2 DISCUSSIONS 1 CASE STUDY 1 WEEKLY SUMMARY
Shrikaa
cyberwarfare_ppt08_l05.pdf
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cyberwarfare: Information
Operations in a Connected World
Lesson 5
Defense-in-Depth Strategies and
Cryptography
Page 2Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective(s)
▪ Describe the concept of defense-in-depth
and various defense-in-depth strategies.
▪ Explain how cryptography is used in
cyberwar.
Page 3Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Key Concepts
▪ Defense-in-depth concepts and strategies
▪ The design elements of a modern defense-in-
depth strategy
▪ How cryptography and cryptanalysis are used in
cyberwar
▪ How to defeat attacks on cryptographic systems
▪ How encryption is used for data and
communications security
Page 4Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: CONCEPTS
Page 5Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Defense in Depth Overview
▪ 11th century
• Motte and bailey fortifications used by the
Norman invaders in England
• Layered ditches, mounds of earth, and wooden
palisades around a central multistory, defensible
house
▪ 13th century
• Concentric castles with layers of stone walls,
strong towers, and heavily fortified gatehouses
with drawbridges, strong doors, strong internal
gates
Page 6Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Concentric Castles
Page 7Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Star Forts
Page 8Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
US-CERT’s Defense-in-Depth
Strategy
Page 9Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
C-I-A Triad
Page 10Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Defense-in-Depth Strategies
▪ The National Security Agency’s people,
technology, and operations defense strategy
▪ The NSA’s Information Assurance Directorate
▪ SANS Top 20 Critical Security Controls
▪ NSA IAD recommendations
▪ The Department of Defense and defensive
design
▪ Computer network defense and defense in
depth
Page 11Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
NSA’s People, Technology, and
Operations Defense Strategy ▪ People, technology, and operational security
must be provided to ensure end-to-end defense
▪ Availability, confidentiality, integrity,
authentication, and nonrepudiation services are
key parts of ability to protect against, detect,
react to, and recover from attacks
Page 12Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
NSA’s Information Assurance and
Defense-in-Depth Conceptual Model
Page 13Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Comparing SANS Top 20 Critical Security
Controls and NSA IAD Recommendations
IAD Recommendation SANS TOP 20 Critical Security Control(s)
Application whitelisting 2. Inventory of authorized and
unauthorized software
Administrative privilege
control
12. Controlled use of administrative
privileges
16. Account monitoring and control
Limit workstation-to-
workstation
communication
13. Boundary defense
11. Limitation and control of network
ports, protocols, and services
Use AV file reputation
services
5. Malware defenses
Page 14Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Comparing SANS Top 20 Critical Security
Controls and NSA IAD Recommendations
IAD Recommendation SANS TOP 20 Critical Security Control(s)
Implement
antiexploitation features
6. Application software security
Implement HIPS Not specifically mentioned
Set secure baseline
configurations
3. Secure configurations for hardware
and software on mobile devices,
laptops, workstations, and servers
Use DNS reputation
services
13. Boundary defense
11. Limitation and control of network
ports, protocols, and services
Page 15Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Comparing SANS Top 20 Critical Security
Controls and NSA IAD Recommendations
IAD Recommendation SANS TOP 20 Critical Security Control(s)
Take advantage of
software
improvements (patches,
bug fixes)
3. Secure configurations for hardware
and software on mobile devices,
laptops, workstations, and servers
6. Application software security
10. Secure configurations for network
devices such as firewalls, routers,
and switches
Segregate networks
and functions
19. Secure network engineering
Page 16Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DoD and Defensive Design
▪ DoD Instruction 8500.01E is most recent DoD
instruction
▪ Addresses cybersecurity
▪ Does not mention defense in depth per se
▪ Provides significant amount of information
about how the DoD expects cybersecurity to be
implemented
▪ Includes many of same elements as NSA’s
People, Technology, and Operations strategy,
IAD’s recommendations, and SANS Top 20
Page 17Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Computer Network Defense and Defense
in Depth
Page 18Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: OBJECTIVES
Page 19Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Where and Why Defense in Depth
Fails ▪ Neglecting layers: Getting past the shell
▪ System administrators: Trusted attackers
▪ Attacking the user: Human factors
▪ Changes in technology
Page 20Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
RSA Attack
Exploit via malware in e-mail installs a remote
back door for attackers to use.
Remote access allows attackers to
attack other internal systems,
gaining more access.
Attackers move through RSA’s network and
systems, gaining access to
protected data and accounts.
Data is sent out to remote systems
that the attackers use for data collection.
