1. Security Blanket or Security Theater?

Chapter Spotlight

Computer security: the threat–vulnerability–countermeasure paradigm Harm to confidentiality, integrity, availability Nature of threats; method–opportunity–motive; risk Kinds of attackers Countermeasure effects: prevent, deter, detect, recover Analyzing security

How Dependent Are We on Computers?	6
What Is Computer Security?	8
Threats	11
Harm	24
Vulnerabilities	30
Controls	30
Analyzing Security with Examples	33
Conclusion	34
Exercises	35

Imagine a series of events unfolding on a single day. First, 20 million U.S. smart phones stop working. Next follow outages in wireline telephone service, problems with air traffic control, disruptions to the New York Stock Exchange, and eventually severe loss of power on America’s East Coast. What could cause such crippling outcomes?

You might think first they are isolated events, just coincidentally occurring on the same day. But with several things happening at once, you next start to look for common causes. Perhaps the various organizations providing these services bought some of their software from the same vendor, and the software is failing because of a shared flaw. Possibly this situation is like the Y2K problem, when people were concerned that on January 1, 2000 computer systems would crash because they used only two digits for the date (98, 99) and would fail when computer clocks rolled over the year boundary. Or maybe dependencies in one sector trigger actions that cause the initial failure to cascade into other sectors, for example:

There is yet another scenario, used by the Bipartisan Policy Center in its February 2010 Cyber ShockWave exercise: malicious computer software or malware, “planted in phones months earlier through a popular ‘March Madness’ basketball bracket application, disrupts mobile service for millions” [BPC10].

It is difficult—sometimes impossible—to distinguish between an accident and an attack. Consider, for example, an online gambling site that received a flood of blank incoming email messages that overwhelmed servers and slowed customer traffic to a crawl. Blank messages could easily come from a software or hardware problem: a mail handler caught in a loop with one malformed message that it dispatches over and over. Shortly thereafter, the company received email written in broken English. It told the company to wire $40,000 to ten different accounts in Eastern Europe if it wanted its computers to stay online [MCA05]. So much for the “just an accident” theory.

Are these scenarios realistic or implausible? And are cyber security exercises such as these and the ones described in Sidebar 1-1 designed to confirm our readiness (a security blanket) or exacerbate our worries (security theater)? What is the likelihood we will be able to determine the causes of these kinds of failures and then prevent or mitigate their effects?

Sidebar 1-1: Testing Cyber Security Readiness Governments and the private sector have organized many “cyber security exercises.” Although the nature of each exercise varies, the goals of such exercises are similar: to anticipate unwelcome cyber events so that prevention and mitigation plans can be made, to make both public and private officials aware of cyber security risks, and to test existing response plans for both coverage and effectiveness. For example, in November 2010, the European Union ran its first cyber security “stress test,” Cyber Europe 2010. Its objective was to “test Europe’s readiness to face online threats to essential critical infrastructure used by citizens, governments and businesses.” The activities involved 22 participating nations and 8 observers. Among the lessons learned: The private sector must be involved. Testing of pan-European preparedness measures is lacking because each member nation is still refining its national approach. The exercise is a first step in building trust at a pan-European level. More cooperation and information exchange are needed. Incident handling varied a lot from one nation to another because of the different roles, responsibilities, and bodies involved in the process. Some nations had difficulty understanding how similar incidents are managed in other member nations. A new pan-European directory of contacts need not be created. The existing directories are sufficient but need to be updated and completed regularly. Other cyber security exercises have been run around the world. The U.S. Department of Home-land Security involves both public and private sector organizations in its biannual Cyber Storm process. And the Bipartisan Policy Center engaged former U.S. government officials in real-time reaction to its simulated cyber attack. Private enterprise and business sector groups also run cyber security exercises; however, they do not usually make their results public, for fear of revealing problems to possible attackers. To learn more: A description of Cyber Europe 2010 and its initial findings is at http://www.enisa.europa.eu/media/press-releases/cyber-europe-2010-a-successful-2019cyber-stress-test2019-for-europe. Descriptions of the U.S. Department of Homeland Security’s Cyber Storm exercises can be found at http://www.dhs.gov/files/training/gc_1204738275985.shtm. A description of the Cyber Shockwave event, conclusions drawn, and video are at http://www.bipartisanpolicy.org/category/projects/cyber-event. The nine-part CNN broadcast of the Cyber ShockWave simulation begins at http://www.youtube.com/watch?v=MDWEM2jM7qY.

