980's used Biba's approach to protect itself miracu- such as writing a check or making a deposit, you
lously from worms.3 It kept low integrity programs perform the associated log entry to make sure
connected to networks from ever writing anything into everything remains in a valid state.
the high integrity systems files. Bell-La Padula controls Clark and Wilson reasoned that computer
were then imposed upside-down to enforce the systems could be designed in the same way. Only valid
separation. The system gave you a bit of vertigo, but it transactions could be allowed to occur on systems that
worked like a charm. were already in a valid state. Mathematicians cleared
You'd think that such functionality would be things up for the masses by explaining that this part of
useful today. Unfortunately, systems like this didn't sell, the model produced something called “inductive
because information technology managers deemed closure.”
them too inconvenient. I wonder if these managers Unfortunately, this concept turned out to be
have since bothered to measure the inconvenience of much easier said than done. How, for example, would
responding to an endless stream of network viruses on you demonstrate validity for a PC running the
their systems. Perhaps the inconvenience of using a Windows operating system and the usual set of popular
more secure system might not seem so bad in applications? Or how could one ever state, for instance,
comparison. that such a system is in a valid state if it must be patched
In the 1980's, another research project had some every month? Or how could one ensure that only valid
influence on our collective thinking about integrity in transactions are allowed to occur when viruses and
the cyber security community. The project was led by other malware find their way onto our systems so
David Clark, a computer scientist from MIT, and easily?
David Wilson, from the accounting firm of Ernst and In the end, the Clark-Wilson model was excellent
Whinney. Their work resulted in what we now know as theory, but too difficult to implement in practice. Most
the Clark Wilson Model. Several working groups were security experts are ignorant of the model, and almost
created in the late 1980's and early 1990's to determine no real systems have been built using the basic tenets of

3
By the way, disclosure issues, in a personal context, are referred to collectively as privacy.

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 9

the model. This is a shame. an engraved stone. Engraved on this stone were the
So how do we maintain integrity in computer names of the developers.
systems? For the most part, we don't. People buy a Similarly, an earlier version of Microsoft's Word
home computer at Best Buy, plug it into the Internet program could be turned into a pinball machine by a
and then use it to browse and send email. Over time, simple sequence of points, clicks, and simple text entry.
the system becomes increasingly muddled with viruses I've demonstrated this frequently, and people are con-
and Trojan horses. The anti-virus license expires, and sistently floored at how little they understand about
soon the whole system becomes unusable. The result is the software on their computers. Here is something I
that person goes out and buys a new system - and the think we all agree on:
cycle begins again. As you would guess, the computer No justification exists for intentional Easter
industry has no problem with this approach. Eggs or Trojan horses, however innocent,
Mind you, security tools do exist for detecting to be placed in software by developers.
changes to a system. These tools often scan the target Unfortunately, no evidence exists that the integri-
system periodically looking for anything that might ty of critical infrastructure systems is protected more
have changed. A couple of decades ago, Fred Grampp effectively than in home settings. This could be obvi-
from Bell Labs invented the first such program - one ous, such as when a power plant or emergency service
that scanned a Unix system for vulnerabilities. It environment includes the types of virus-prone PCs you
checked for unused accounts, programs with too much might find in the home. But it could also be more sub-
system privilege, bad passwords, and so on. Computer tle, such as when custom developed software contains
system administrators do this routinely now, but the integrity problems due to insufficient levels of assur-
whole process traces it lineage to this early work at Bell ance and verification performed during development.
Labs. This does not mean that the most recent virus to
Now that I've said such nice things about Fred's hit your PC could also take out the computers in your
scanning program, let me offer a sobering reality: a local nuclear power plant. But you never know.
professional cyber terrorist can attack systems without
breaking a sweat at scanners. Computer scanners are
designed to test for known problems. If some
Denying Service
previously unknown or unreported problem happens The concept of denying service is easy for most people
on your system, then a scanner will not be able to detect to grasp. See if any of the following analogous scenarios
this in any way. 4 are familiar to you:
You may not know this, but the software you buy • You're in a rush to get to work, but the traffic
for your home computer might be embedded with is so thick you can barely move ten feet.
intentional Trojan horses before you even unwrap and • You're trying to get onto an important confer-
install the software. These gems, referred to as Easter ence call, but the signal on your cell phone is too
eggs by software developers, are inserted quietly into weak to connect.
code and represent an artistic means for the authors to • You're watching the World Series and it's the
sign their work. For example, recent versions of ninth inning of a tie game during a crucial at-bat,
Microsoft's Excel program could be turned into a flight and your satellite coverage suddenly goes out.
program where you fly over bumpy terrain in search of When these scenarios occur, we generally just resign

