Cyber attacks

For instance, a cyber attack that disabled the water supply or the electrical system in conjunction with a physical attack could deny emergency services the necessary resources to manage the consequences—such as controlling fires, coordinating actions, and generating light. 

Control systems, such as SCADA, can be vulnerable to cyber attacks. Entities or individuals with malicious intent might take one or more of the following actions to successfully attack control systems ... 

To be able to effectively respond to cyber attacks, establish an intrusion detection strategy that includes alerting network administrators of malicious network activity originating from internal or external sources. Intrusion detection system monitoring is essential twenty-four hours a day this capability can be easily set up through a pager. Additionally, incident response procedures must be in place to allow an... 

Establish a disaster recovery plan that allows for rapid recovery from any emergency (including a cyber attack). System backups are an essential part of any plan and allow rapid reconstruction of the network. Routinely exercise disaster recovery plans to ensure that they work and that personnel are familiar with them. Make appropriate changes to disaster recovery plans based on lessons learned from exercises. 

Ezell, B. C. 1998. Risks of cyber attack to supervisory control and data acquisition for water supply. PhD diss., University of Virginia. 

Gellman, B. 2002. Cyber-attacks by A1 Qaeda feared Terrorists at threshold of using Internet as tool of bloodshed, experts say. Washington Post, June 27, A01. 

Some people use honeynets to investigate cyber-criminal behavior and to discover new types of cyber-attacks. We should mention that a honeynet is a computer network created especially to attract cyber-attacks. Whenever a honeynet is attacked, lots of information is collected and then analyzed in order to better understand the cyber-criminals activity. A key step in protecting a network is to detect defects in the defense systems and removing them immediately. 

Most contemporary computer environments have very primitive facilities for localizing and tracing sources of cyber-attacks [2], Contemporary tools are incapable of effectively identifying the source of cyber-attacks. Nowadays computer criminals are very good in staying anonymous while committing criminal activities during unauthorized access to networks [4],... 

There are three basic methods to determine the geographical location of a cyber-attacker using the WHOIS service, using the traceroute utility and using a distributed traceroute approach. 

R. Romanyak, A. Sachenko, S. Voznyak, G. Connolly, and G. Markowsky, Detecting a Cyber-Attack Source in Real Time, Proceedings of2004 Spring IEEE Conference on Technologies for Homeland Security, Boston, USA, April 21-22, 2004. 

List the key issues to consider following a cyber-attack. 

In Jnne 2013, the FDA recommended that medical device manufacturers and healthcare facilities take steps to assnre that appropriate safeguards reduce the risk of failure due to cyber-attack, which could be initiated by the introduction of malware into the medical equipment or unauthorized access to configuration settings in medical devices and hospital networks. Many medical devices contain confignrable embedded compnter systems that can be vulnerable to cybersecurity breaches. In addition, as medical devices become increasingly interconnected, via the Internet, hospital networks, other medical device, and smartphones, there is an increased risk of cybersecurity breaches, which could affect how a medical device operates. Recently, the FDA has become aware... 

Computer systems. Process control computers should not be connected to the Internet, since being connected online opens the doors for possible "cyber attacks."... 

We expect that adversaries may attempt to employ cyber attacks to interfere with the DoD s SOA systems. For example, an adversary may accompany a ballistic missile attack with a multitude of cyber attacks designed to inhibit defensive missile counter-measures. It is therefore imperative that mission-critical net-centric systems operate dependably, even when under cyber attack. 

We evaluate our architecture in the context of a BMD demonstration. In November 2009, MIT Lincoln Laboratory demonstrated a proof-of-concept net-centric BMD decision-support system during the simulation of an intercontinental ballistic missile (ICBM) attack [10]. For this exercise, we developed and deployed an illustration-of-concept implementation of om siu vivability architecture. This exercise demonstrated the principles of om siu vivability architecture in a realistic simulation of a coordinated ICBM and cyber attack. Our experience developing this survivabihty architecture taught us several important lessons learned, which we share in this paper. 

We instantiate the NCDS architecture as an illustration-of-concept implementation. We evaluate our implementation in the context of a simulated ICBM and cyber-attack exercise. 

While cyberspace generally refers to the global domain of interconnected computing systems, in this work we focus on the specific cyber domain that supports ballistic missile defense in the United States. Thus when we refer to the Cyber OODA loop we are referring to the specific decision-making process used to defend the BMD mission from cyber attack. 

In the following subsections we describe the components of this demonstration in greater detail. We begin by briefly describing the net-centric BMD system, then follow with a description of the cyber attack. We conclude this section by describing the illustration-of-concept NCDS implementation that we used to mitigate the cyber attack. 

We expect that a capable adversary will use all available means to circumvent ballistic missile defense, including using information operations to weaken the defender s ability to enact missile countermeasures. We implemented such a cyber attack that targets the Radar-Sensor Service. By disabling the Radar-Sensor Service, the cyber attack disrupts the BMD OODA loop—preventing BMD commanders from potentially enacting effective missile counter-measures. 

Overview. The VTop Cyber Sensor monitors and publishes a specific statistic pertaining to CPU utilization. At a rate on the order of 1000 Hz, the sensor samples the processor s state, recording whether the processor is idle or is executing in user or kernel space. Every second, the sensor aggregates the tally and publishes the proportion of time spent idle or in user or kernel space. This sensor is indicative of system faults that manifest themselves is anomalous utilization patterns. For example, our cyber attack manifests itself by causing the CPU to spend approximately 100% of its time in kernel space. 

VTop relies on performance isolation provided by VMware Workstation. VProbes (and hence VTop) is not adversely affected by the cyber attack since the performance of the guest operating system does not adversely affect the performance of the hypervisor. If VTop were implemented as a component of the observed system, then the attack would likely interfere with the sensor. Here we rely on the assumption that an adversary cannot affect the operation of the hypervisor we essentially assume that the hypervisor is a trusted computing base (TCB). While this assumption is not warranted in our setup, we believe that it should be possible to implement a trustworthy hypervisor that is dependably immune to attack. 

This actuator is capable of remedying faults within the operating system. Since the demonstration s cyber attack is specific to the Linux operating system, switching to FreeBSD makes the Radar-Sensor Services immune to the attack. 

As the DoD increases its reliance on net-centric systems it becomes increasingly important to protect those systems from cyber attack. Towards this end, we have developed the Net-centric Cyber-Decision-Support (NCDS) architecture. Our architecture aims to improve the user s ability to quickly enact good decisions that will remedy faults at run time. Oiu approach to siu vivability stands to advance the state of the practice by leveraging existing dependabihty approaches in two ways. 

Thus our design of the NODS architecture represents an interesting point in the space of techniques for achieving cyber survivabihty it complements existing approaches for developing dependable software and for detecting and responding to cyber attacks. 

The growing usage of low cost COTS components comes at the cost of potentially increasing the vulnerabihty of SCADA systems to node and communication failures and cyber attacks. The crash of SCADA network nodes usually... 

On the other hand, the risk inherent in the flow of money pertains chiefly to untimely payment, hedging or letters of credit. ICT systems are exposed to cyber attacks, weak firewalls, failures and equipment theft. Opportunistic behaviours and transaction costs pertain to risk in relationships with suppliers. The GSR area is associated mainly with threats to the reputation of the enterprise related to unacceptable practices (e.g. child labour) that the company or its business partners may have adopted. 

---