SANS Institute Research Articles

Cybercrime Management: The Role of Cybersecurity Education and Training

Leading technology companies such as Cisco, IBM, Fortinet, Broadcom, and the SANS Institute have responded to the growing threat of cybercrime by developing extensive cybersecurity tools and training programs. Examples of these tools include Cisco's Snort, IBM's QRadar, Fortinet's FortiGate, Broadcom's Symantec Endpoint Protection, and the SANS Institute's Metasploit. These tools are essential in a variety of industries, including financial services, healthcare, government, and manufacturing. They protect against cyberattacks, safeguard sensitive information, and ensure regulatory compliance; however, they present certain challenges such as complexity, cost, and the possibility of false positives. Future research should concentrate on creating flexible security frameworks, improving cybersecurity training, and extending automated incident response and predictive analytics as the digital ecosystem changes. These initiatives are essential for maintaining a step ahead of new threats and guaranteeing effective cybercrime management across all industries.

An Analysis of Critical Cybersecurity Controls for Industrial Control Systems

Industrial Control Systems (ICS) comprise software, hardware, network systems, and people that manage and operate industrial processes. Supervisory Control and Data Acquisition Systems (SCADA) and Distributed Control Systems (DCS) are two of the most prevalent ICS. An ICS facilitates the effective and efficient management and operation of industrial sectors, including critical infrastructure sectors like utilities, manufacturing, and water treatment facilities. An ICS collects and integrates data from various field controllers deployed in industrial contexts, enabling operators to make data-driven decisions in managing industrial operations. Historically, ICS were isolated from the internet, functioning as part of air-gapped networks. However, the efficiency improvements brought about by the emergence of Information Technology necessitated a shift towards a more connected industrial environment. The convergence of Information and Operational Technology (IT/OT) has made ICS vulnerable to cyberattacks. Due to the crucial nature of the infrastructure that ICS manage, cyberattacks against ICS may cause critical infrastructure sectors to experience downtime. This may have a crippling impact on a country's well-being and essential economic activities. Given the proliferation of cyber warfare, cyberattacks against ICS are increasingly significant at present, as was the case during the 2015 attack on Ukraine's power infrastructure, which was successful in causing a blackout that affected over 200 000 persons. The threat actors used malicious software known as "BlackEnergy3", which was created to interfere with the regular operation of the ICS in charge of controlling electrical substations. This was the first known instance of malicious software causing blackouts. In response to increasing cyberattacks against ICS, the SANS Institute, in a whitepaper titled “The Five ICS Cybersecurity Critical Controls”, present five critical controls for an ICS cybersecurity strategy. This paper discusses ICS and the increased convergence of IT and OT. The paper also outlines significant cyberattacks directed at ICS. The paper then follows an exploratory research methodology done in response to the Five ICS Cybersecurity Critical Controls to determine the state of ICS literature that can help ICS operators secure their environments in accordance with the framework. Additionally, the ICS Cybersecurity Critical Controls are mapped to the NERC CIP standards, which provide guidance on the security of the Bulk Electric System (BES) and associated critical assets in North America.

Using the Latin Square Design Model in the Prioritzation of Network Security Threats: A Quantitative Study

Society is becoming increasingly dependent on cyberspace for both business and pleasure. Cyber attackers continue to attack organizational computer networks, as those same computer networks become increasing critical to organizational business process. Strategic planning and managing IT security risks play an important role in the business and government planning process. Deploying defense in depth security measures can ensure that organizations continue to function in times of crisis. This quantitative study explores whether the Latin Square Design (LSD) model can be effectively applied to the prioritization of cybersecurity threats and to the linking of information assurance defense in-depth measures to those threats. The methods used in this study consisted of scanning 10 Cybersecurity Websites such as the Department of Homeland Security US CERT (United States-Computer Emergency Readiness Team [1]) and the SANS Institute (SysAdmin, Audit, Network and Security [2]) using the Likert Scale Model for the Website’s top ten list of cyber threats facing organizations and the network defense in depth measures to fight those threats. A comparison of each cybersecurity threats was then made using LSD to determine whether the Likert scale and the LSD model could be effectively applied to prioritize information assurance measures to protect organizational computing devices. The findings of the research reject the H0 null hypothesis that LSD does not affect the relationship between the ranking of 10 Cybersecurity websites top ten cybersecurity threats dependent variables and the independent variables of defense in depth measures used in protecting organizational devices against cyber-attacks.

