Tuesday, December 22, 2009

Information Security Forum

https://www.securityforum.org/

Founded in 1989, the Information Security Forum (ISF) is an independent, not-for-profit organisation that supplies authoritative opinion and guidance on all aspects of information security. By harnessing our world-renowned expertise and the collective knowledge and experience of our 300 members, the ISF delivers practical solutions to overcome wide-ranging security challenges impacting business information today.

Four main areas of service are available to our Members:

	Tools and Methodologies, built using the collective expertise, insight, and knowledge of our Members worldwide		A comprehensive programme of Knowledge and Information Exchange, offering interactive peer-to-peer forums that give Members an opportunity to meet on a regular basis to share best practices, experiences and perspectives on a wide range of issues.

	An impressive library of Research and Report material, incorporating an unmatched degree of thought leadership in information security, information risk management and related topics.		The ISF Annual World Congress, our flagship global event which offers attendees an opportunity to discuss key security challenges and gain practical advice from peers and leading industry experts from around the world.

Wednesday, December 16, 2009

A comprehensive national broadband plan.

FCC digs into broadband controversies

by Marguerite Reardon

The Federal Communications Commission is taking on difficult and controversial issues as it works toward developing a comprehensive national broadband plan.

On Wednesday the agency heard from an FCC task force on the progress that it's making in writing that broadband plan, which will be presented to Congress in February.

The FCC has been tasked with developing a plan that will get broadband services to all Americans. In working to come up with a comprehensive policy, the FCC has tackled several controversial issues, most notably reforming the Universal Service Fund, reallocating wireless spectrum, and forcing more competition in the market for cable set-top boxes.

One of the top items on the FCC task force's to-do list is reforming the $7 billion rural phone subsidy program called the Universal Service Fund. This program, which also provides funding for schools and libraries through its E-rate program, is funded by consumers, who are charged extra fees on their long-distance phone bills. Specifically, the agency wants to expand the program to help fund broadband service in parts of the country where private industry doesn't find it profitable to invest.

The task force didn't provide long-term recommendations for transitioning USF into funding broadband deployments. But in the short term, it suggested extending some current programs such as life-line link-up to schools and other public areas to provide more access to unemployed people who may not have Internet connectivity at home. The idea is that these individuals can use broadband in these public areas to look for jobs.

FCC Chairman Julius Genachowski said it will take time to get reforms in place. He noted that the national broadband plan won't directly affect USF, but he said the program, once it's expanded, will eventually help fund and become a key part of helping get broadband to underserved parts of the country.

"It's tempting to kick the can [USF reform} further down the road," he said. "But for many reasons it's important to begin tackling these issues now. We must make sure that the fund fully supports the technology of today and tomorrow, not just the technology of the past."

But the process is going to be a long one, he said. And he wouldn't comment on whether true reform could be achieved in his term as chairman.

The FCC task force also reiterated its plans to re-evaluate spectrum issues. Genachowski has said publicly that one of his top priorities is reallocating and finding more spectrum that can be used to build wireless broadband services. Both he and the CTIA, a trade group representing the wireless industry, say there is a looming spectrum crisis that could result in dire consequences without adequate attention now.

During its report to the commission, the broadband task force said it is working with Congress to inventory and assess current spectrum usage in the U.S. It is calling for Congress to also require periodic review of spectrum uses and to find ways to clear spectrum bands that aren't serving other uses, such as wireless broadband.

The task force also said during its presentation Wednesday that it's looking at ways to spur more competition in the cable set-top box market. The group said that a lack of competition in the set-top box market has also resulted in a lack of innovation. The agency feels that more competition in this market would spur companies to develop new Internet applications and services that could be accessed via TVs.

The FCC is considering requiring paid TV providers, such as Comcast, Time Warner Cable, AT&T, and Verizon Communications to supply a low-cost network interface device that would allow people to access the Internet on their TVs and to access cable TV without using a cable box.

Monday, November 23, 2009

Interplanetary Internet. Whoa can IPv6 handle this?!?!?