Page 21Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Trusted NSA Network
Page 22Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Targeted Malware
Page 23Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Designing a Modern CND Strategy
Dynamic defense
CND and defense-in-
depth design
Page 24Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Sample CND Design Network
Edge Security
Network Security
Host Security
Application and Software Security
Data Security and Encryption
Physical Security
Policies, Procedures, Training, and Awareness
Page 25Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Secure Networks
▪ Network enclaves
▪ Defensive technologies
▪ Monitoring
▪ Cryptography
▪ Defense against malware
▪ Endpoint security design
▪ Physical security
Page 26Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Network Enclave Admission Process
Page 27Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: CONTEXT
Page 28Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
An Introduction to Cryptography
▪ Cryptography
• The study and practice of techniques for secure
communication that is protected from
adversaries
▪ Encryption
• A process that encodes information in a way
that prevents unauthorized parties from reading
the data
▪ Decryption
• A process that removes the encoding, allowing
authorized parties to read the original text
Page 29Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cryptographic Concepts
Confidentiality Data integrity
Authentication Nonrepudiation
Page 30Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Ciphers and Encryption
▪ Code: A cryptographic system that substitutes
values or words for other words
▪ Plaintext: The original data prior to encryption
▪ Ciphers: Encryption algorithms applied to
plaintext
▪ Ciphertext: The output of a cryptographic
algorithm
▪ Key: The secret variable in an encryption
algorithm
Page 31Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Ciphers and Encryption (Cont.)
▪ Cryptosystem: The hardware and software
implementation of a cipher
▪ Checksums: Mathematical values calculated to
check for common errors in data
▪ Message digests or hashes: Cryptographic
functions that protect the integrity of a message
by allowing you to check that the message has
not changed
Page 32Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Symmetric Ciphers
▪ Rely on a shared key
▪ Sender and recipient use same key for
encryption and decryption
▪ Symmetric encryption can’t provide
authentication or nonrepudiation
• Cannot identify who the sender is based on the
encryption method
▪ Can be very hard to break when sender and
recipient use a strong key that’s handled
responsibly
Page 33Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Symmetric Ciphers (Cont.)
Page 34Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Symmetric Cipher Scaling
Page 35Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Asymmetric Ciphers
▪ Rely on key pairs with a public and a private
key used in the encryption algorithm
▪ Each key is typically a very large prime number
▪ Encryption algorithm’s strength relies on the
fact that determining which very large prime
numbers were used in the algorithm is very
difficult
▪ Public key encryption can provide
confidentiality, message integrity,
authentication, and nonrepudiation
Page 36Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Asymmetric Cipher Scaling
Page 37Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Asymmetric Encryption Public Key
Page 38Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Asymmetric Encryption Private Key
Page 39Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Modern Cryptosystems
▪ DES, one of the earliest broadly adopted
electronic encryption systems
▪ 3DES, its later upgrade
▪ AES
▪ RSA
▪ A number of other competitors that are
available for programmers and system
builders
Page 40Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Hashing and Message Digests
▪ Hashes take a message and generate a unique
output value based on the message.
▪ The output of a hash is often known as a
message digest.
Page 41Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Hashing Basic Requirements
1. They must accept inputs of any length.
2. Their output must be a fixed length.
3. They should be easy to compute for any input
data.
4. They should not be reversible. Thus, you
should not be able to calculate an original
message from a hash.
5. They should not have collisions, meaning that
they should not generate the same hash for
different inputs.
Page 42Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cryptography in Cyberwar
▪ Computer network defense and cryptographic
systems
• Drive encryption
• File encryption
• Digital certificates
• Public key infrastructure (PKI)
• Transport Layer Security (TLS)
• Virtual private networks (VPNs)
• Hashing
Page 43Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cryptography in Cyberwar
(Cont.)
▪ Computer network attack and cryptographic
systems
• Drive encryption
• File encryption
• Digital certificates
• Public key infrastructure (PKI)
• Transport Layer Security (TLS)
• Virtual private networks (VPNs)
• Hashing
Page 44Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: TECHNOLOGY
Page 45Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Attacking Cryptography
▪ Cryptanalysis: Attacks against
cryptographic systems
▪ Techniques include:
• Analyzing encrypted data to attempt to find
patterns
• Finding vulnerabilities in the underlying
cryptographic systems
• Trying every possible combination in a
cryptosystem to decrypt the message
Page 46Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Attacking Cryptography (Cont.)
▪ Attack type chosen often based on how
much information is available to attacker
▪ Information is normally classified as:
• Ciphertext only
• Known plaintext
• Chosen plaintext
• Adaptive chosen plaintext
• Related key attacks
Page 47Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Attacking Cryptography (Cont.)
▪ Brute force
▪ Acquiring the keys
▪ Attacking the algorithm
Page 48Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Defeating Attacks on
Cryptographic Systems
▪ Defenses
▪ Defense in depth using cryptographic
systems
Page 49Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Encryption Uses for a Typical Modern
Laptop
Page 50Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DISCOVER: UNDERSTANDING
Page 51Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Weaponizing Cryptography
▪ Defensive cryptography: malware
encryption
▪ Offensive cryptography
• Example: Zeus
Page 52Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Zeus.
Gameover
Infection
Process
Page 53Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The Future of Cryptography in
Cyberwar
Attack Defenses
Page 54Cyberwarfare: Information Operations in a Connected World © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
▪ Defense-in-depth concepts and strategies
▪ The design elements of a modern defense-in-
depth strategy
▪ How cryptography and cryptanalysis are used in
cyberwar
▪ How to defeat attacks on cryptographic systems
▪ How encryption is used for data and
communications security