Brute-force Attacks Analysis against SSH in HPC Multi-user Service Environment

Background/Objectives: The brute-force attack is one of popular cyber security threats in the secure shell (SSH) service environment. The SANS Institute has warned about SSH brute-force attacks against remote services. Methods/Statistical Analysis: We describe two brute-force attack detection methods are applied in the High Performance Computing (HPC) service environment which has been operated by KISTI in KOREA. The first way parses failed authentication logs of systems. The second way analyze dropped events of network firewalls. Findings: We analyze SSH brute-force attacks that are detected applying these methods in our service environment. The analysis results show that SSH brute-force attacks are classified ‘1:N’ or ‘N:1’ types of attack between source and destination IP address. And a duration of attacks that is generally the time it takes to execute attacks keeps enough long times. Improvements/Applications: Two detection methods which are deployed in our HPC multi-user service environment are complementary to each other. These methods will be also able to apply for other service environment.

Have things changed now? An empirical study on input validation vulnerabilities in web applications

Web applications have become important services in our daily lives. Millions of users use web applications to obtain information, perform financial transactions, have fun, socialize, and communicate. Unfortunately, web applications are also frequently targeted by attackers. Recent data from SANS institute estimates that up to 60% of Internet attacks target web applications.In this paper, we perform an empirical analysis of a large number of web vulnerability reports with the aim of understanding how input validation flaws have evolved in the last decade. In particular, we are interested in finding out if developers are more aware of web security problems today than they used to be in the past. Our results suggest that the complexity of the attacks have not changed significantly and that many web problems are still simple in nature. Hence, despite awareness programs provided by organizations such as MITRE, SANS Institute and OWASP, application developers seem to be either not aware of these classes of vulnerabilities, or unable to implement effective countermeasures. Therefore, we believe that there is a growing need for languages and application platforms that attack the root of the problem and secure applications by design.

Google Confronts China’s “Three Warfares”

In early January 2010, Google announced that a computer attack originating from China had penetrated its corporate infrastructure (in mid-December) and stolen information from its computers, most likely source code. The hackers also accessed Gmail accounts of some human-rights activists and infiltrated networks of 33 companies. In April 2010, journalist John Markoff wrote: A person with direct knowledge of investigation now says that losses included one of Google's crown jewels, a password system that controls access by millions of users worldwide to almost all of company's Web services, including e-mail and business applications. The program, code named Gala for Greek goddess of earth, was attacked in a lightning raid taking less than two days last December, person said. (1) China's recent incursions into US military computer networks and Google's cyber systems are of concern when viewed in isolation. They reflect a more serious problem when viewed as part of a short-term goal of conducting preemptive reconnaissance that accommodates a longer-term goal of affecting US military planning or US economy. Many factors indicate that this may be China's goal. Initially, this article examines context within which Google attacks occurred and how Google's response--abandoning censorship in China--was used by Chinese to distract attention from their planned aggression. It then analyzes how a 2003 military regulation assisted China's response to Google's accusations. In short, these procedures are being used all too often by Chinese and are causing US authorities to be more and more intolerant of Chinese behavior. Why America Has Had Enough Journalist Josh Rogin recently listed ten computer incidents that are commonly known in United States through press releases and government agency briefings. All parties damaged by attacks suspect that Chinese are behind these incursions. The ten events are: * 2004: Titan Rain, Federal Bureau of Investigation name for a group of hackers from Guangdong province who stole information from US military labs, National Aeronautics and Space Administration, World Bank, and others. * 2006: A US State Department official in East Asia opens an email that allows hackers to break into computers at US embassies all over region. * 2006: US Representative Frank Wolf's office is attacked. He is an outspoken lawmaker on Chinese human-rights issues and suspects Chinese in attack. * 2006: The US Commerce Department had to discard all of its computers due to targeted attacks originating from China. * 2006: The US Naval War College took all of its computers offline after a major cyber attack in which China emerged as main culprit. * 2007: Secretary of Commerce Carlos Gutierrez finds spy software on his computer following a trade mission trip to China. * 2008: The presidential campaigns of both President-elect Barack Obama and Senator John McCain are attacked by Chinese cyber spies. * 2009: Senator Bill Nelson revealed attacks against his computer had been traced to China. * 2009: Toronto researchers find a massive cyber espionage ring using Chinese malware they call Ghostnet. The attacks penetrated 103 countries, and their origin was China. * 2009: Lockheed Martin's F-35 program is hacked and China emerges as main suspect. (2) This list obviously does not include hundreds of thousands of pings (purpose unknown) that US Web sites have received from China over years, nor does it mention other specific incidents. And then along comes Google. How Serious was Google Attack? The attack on Google occurred in December 2009. Some sources state that as many as 33 companies were victims of hack attack. (3) Alan Paller, director of well-known information security training firm known as SANS Institute in Bethesda, Maryland, indicated just how invasive attacks were, noting the odds of 25 biggest companies in California not being fully compromised by Chinese is near zero. …