From Wikipedia, the free encyclopedia

The Interplanetary Internet (IPN) is a conceived computer network in space, consisting of a set of network nodes which can communicate with each other.^[1]^[2] Communication would be greatly delayed by the great interplanetary distances, so the IPN needs a new set of protocols technology that are tolerant to large delays and errors.^[2] While the Internet as we know it tends to be a busy "network of networks" with high traffic, negligible delay and errors, and a wired backbone, the Interplanetary Internet is a store-and-forward "network of Internets" that is often disconnected, has a wireless backbone fraught with error-prone links and delays ranging to tens of minutes, even hours, even when there is a connection. and

[hide]

[edit] Development

Space communication technology has steadily evolved from expensive, one-of-a-kind point-to-point architectures, to the re-use of technology on successive missions, to the development of standard protocols agreed upon by space agencies of many countries. This last phase has gone on since 1982 through the efforts of the Consultative Committee for Space Data Systems^[3] a body composed of the major space agencies of the world. It has 11 member agencies, 22 observer agencies, and over 100 industrial associates. (CCSDS),

The evolution of space data system standards has gone on in parallel with the evolution of the Internet, with conceptual cross-pollination where fruitful, but largely as a separate evolution. Since the late 1990s, familiar Internet protocols and CCSDS space link protocols have integrated and converged in several ways, for example, the successful FTP file transfer to Earth-orbiting STRV-1b on January 2 1996, which ran FTP over the CCSDS IPv4-like Space Communications Protocol Specifications (SCPS) protocols.^[4]^[5] Internet Protocol use without CCSDS has taken place on spacecraft, e.g., demonstrations on the UoSAT-12 satellite, and operationally on the Disaster Monitoring Constellation. Having reached the era where networking and IP on-board spacecraft have been shown to be feasible and reliable, a forward-looking study of the bigger picture was the next phase.

ICANN meeting, Los Angeles, USA, 2007. The marquee plays a humorous homage to the Ed Wood film Plan 9 from Outer Space, while namedropping Internet pioneer Vint Cerf.

The Interplanetary Internet study at NASA's Jet Propulsion Laboratory (JPL) was started by a team of scientists at JPL led by Vinton Cerf and Adrian Hooke.^[6] Cerf is one of the pioneers of the Internet on Earth, and currently holds the position of distinguished visiting scientist at JPL. Hooke is one of the directors of the CCSDS.

While IP-like SCPS protocols are feasible for short hops, such as ground station to orbiter, rover-to-lander, lander-to-orbiter, probe-to-flyby, and so on, delay-tolerant networking is needed to get information from one region of the solar system to another. It becomes apparent that the concept of a "region" is a natural architectural factoring of the InterPlanetary Internet.

A "region" is an area where the characteristics of communication are the same.^[7] Region characteristics include communications, security, the maintenance of resources, perhaps ownership, and other factors.^[7] The Interplanetary Internet is a "network of regional internets."

What is needed then, is a standard way to achieve end-to-end communication through multiple regions in a disconnected, variable-delay environment using a generalized suite of protocols. Examples of regions might include the terrestrial Internet as a region, a region on the surface of the moon or Mars, or a ground-to-orbit region.

The recognition of this requirement led to the concept of a "bundle" as a high-level way to address the generalized Store-and-Forward problem. Bundles are an area of new protocol development in the upper layers of the OSI model, above the Transport Layer with the goal of addressing the issue of bundling store-and-forward information so that it can reliably traverse radically dissimilar environments constituting a "network of regional internets."

Bundle Service Layering, implemented as the Bundling protocol suite for delay-tolerant networking, will provide general purpose delay-tolerant protocol services in support of a range of applications: custody transfer, segmentation and reassembly, end-to-end reliability, end-to-end security, and end-to-end routing among them. The Bundle Protocol was first tested in space on the UK-DMC satellite in 2008.^[8]^[9]

The Deep Impact mission

An example of one of these end-to-end applications flown on a space mission is CFDP, used on the comet mission, Deep Impact. CFDP is the CCSDS File Delivery Protocol^[10] an international standard for automatic, reliable file transfer in both directions. CFDP should not be confused with Coherent File Distribution Protocol, which unfortunately has the same acronym and is an IETF-documented experimental protocol for rapidly deploying files to multiple targets in a highly-networked environment.