4
Fred Grampp receives little credit for his pioneering work in scanning. Industries are based on concepts he invented - and people don't know his name.

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 10

ourselves to the fact that stuff happens. And we deal information associated with an attack to the true attack
with it. source is extremely difficult due to the ease with which
But imagine if, in addition to your inconvenience, intruders can weave a pattern across the Internet.
you also knew that someone was deliberately causing Furthermore, there is the basic physical principle that
this situation. Imagine if that traffic jam was being if a system can only handle so much capacity, then
caused intentionally to make you late. Or if your cell attackers can simply initiate malicious activity that will
signal was being degraded for the sole purpose of exceed that capacity.
keeping you off your call. Or if television coverage was
shut down to keep you from watching your game. Such
infuriating situations correspond to the denial of
How Serious is
service threat. Cyber Terrorism?
Stated explicitly, denial of service in cyber
security involves a malicious intruder intentionally I already know what you're thinking. Cyber security
blocking an important computer or network service threats don't seem anywhere near as bad as hijacking,
from its authorized users. Note that denial of service truck bombs, and biological weapons. While this may
does not correspond to accidental or unintentional be true, there are two issues that must be considered:
outages. Rather, the threat involves someone causing 1. All forms of terror can include a cyber compo-
the problem deliberately. nent - in fact, some can be directly controlled using
Examples of this abound. Perhaps you are a war computers.
fighter and need some on-line tactical information, 2. Serious inconvenience, disruption, and even
only to find that the enemy is actively blocking your misery can be created via cyber attacks.
access. Or perhaps you run an emergency service, and Most people tend to ignore these issues, perhaps
during a serious life-threatening situation, you are because the effects of cyber security attacks are some-
blocked from accessing some important system by some times less obvious. Here's a story to illustrate: Just after
hacker. Or maybe your shipping business allows 9/11, I watched live panel discussion on how to prevent
customers to check package delivery on-line. If a virus future airplane hijacking. One of the experts on the
or worm floods your site and makes it unavailable, then panel endorsed the concept of ground flight control of
you are the victim of a denial of service attack. airplanes to deal with an on-going hijacking. The idea
In a crude sense, repeatedly calling someone on would be that if a plane were hijacked, air traffic control
the telephone is a type of denial of service. By calling would somehow take over the flight controls and ren-
your victim over and over, you are rendering their der the hijackers unable to fly the plane from
phone essentially useless. Methods for dealing with this the cockpit.
problem include pleading with the caller to stop, To my amazement, everyone thought the idea was
contacting the phone company, or notifying the police. marvelous, but beyond our technical capacity. I could
Most of the time, these methods will work for basic hardly believe that they were completely ignoring the
telephony because it's relatively easy to detect the source hacking potential here! Can you imagine the security
of crank phone calls. threats that would emerge if terrorists didn't have to
Unfortunately, this threat is more difficult to actually get onto planes, but could rather break into
defend against on the Internet. Linking IP address

