2 Discussions 1 Case Study and 1 weekly Summary
Shrikaa
cyberwarfare_ppt08_l03.pdf
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cyberwarfare: Information
Operations in a Connected World
Lesson 3
Evolving Threats and Social Engineering
Page 2Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective(s)
▪ Describe cyberwarfare attackers and the
evolution of cyberwarfare techniques.
Page 3Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Key Concepts
▪ The characteristics, motivations, and tools of
hackers and advanced persistent threats
▪ The Cyber Kill Chain and how it describes the
attack techniques of advanced persistent threats
▪ How humans are the weak link in the
cybersecurity chain
▪ Social engineering as a weapon of cyberwarfare
and how to defend against it
▪ The key principles of influence are and how they
may be exploited by social engineers
Page 4Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: CONCEPTS
Page 5Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The Changing Threat Model
Teenagers
Sophisticated cyberwarfare threats
Page 6Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
How Hacking Has Evolved
▪ Hacker once described an individual who was
extremely proficient at manipulating computers
• Examples: Steve Wozniak, Bill Gates
▪ 1980s: Hacker describes individuals who exploit
computer security weaknesses for fame,
financial gain, or other purposes
Page 7Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The Many Hats of Hackers:
Hacker Motivations
White-hat hackers
Black-hat hackers
Gray-hat hackers
Page 8Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Modern Hacking and Types of
Attacks
Opportunistic attacks
Semi-targeted attacks
Focused attacks
Page 9Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: OBJECTIVES
Page 10Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Inside the Advanced Persistent
Threat
▪ Make use of advanced technologies
▪ Select specific targets
▪ Remain focused on targets until victory is
achieves
Page 11Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Characteristics of the APT
▪ Sophisticated technical tools
▪ Use of social engineering
▪ Clear, defined objectives
▪ Financial and human resources
▪ Organization and discipline
Page 12Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
APT Motivations
Military/ political
Cybercrime and corporate
espionage Activism
Page 13Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
APT Tradecraft
Zero-day attacks
Malware
Social engineering and phishing
Strategic Web compromises
Page 14Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Window of Vulnerability
Page 15Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: CONTEXT
Page 16Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Military Kill Chain
Military Joint Targeting Manual kill chain steps:
1. Find: Identify targets and collect intelligence
about them.
2. Fix: Focus sensors on the target and locate it
in time and space.
3. Track: Maintain tracking information on the
target and conduct additional intelligence,
surveillance, and reconnaissance, as
necessary.
Page 17Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Military Kill Chain (Cont.)
Military Joint Targeting Manual kill chain steps:
4. Target: Select appropriate weapons, conduct
a risk assessment, and decide upon the plan
of engagement.
5. Engage: Transmit the order to attack and
strike the target.
6. Assess: Monitor the attack, determine
success, and recommend another attack, if
necessary.
Page 18Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cyber Kill Chain
Reconnaissance Weaponize Deliver
ExploitInstall Command and
Control
Act on Objectives
Page 19Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cyber Kill Chain (Cont.)
Page 20Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Design and Embed Malicious
Payload
Page 21Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Payload Infecting Targeted
System
Page 22Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Command-and-Control Link
Established
Page 23Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: TECHNOLOGY
Page 24Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Humans: The Weak Link
Organizations build security
• Organizations
Humans undermine
security
Page 25Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Humans: The Weak Link
Scampi
• User gives VPN username and password to attacker
• Can bypass firewall
Doodle
• User bypasses DLP by copying files to flash drive
Hunter
• Employee uses Tor anonymous Web browser to bypass content filter
Page 26Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Social Engineering
▪ How does a cyberwarrior use social
engineering techniques on potential victims?
Cite specific examples.
▪ How can an advanced persistent threat
leverage social engineering?
Page 27Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Social Engineering
▪ The art of manipulating human behavior
through social influence tactics to achieve a
desired behavior
▪ Examples:
• Tricking an individual into divulging information
about information systems
• Influencing an individual to bypass physical security
controls
• Convincing an individual to disable electronic
security controls
• Tricking an insider into installing software that
secretly creates a back door
Page 28Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Six Principles of Influence
InfluenceReciprocity
Commitment and
Consistency
Social Proof Authority
Liking
Scarcity
Page 29Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Tools of the Social Engineer
Pretexting
Phishing
Baiting
Page 30Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Phishing E-mail Example
Page 31Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Social-Engineer Toolkit
Page 32Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: UNDERSTANDING
Page 33Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Defending Against Social
Engineering
▪ Security awareness and education
▪ Incident reporting and response
▪ Content filtering
▪ Penetration testing
Page 34Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
▪ The characteristics, motivations, and tools of
hackers and advanced persistent threats
▪ The Cyber Kill Chain and how it describes the
attack techniques of advanced persistent threats
▪ How humans are the weak link in the
cybersecurity chain
▪ Social engineering as a weapon of cyberwarfare
and how to defend against it
▪ The key principles of influence are and how they
may be exploited by social engineers