In addition to reliably copying a file from one entity (i. e., a spacecraft or ground station) to another entity, the CCSDS CFDP has the capability to reliably transmit arbitrary small messages defined by the user, in the metadata accompanying the file, and to reliably transmit commands relating to file system management that are to be executed automatically on the remote end-point entity (i. e., a spacecraft) upon successful reception of a file.

[edit] Implementation

The dormant InterPlanetary Internet Special Interest Group of the Internet Society has worked on defining protocols and standards that would make the IPN possible.^[11] The Delay-Tolerant Networking Research Group (DTNRG) is the primary group researching Delay-tolerant networking which has several major arenas of application in addition to the Interplanetary Internet, including stressed tactical communications, sensor webs, disaster recovery, hostile environments, and remote outposts.^[12] As an example of a remote outpost, imagine an isolated Arctic village or a faraway island, with electricity, and one or more computers but no communication connectivity. With the addition of a simple wireless hotspot in the village, plus DTN-enabled devices on, say, dog sleds or fishing boats, a resident would be able to check their e-mail or click on a Wikipedia article, and have their requests forwarded to the nearest networked location on the sled's or boat's next visit, and get the replies on its return.

As of 2005, NASA has canceled plans to launch the Mars Telecommunications Orbiter in September 2009; it had the goal of supporting future missions to Mars and would have functioned as a possible first definitive Internet hub around another planetary body.^[update]

Since July of 2009 NASA have been testing DTN on board the ISS,^[13] in August or September there are plans to reload the DTN protocol on the Deep Impact probe. That later combined with another satellite and the ground node will produce a 4 node network.^[14]

[edit] See also

[edit] References

^ IEEE Spectrum: The Interplanetary Internet
^ ^a ^b Generation InterPlanetary Internet | SpaceRef — Your Space Reference
^ http://public.ccsds.org
^ The Space Technology Research Vehicles: STRV-1a, b, c and d, Richard Blott and Nigel Wells, AIAA Small Satellite Conference, Logan, Utah, 1996.
^ Appendix F, CCSDS 710.0-G-0.3: Space Communication Protocol Specification (SCPS) - Rationale, Requirements, and Application Notes, Draft Green Book, Issue 0.3. April 1997.
^ CCSDS.org — Meet the Area Directors — Adrian Hooke
^ ^a ^b Interplanetary Internet
^ Use of the Delay-Tolerant Networking Bundle Protocol from Space, L.Wood et al., Conference paper IAC-08-B2.3.10, 59th International Astronautical Congress, Glasgow, September 2008.
^ UK-DMC satellite first to transfer sensor data from space using 'bundle' protocol, press release, Surrey Satellite Technology Ltd, 11 September 2008.
^ CCSDS.org - CCSDS Recommendations and Reports - Space Internetworking Services Area
^ InterPlanetary Internet
^ Home - Delay-Tolerant Networking Research Group
^ http://www.theregister.co.uk/2009/07/07/dtn_node/
^ 3 oktober 2009. "Vint Cerf - The Internet Today". YouTube. http://www.youtube.com/watch?v=KeAIwLp9YmA#t=43m24s. Retrieved 2009-10-31.

[edit] External links

This article's external links may not follow Wikipedia's content policies or guidelines. Please improve this article by removing excessive or inappropriate external links.

Retrieved from "http://en.wikipedia.org/wiki/Interplanetary_Internet"

Categories: Computer networks | CCSDS

Sunday, November 8, 2009

A prophetic article written a few months after September 11th, 2001. "Is Cyber Terror Next"? by Dorothy E. Dennings

Is Cyber Terror Next?
Dorothy E. Denning, Professor of Computer Science; Director of the Georgetown Institute for Information Assurance, Georgetown University

Shortly after the September 11 terrorist attack against the United States, hackers took to the Internet to voice their rage. A group called the Dispatchers announced they would destroy Web servers and Internet access in Afghanistan and target nations that support terrorists. Led by a 21-year-old security worker "Hackah Jak" from Ohio, the group of 60 people worldwide defaced hundreds of Web sites and launched denial of service attacks against such targets as the Iranian Ministry of Interior, the Presidential Palace of Afghanistan, and Palestinian ISPs. Another group, called Young Intelligent Hackers Against Terror (YIHAT), claimed they penetrated the systems of two Arabic banks with ties to Osama bin Laden, although officials from the banks denied any security breaches occurred. The group, whose stated mission is to stop the money sources of terrorism, issued a plea on their Web site for corporations to make their networks available to group members for the purpose of providing the "electronic equivalent to terrorist training camps." Later, they took down their public Web site, apparently in response to attacks from other hackers.