Should vendors be liable for security flaws in software?

Integrating security into applications is an obvious thing, especially since most software bugs are usually the result of small errors in the code or oversights in the requirements. However, very few people have publicly asked the question: should the vendors who create software containing security holes be held liable for their oversights? With the National Security Agency, along with the SANS Institute and MITRE, highlighting the urgent need for a solution with their list of the top 25 most dangerous programming errors, companies and vendors need to pay more attention. 1 Organisations need to start asking more questions about the security of commercial off the shelf software (COTS) and the custom applications that are developed specifically for them.

Silver Bullet Talks with Matt Bishop

Gary McGraw interviews Matt Bishop, who has made significant inroads in the commercial side of security, lecturing for the SANS Institute, and focusing much of his writing on security education. He is the author of Computer Security: Art and Science (Addison-Wesley, 2002), an important textbook in the space. You can find additional podcasts in the series at www.computer.org/security/podcasts/ or www.cigital.com/silverbullet/.

News Briefs

This paper deals with an algorithm that generates useful blacklists for networks by taking information from victims of past network attacks and predicting which hacker sites are likely to target specific networks in the future. Blacklists, which contain IP addresses previously involved in malicious activity, are an increasingly popular security technique. However, there are problems with the two main blacklisting approaches. HPB uses two analysis engines to create a blacklist for each network it protects. One engine ranks attack sources based on their relevance to the network for which it is developing a blacklist. The other determines the severity of potential attacks. The highly predictive blacklist approach works with information about harmful online activity that the SANS Institute collects via its DShield system. After filtering out unnecessary information, HPB runs the data through one system that ranks attack sources based on their relevance to a network being protected and one that determines potential attack severity.

Games and Simulation: DS Online's Newest Topic Area

Over the past few years, we've all witnessed the hacker community's growing impact on both the IT industry and academia. Host and network exploitation techniques that used to be discussed in "underground" forums are now featured in book series from No Starch Press, Syngress, and other publishers. Furthermore, they've become standard training for security practitioners - see, for example, the SANS Institute's Security 504: Hacker Techniques, Exploits, and Incident Handling course (http://www.sans.org/training/courses.php). It is now beyond doubt that the hacker community has developed efficient techniques for analyzing, reverse engineering, testing, and modifying software and hardware that challenge their college and graduate-school-educated peers. These techniques have let the community substantially contribute to the state of the art of practical computer security. Many academic researchers recognize that marginalizing the hacker community would be a mistake, and increasing numbers of industry and government security practitioners attend hacker conferences such as DefCon (http://www.defcon.org) and Black Hat (http://www.blackhat.com). In fact, the US Military Academy and the US Naval Academy supported their students' participation in computer-security-related competitions at ShmooCon (http://www.shmoocon.org) and DefCon, respectively.

Managing the Most Critical Internet Security Vulnerabilities: One Effective Approach

Security continues to be the most significant risk (in terms of costs) associated with businesses, their information systems (IS), and information assets — especially those on the Internet. A new vulnerability or exposure seems to appear every week. A strong argument can be made that vendors ought to be held more responsible for their faulty systems. Although absolute security is impossible, and although a secure system today will have new risks next week, there are some developing tools of interest to assist auditors and security professionals in the management of the most critical Internet security vulnerabilities. Some expert assistance is being provided, not only in the publishing of alerts as new vulnerabilities occur, but also in assembling various broad analyses of Internet attacks and providing the results to the public. For example, a list from the SANS Institute and the FBI, called “Twenty Most Critical Internet Security Vulnerabilities,” serves as an excellent check-sheet for those responsible for security. This article attempts to provide tools and techniques that can mitigate these types of security risks.