No matter what your work or family responsibilities, it is important for you to understand the nature of these scenarios, make reasoned judgments about their likelihood, and take prudent actions to protect yourselves and the people, data, and things you value.

One way to develop an understanding is to imagine how you might interpret a situation and then react to it. For example, in the unfolding events from mobile phone outage to East Coast power failure, consider these roles:

• You are using your mobile phone to talk with your friend, and the connection drops. You redial repeatedly but never connect. You then try to call your friend on your land line, but again there is no connection. How long does it take you to realize that the problem affects far more people than just you and your friend? Do you contact the telephone company? (And how? You cannot phone, and your Internet connection may very well depend on your telephone carrier!) By the time the power goes out, how do you know the power failure is related to your phone problems? When do you take any action? And what do you do?

• You are using your mobile phone to call your stockbroker because your company’s initial public offering (IPO) is scheduled for today—so your company’s viability depends on the resulting stock price and the volume of sales. As you begin your conversation with the stockbroker, the connection drops. You redial repeatedly, but never connect. You then try to call your broker on the land line, but again there is no connection. How long does it take you realize that the problem affects your company? Your broker? Others? Whom do you call to report a problem? And when the power goes out, what action do you take?

• You are a government official involved with air traffic control. All morning, you have heard rumors of telephone problems around the country. On your secure government line, you get a call confirming those problems and reporting widening problems with the air traffic control system. How do you determine what is wrong? To whom do you report problems? When you realize that problems with air traffic control may be dangerous to aircraft and their passengers, how do you react? Can you ground all aircraft until the sources of the problems are located and corrected?

• You are a government official involved with regulating the power grid. All morning, you have heard rumors of telephone problems around the country. Your web-based reporting system begins to report sporadic power outages on the East Coast. On your secure government line, you get a call confirming those problems and reporting widening problems with the air traffic control system. How do you determine what is wrong? To whom do you report problems? When you realize that problems with the power grid may threaten the viability of the entire nation’s power system, how do you react? The power grid is owned by the private sector. Does the government have authority to shut down the grid until the sources of the problems are located and corrected?

The last situation has precedents. During World War I, the U.S. government took over the railroads [WIL17] and the telephone-telegraph system by presidential proclamations:

I, Woodrow Wilson, President of the United States, ... do hereby take possession and assume control and supervision of each and every telegraph and telephone system, and every part thereof, within the jurisdiction of the United States, including all equipment thereof and appurtenances thereto whatsoever and all materials and supplies [WIL18].

During World War II, the U.S. government encouraged the automotive industry to redirect production toward jeeps, trucks, and airplane parts. The Automotive Council for War Production was formed at the end of 1941, and automobile production was suspended entirely in 1942 so that the industry’s total capacity could focus on the war effort. So possible reactions to our complex scenario could indeed range from inaction to private sector coordination to government intervention. How do you determine cause and effect, severity of impact, and over what time period? The answers are important in suggesting appropriate actions.

Analyzing Computer Security will assist you in understanding the issues and choosing appropriate responses to address these challenges.

In this chapter, we examine our dependence on computers and then explore the many ways in which we are vulnerable to computer failure. Next, we introduce the key concepts of computer security, including attacks, vulnerabilities, threats, and controls. In turn, these concepts become tools for understanding the nature of computer security and our ability to build the trustworthy systems on which our lives and livelihoods depend.