One group of Muslim hackers attacking the YIHAT site said they stood by bin Laden, even as they condemned the attacks of September 11. "Osama bin Laden is a holy fighter, and whatever he says makes sense," GForce Pakistan wrote on a Web site it defaced. The modified Web page warned that the group planned to hit major US military and British Web sites and proclaimed an "Al-Qaeda Alliance Online." Another GForce defacement contained similar messages along with images of badly mutilated children who had been killed by Israeli soldiers.

The cyber attacks arising from the events of September 11 reflect a growing use of the Internet as a digital battleground. It is not at all unusual for a regional conflict to have a cyber dimension, where the battles are fought by self-appointed hackers operating under their own rules of engagement. A rash of cyber attacks have accompanied the conflict between Israel and the Palestinians, the conflict over Kashmir, and the Kosovo conflict, among others. According to iDefense, over 40 hackers from 23 countries participated in the Israeli-Palestenian cyber conflict during the period October 2000, when the cyber battles erupted, to January 2001. They also reported that two of the pro-Palestinian attackers had connections to terrorist organizations. One of these was UNITY, a Muslim extremist group with ties to Hezbollah. The hackers launched a coordinated, multi-phased denial of service attack, first against official Israeli government sites, second against Israeli financial sites, third against Israeli ISPs, and fourth, against "Zionist E-Commerce" sites. The other group, al-Muhajiroun, was said to have ties with a number of Muslim terrorist organizations as well as bin Laden. The London-based group directed their members to a Web page, where at the click of a mouse members could join an automated flooding attack against Israeli sites.

Cyber protests have emerged in a climate where computer network attacks have become a serious and growing threat. The Computer Emergency Response Team Coordination Center (CERT/CC), for example, reported 2,134 incidents in 1997. This number rose to 21,756 in 2000 and to almost 35,000 during the first three quarters of 2001 alone. Considering that many, perhaps most, incidents are never reported to CERT/CC or indeed to any third party, the numbers become even more significant. Further, each incident that is reported corresponds to an attack that can involve thousands of victims. The Code Red worm, which infected about a million servers in July and August and caused $2.6 billion in damages, was a single incident.

The rise in computer-based attacks can be attributed to several factors, including general growth of the Internet, with corresponding increase in the number of potential attackers and targets; a never-ending supply of vulnerabilities that, once discovered, are quickly exploited; and increasingly sophisticated hacking tools that allow even those with modest skills to launch devastating attacks. The tools used to launch massive denial of service assaults, for example, have advanced command and control capabilities. The attacker runs client software to direct and coordinate the actions of server software running on potentially thousands of previously compromised "zombie" computers. Computer worms like Code Red can be used to find potential zombies and automatically install the attack software.

Although cyber attacks have caused billions of dollars in damage and affected the lives of millions, few if any can be characterized as acts of terrorism: fraud, theft, sabotage, vandalism, and extortion – yes, but terrorism – no. Their effect, while serious and not to be taken lightly, pales in comparison to the horror we witnessed on September 11.

But is cyber terrorism coming? Given that at least some hackers sympathetic to bin Laden are engaging in cyber protests, will they or terrorists specifically trained in cyber methods conduct future operations using nothing more than a keyboard and mouse? And if they do, will their cyber bombs target critical infrastructures or cause death and destruction comparable to that from physical weapons? Or, will they use cyber terrorism as an ancillary tool to amplify the impact of a physical attack, for example, by jamming 911 services or shutting down electricity or telecommunications after blowing up a building or releasing toxic gases?

Before addressing these questions, it is important to understand what is meant by cyber terrorism. The term is generally understood to mean a computer-based attack or threat of attack intended to intimidate or coerce governments or societies in pursuit of goals that are political, religious, or ideological. The attack should be sufficiently destructive or disruptive to generate fear comparable to that from physical acts of terrorism. Attacks that lead to death or bodily injury, extended power outages, plane crashes, water contamination, or major economic losses would be examples. Depending on their impact, attacks against critical infrastructures such as electric power or emergency services could be acts of cyber terrorism. Attacks that disrupt nonessential services or that are mainly a costly nuisance would not.