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 11

ground flight control networks and remotely control the consequences of an accident are too high for that
the planes from a network? The very idea makes me baby. When adults get into our car, however, we might
dizzy. be more ambivalent about whether they buckle. This is
because we measure the consequences as being lower.
Calculating Security Risk I have a friend who was a jeweler in a strip mall in
New Jersey. After a long career, he closed his shop, but
decided to re-open on a smaller scale in the basement of
With these frightening threats to systems, you might
his home. This introduced some risk problems in his
find yourself wondering how suitable protections are
home. First of all, the consequences of a break-in
identified. You might also recognize the
increased dramatically since he was now storing
difficulty of countering threats on the inevitable
valuables in his home. And second, the likelihood of an
limited budget that organizations and individuals have
attack increased simply because people were now
for cyber security.
coming into and out of his home, knowing that
For critical infrastructure systems, this is handled
valuables were present.
through an engineering practice known as risk
In order to better understand the consequences of
management. In particular, security professionals
cyber attack on national infrastructure, let's take a brief
measure and manage risk to computer and network
look at how cyber terrorism could affect several of
infrastructure using a simple equation: They multiply
major critical system components.
an estimate of the likelihood of an attack by an estimate
of the consequences of such attack.
Obviously, this requires some sort of numeric Are the Phones Working?
measures to be used as estimates. Perhaps after some
consideration, the security engineer might decide that Many people around the world continue to rely on cir-
likelihood of attack and consequence of attack would cuit-switched telephones - the ones that provide only a
each be given a rating of 3 for high, 2 for medium, and keypad and receiver. They are connected to copper lines
1 for low. These numbers might seem arbitrary, but that run out to traditional public switched
when put in use, they help to demonstrate important telephone network lines. You probably do most of your
relationships. talking on a traditional circuit switched phone in the
For example, a system with high likelihood and kitchen of your home.
high consequence of attack would have a risk equal to Perhaps more importantly, these phones are
3 times 3, or 9. If some step is taken to reduce the typically powered via the trickle of current coming over
likelihood of attack from high to medium, then the risk the phone line. This is critical, because when there is a
is lowered to 2 times 3, which is 6. Similarly, if the power outage in an area, it is often the case that people
consequences of the attack are lowered, then the risk is with feature-rich phones requiring power are unable to
lowered as well, and so on.5 make calls. Many are forced to use their cell phone,
This notion of risk being proportional to both the perhaps plugging it into the car for power. In contrast,
likelihood and consequences of attack is fundamental those with the less feature-rich circuit switched phones
to how we create security defenses. Think about seat are typically unaffected.
belts, for instance: We would never dream of putting a I'm not saying that modern telephones are
baby into a car seat without buckling, simply because undependable. What I am saying, however, is that we

5
Jon Weiss, now at Lucent, led a group at AT&T in the mid-1980's that invented the use of threat trees to calculate risk based on these equations.

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 12

have traded a bit of resiliency in our telephones for the attacks are likely to occur. For this reason, many experts
added flexibility that comes with powered devices. posit that a massive cyber attack on any nation would
Obviously, voice services over the Internet – the not involve any tampering with basic communications
familiar VOIP capability so aggressively marketing backbones. This would be like destroying the roads
today – carry this notion to an extreme. before a ground attack.
The telecommunications infrastructure in the Keep in mind, however, that if the purpose of a
United States can be grouped specifically into a few cyber attack is to deny access to landlines, cable
basic components: First there are the large transport television, mobile telephony, pagers, email, Internet
carrier groups who own miles of underground fiber. access, or even instant messaging, then telecommunica-
These networks support long haul transport of phone tions could easily be targeted. For hackers, this could be
calls, data, video, and Internet browsing sessions. Such attractive, if only for the attention such an attack would
transport systems are like the super highways in our be given. From the perspective of massive cyber attack
freeway system – they let you go fast, and they are to infrastructure, if basic communications are
generally well maintained. But you also need a system obliterated, the effects on a target nation could be more
of off-ramp highways. effective than conventional weapons.
The second component in the American telecom- Denial of service is not the only type of threat to
munications infrastructure includes the local phone, national telecommunications systems. We all know
cable, and satellite providers, who own the wires that citizens, corporations, and government organiza-
connected to buildings and the sides of everyone's tions regularly send and receive valuable information
garage. These local companies also support voice, data, over telephones and computer networks. Such
video, and Internet for customers. They correspond to information is obviously much more at risk if someone
the local roads and off-ramps in our highway system has managed to infiltrate the telecommunications
analogy – they are close to home, tougher to maintain, provider's systems for the purpose of listening. This is
and don't let you go as fast. Many of these companies certainly unlikely, but must be considered.
are now deploying fiber to the home to increase their During the majority of the past half century,
ability to sell bundled services. proprietary circuit-switched technology was used for
The third component in our telecommunications telephone and data connections. This approach proved
infrastructure includes wireless companies. These to be highly reliable in supporting national telecomm-
companies make use of the infrastructure provided by unications needs, as you probably observed.
long haul and local providers, but they also operate Furthermore, the limited exposure to the basics of
towers to which you can connect with your cell phone proprietary telecommunications did have a throttling
and other wireless devices. The integrity of the connec- effect on the number and type of attacks that were
tion path between your phone and the nearest tower present.6
obviously varies across regions – as you recognize With the advent of the Internet and its open,
whenever your signal is dying during an important call. non-proprietary services and protocols, however,
So what are the cyber security risks to telecommu- interesting new opportunities have arisen for hackers.
nications in the United States? In considering this This results in a Catch-22 situation in which our open
question, one must recognize that telecommunication technology prevents hidden catastrophic vulnerabili-
networks provide the means over which most cyber ties, while at the same time allowing any known

6
Be careful with this point. Security experts refer to this type of protection as “security through obscurity,” and it has obvious drawbacks when adversaries
do obtain information about a target system or technology.

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 13

vulnerabilities to be known by everyone. Think of Power systems generate waste, employ large
Internet technology as being in a glass house. numbers of human beings, include huge physical
Perhaps more worrisome is the threat that arises plants, rely on massive electromechanical systems, and
when shared telecommunications services are operated include many, many computers and networks. Such
across the Internet through collective agreements. The computers and networks are of obvious interest to the
Domain Name System (DNS) and the Border Gateway cyber attacker, especially where nuclear power and
Protocol (BGP) are two examples of Internet utilities waste products are being generated. Of course, attack-
that many experts view as being almost trivial to ers fully understand that you don't just break into a core
disrupt. In both cases, individual groups can inject reactor. A better approach is to target the computer
bogus changes to the Internet infrastructure, with no systems that might be connected to, or contain critical
centralized (or even distributed) police force to stop information about, a core reactor.
them. Now, cyber terrorists with a broadband connection
As you might guess, this produces enormous risk cannot cause a Chernobyl-like disaster at your local
to any telecommunications service that relies on the nuclear power plant. But this does not imply that cyber
integrity of the Internet. Email, web services, and any terrorism is a non-issue for power plants and systems,
types of electronic commerce rely directly on jointly especially in the United States. In fact, serious national
operated services such as DNS and BGP. The cyber consequences can occur as a result of the dependence of
security risk here is considerable, and is poorly this industry on computer and network systems.
understood by policy makers in most countries. The software, for example, that is embedded in
power plants appears to be no more reliable or secure

What Happened than any other software developed for less critical
applications. Recall the scenario mentioned in our first
to the Power? chapter in which the Nuclear Regulatory Commission
discovered a safety monitoring computer program with
Human beings are dependent on power – period. a serious bug. The likelihood that additional bugs
Except in the most remote and extreme areas, extended might be present in similar software would seem pretty
losses of power bring great hardship onto residents and high.
businesses. As such, we must presume that cyber The major power system-related question for
terrorists already understand the target-rich environ- most readers is this: Can cyber terrorists shut off the
ment that exists in any nation's power systems. lights in my home? The answer is maybe, but the likeli-
Power generation systems are, for the most part, hood improves greatly if cyber terrorism is combined
either conventional or nuclear. Both involve complex with more conventional terrorist measures. For exam-
systems that heat water to produce steam. This steam is ple, if the objective is to remove power service from a
used to drive turbines that generate electrons onto a specific region, perhaps by dropping a bomb onto a
massive transport network of power lines. The high physical power distribution point, then cyber terrorists
voltage electric power carried on these lines is might use electronic means to obtain maps of how the
gradually reduced to levels that are safe for distribution distribution is designed.
into your home and business. Terrorists might also try to obtain sensitive
information about power system vulnerabilities in a