To assess the potential threat of cyber terrorism, two factors must be considered: first, whether there are targets that are vulnerable to attack that could lead to severe harm, and second, whether there are actors with the capability and motivation to carry them out.

Looking first at vulnerabilities, several studies have shown that critical infrastructures are potentially vulnerable to a cyber terrorist attack This is not surprising, because systems are complex, making it effectively impossible to eliminate all weaknesses. New vulnerabilities are continually uncovered, and systems are configured or used in ways that make them open to attack. Even if the technology is adequately hardened, insiders, acting alone or in concert with other terrorists, may be able to exploit their access capabilities to wreak considerable harm.

Click here for the home page of CERT/CC.

Consultants and contractors are frequently in a position where they could cause grave harm. In March 2000, Japan's Metropolitan Police Department reported that a software system they had procured to track 150 police vehicles, including unmarked cars, had been developed by the Aum Shinryko cult, the same group that gassed the Tokyo subway in 1995, killing 12 people and injuring 6,000 more. At the time of the discovery, the cult had received classified tracking data on 115 vehicles. Further, the cult had developed software for at least 80 Japanese firms and 10 government agencies. They had worked as subcontractors to other firms, making it almost impossible for the organizations to know who was developing the software. As subcontractors, the cult could have installed Trojan horses to launch or facilitate cyber terrorist attacks at a later date.

If we take as given that critical infrastructures are vulnerable to a cyber terrorist attack, then the question becomes whether there are actors with the capability and motivation to carry out such an operation. While many hackers have the knowledge, skills, and tools to attack computer systems, they generally lack the motivation to cause violence or severe economic or social harm. Conversely, terrorists who are motivated to cause violence seem to lack the capability to cause that degree of damage in cyberspace. The methods of cyber terrorism are not, to the best of my knowledge, taught in the terrorist training camps of Afghanistan.

In August 1999, the Center for the Study of Terrorism and Irregular Warfare at the Naval Postgraduate School (NPS) in Monterey, California, issued a report entitled "Cyberterror: Prospects and Implications." Their objective was to assess the prospects of terrorist organizations pursuing cyber terrorism. They concluded that the barrier to entry for anything beyond annoying hacks is quite high and that terrorists generally lack the wherewithal and human capital needed to mount a meaningful operation. Cyber terrorism, they argued, was a thing of the future, although it might be pursued as an ancillary tool.

The NPS study examined five types of terrorist groups: religious, New Age, ethno-nationalist separatist, revolutionary, and far-right extremist. Of these, only the religious groups were thought likely to seek the most damaging capability level, as it would be consistent with their indiscriminate application of violence.

In October 2000, the NPS group issued a second report following a conference aimed at examining the decision making process that leads sub-state groups engaged in armed resistance to develop new operational methods. They were particularly interested in learning whether such groups would engage in cyber terrorism. In addition to academics and a member of the United Nations, the participants included a hacker and five practitioners with experience in violent sub-state groups. The latter included the PLO, the Liberation Tigers of Tamil Eelan (LTTE), the Basque Fatherland and Liberty-Political/Military (ETA-PM), and the Revolutionary Armed Forces of Colombia (FARC). The participants engaged in a simulation exercise based on the situation in Chechnya.

Only one cyber attack was authorized during the simulation, and that was against the Russian Stock Exchange. The attack was justified on the grounds that the exchange was an elite activity and thus disrupting it would not affect most Russians. Indeed, it might appeal to the average Russian. The group ruled out mass disruptions impacting e-commerce as being too indiscriminate and risking a backlash.

The findings from the meeting were generally consistent with the earlier study. Recognizing that their conclusions were based on a small sample, they concluded that terrorists have not yet integrated information technology into their strategy and tactics; that sub-state groups may find cyber terror attractive as a non-lethal weapon; that significant barriers between hackers and terrorists may prevent their integration into one group; and that politically motivated terrorists had reasons to target selectively and limit the effects of their operations, although they might find themselves in a situation where a mass casualty attack was a rational choice.