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 14

given system, especially if they can place insiders into transaction would raise an eyebrow, but in aggregate,
a target power company. The insider problem is the theft can be significant. In the United States,
certainly not unique to the power industry, but the Sarbanes-Oxley controls have reduced the risk of this
consequences of malicious insiders in this industry are attack somewhat. But the potential remains.
obviously considerable. Banks must also address phishing attacks in which
account-related information is stolen from their

Where's the Money? customers. The theft is done via a familiar, but bogus
request that victims supply personal information to
avoid some unpleasant or annoying action.
During the morning of 9/11, I stood with so many
Unfortunately, there are no good solutions to the
others on the streets of Washington, DC, watching in
problem currently – and it's only a matter of time
horror as a black plume of smoke rose up from the
before banks begin to retreat from their Internet strate-
Pentagon. Almost instinctively, I went to an ATM and
gies to avoid the risk.
drew out as much cash as it would give me. Some
In the mid 1980's, a group of security consultants
readers might argue that such action is inappropriate,
from AT&T met with system managers from a large
because it contributes to public panic, and they may be
investment bank in New York City. The bank
right.
apparently was running applications that transferred
But this does illustrate the importance of financial
sizable payments to creditors every Friday afternoon at
soundness in times of national stress. If the ATM in
3:45 PM. This transfer had to be reliable because late
Washington had not given me cash on that morning, it
payments carried penalties.
would have just made an already horrific day much
Things worked fine for years, but they suddenly
worse. The story also illustrates the responsibility that
began to notice unexplainable problems with their
the owners and operators of financial services
network just before 3:45 PM every Friday. Everyone
infrastructure have to maintain soundness in their
suspected insider financial sabotage because the source
systems and to avoid any types of cyber security
of the trouble jumped around in a random manner,
catastrophes.
almost as if to avoid detection. The team tried hard to
The good news is that considerable emphasis has
pinpoint what was going on, but could not obtain
been directed toward reducing security risks in the
accurate evidence.
financial services industry. This includes the massive
Ironically, the problem stopped once the consult-
investments made by businesses to reduce fraud over
ing group began establishing a more visible presence at
the past decades; but it also includes the substantive
the bank. Everyone presumed that the malicious
initiatives being worked across most banks today to
insider probably noticed the ragged-looking security
protect their computers and networks from hackers,
engineers wandering around the trading floor, and just
criminals, and cyber terrorists.
figured that the heat was getting a bit too close. So in
One insider problem that banks have seen is the
the end, the attack stopped.
so-called salami attack. This involves repeated theft of
But this incident left me with an uneasy feeling.
small amounts of money. For example, a dishonest clerk
The attack, if indeed it really was one, could have
might steal a few cents from the travel reimbursements
targeted great sums of money. Furthermore, the fact
of employees over a large period of time. No single
that a team of trained forensic security experts could

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 15

not locate this problem illustrates, in a small way, the as a law enforcement issue. This complicates how the
potential for a scenario that might have more serious military deals with cyber security for two reasons:
consequences for the financial sector. • Domestic infrastructure attacks could have
Citizens of most companies are totally reliant on strategic military importance.
computer and network systems for their personal • The geographic location of some attack
financial needs. Many view access to their money using source is tough to reliably determine.
an ATM machine, for instance, as a basic human right. The military in most countries includes three
In addition, businesses obviously rely on the availabili- components. There is a strategic component tasked
ty of financial systems to support their day-to-day with the overall planning, architecture, and method-
operational needs. Their supply chain management, ologies to be used in theater and non-theater
their point of sale systems, and their advertising and engagement (a theater is a place where you fight a war).
marketing methods are all heavily dependent on There is also a tactical component, empowered to
computing. perform the steps involved in dealing with a real-time
Another point, made resoundingly clear on 9/11, situation. And there is the sustaining base component,
is that the software, computing, and networking which involves the systems that allow military
infrastructure supporting financial firms are as vital (if organizations to function. This includes payroll
not more) to operations as the structural integrity of systems, families benefits, food preparation, and on
buildings. Anyone who believes that such cyber and on.
infrastructure will not be targeted more aggressively by This distinction is important because so often we
a future cyber terrorist attack is simply not being hear the phrase “hacking the military,” without any
realistic. information about what specifically is being attacked.
Furthermore, the customized software powering We presume immediately when we hear such talk that
the financial infrastructure is increasingly developed in hackers are using computers to run tanks into walls or
non-traditional ways. Much of this software develop- to cause airplanes to lose contact with the ground.
ment, for example, is performed in countries for which More likely, such cyber attacks generally focus on
the link between government and industry is military Web sites, part of the non-tactical, non-strate-
somewhat blurred. This may be fine, but the result is gic sustaining base.
that these countries now have a direct pipeline to the The military has tried to assess its level of risk over
software powering critical financial systems. The the years through a series of calculated exercises. Back
presence of such access certainly must be factored into in the late 1990's, several exercises were run in which
any estimation of national security risk. good guys broke into military computer and network
systems. The good-guy attack team showed that by

Three Thousand taking their time and avoiding obviously detectable

actions, they were able to get through most of the
Tooth Brushes to Iraq? computer network defenses that the military had
established.
Cyber attacks pose an interesting dilemma for the This is a useful finding, one that all organizations
military. Specifically, if a domestic enemy attacks must consider. Specifically, it showed that the most
domestic infrastructure, then most countries view this serious cyber attacks will probably not come barreling
into an organization's network with guns blazing and

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks

 16

rockets firing. No, the cyber terrorist will more likely Information Warfare and Security the story of five
use the techniques demonstrated in this valuable hackers from the Netherlands who penetrated comput-
military exercise: They will proceed slowly with the er systems at 34 military sites on the Internet, many
goal of not being noticed. They will patiently build up supporting the 1991 U.S. war against Iraq. A program
enough privileged access to perform the attack only manager at the Air Force Office of Special
when the time is right. Investigations explained at the time that these hackers
Of course, the military's cyber attack experience is had so much information and control that “instead of
not confined to exercises. Dorothy Denning of the sending bullets to the Gulf, they could have sent
Naval Postgraduate School relates in her excellent book toothbrushes.” This is obviously unacceptable.

© 2007 by AT&T Inc.

Printed in the United States of America

All rights reserved. No part of this book may be reproduced, transmitted or stored in a retrieval system in any
form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior
written permission of the publisher.

The author, copyright holder, and publisher have used their best efforts to prepare this book. The author,
copyright holder, and publisher make no warranty, implicit or explicit, about the material contained herein.
The author, copyright holder, and publisher will not be liable under any circumstances for any direct or
indirect damages arising from any use, direct or indirect, of the material in this book.

Silicon Press, Summit, NJ 07901, USA

ISBN 0-929306-38-4
First Edition
Printing 9 8 7 6 5 4 3 2 1 Year 09 08 07 06

Library of Congress Cataloging-in-Publication Data

Amoroso, Edward G.
Cyber security / Edward Amoroso.
p. cm.
Includes index.
ISBN 0-929306-38-4 (alk. paper)
1. Information warfare--United States. 2. Computer networks--Security
measures--United States. 3. Cyberspace--Security measures. 4.
Cyberterrorism--United States--Prevention. 5. Civil defense--United States.
I. Title.

U163.A525 2007
363.325--dc22

Cyber Security by Edward Amoroso Ch. 3 - The Effects of Cyber Attacks