The NPS group also concluded that the information and communication revolution may lessen the need for violence by making it easier for sub-state groups to get their message out. Unfortunately, this conclusion does not seem to be supported by recent events. Many of the people in bin Laden’s network, including the suicide hijackers, have used the Internet but nevertheless engage in horrendous acts of violence. Groups that foster hate and aggression thrive on the Internet alongside those that promote tolerance and peace.

Although cyber terrorism is certainly a real possibility, for a terrorist, digital attacks have several drawbacks. Systems are complex, so controlling an attack and achieving a desired level of damage may be harder than using physical weapons. Unless people are killed or badly injured, there is also less drama and emotional appeal.

In assessing the threat of cyber terrorism, it is also important to look beyond the traditional terrorist groups and to the computer geeks who already possess considerable hacking skills. As noted at the beginning of this essay, some of these folks are aligning themselves with terrorists like bin Laden. While the vast majority of hackers may be disinclined towards violence, it would only take a few to turn cyber terrorism into reality.

Further, the next generation of terrorists will grow up in a digital world, with ever more powerful and easy-to-use hacking tools at their disposal. They might see greater potential for cyber terrorism than do the terrorists of today, and their level of knowledge and skill relating to hacking will be greater. Cyber terrorism could also become more attractive as the real and virtual worlds become more closely coupled, with automobiles, appliances, and other devices attached to the Internet. Unless these systems are carefully secured, conducting an operation that physically harms someone may be as easy as penetrating a Web site is today.

At least for now, hijacked vehicles, truck bombs, and biological weapons seem to pose a greater threat than cyber terrorism. However, just as the events of September 11 caught us by surprise, so could a major cyber assault. We cannot afford to shrug off the threat.

November 1, 2001

Dorothy E. Denning is the Patricia and Patrick Callahan Family Professor of Computer Science and Director of the Georgetown Institute for Information Assurance at Georgetown University. She has written extensively on information warfare and testified before Congress on cyberterrorism.

Friday, October 30, 2009

An older article but never the less timely: China’s cyber army is preparing to march on America, says Pentagon

From The Times

September 8, 2007

China ‘tops list’ of cyber-hackers

Chinese military hackers have prepared a detailed plan to disable America’s aircraft battle carrier fleet with a devastating cyber attack, according to a Pentagon report obtained by The Times.

The blueprint for such an assault, drawn up by two hackers working for the People’s Liberation Army (PLA), is part of an aggressive push by Beijing to achieve “electronic dominance” over each of its global rivals by 2050, particularly the US, Britain, Russia and South Korea.

China’s ambitions extend to crippling an enemy’s financial, military and communications capabilities early in a conflict, according to military documents and generals’ speeches that are being analysed by US intelligence officials. Describing what is in effect a new arms race, a Pentagon assessment states that China’s military regards offensive computer operations as “critical to seize the initiative” in the first stage of a war.

The plan to cripple the US aircraft carrier battle groups was authored by two PLA air force officials, Sun Yiming and Yang Liping. It also emerged this week that the Chinese military hacked into the US Defence Secretary’s computer system in June; have regularly penetrated computers in at least 10 Whitehall departments, including military files, and infiltrated German government systems this year.

Cyber attacks by China have become so frequent and aggressive that President Bush, without referring directly to Beijing, said this week that “a lot of our systems are vulnerable to attack”. He indicated that he would raise the subject with Hu Jintao, the Chinese President, when they met in Sydney at the Apec summit. Mr Hu denied that China was responsible for the attack on Robert Gates, the US Defence Secretary.

Larry M. Wortzel, the author of the US Army War College report, said: “The thing that should give us pause is that in many Chinese military manuals they identify the US as the country they are most likely to go to war with. They are moving very rapidly to master this new form of warfare.” The two PLA hackers produced a “virtual guidebook for electronic warfare and jamming” after studying dozens of US and Nato manuals on military tactics, according to the document.

The Pentagon logged more than 79,000 attempted intrusions in 2005. About 1,300 were successful, including the penetration of computers linked to the Army’s 101st and 82nd Airborne Divisions and the 4th Infantry Division. In August and September of that year Chinese hackers penetrated US State Department computers in several parts of the world. Hundreds of computers had to be replaced or taken offline for months. Chinese hackers also disrupted the US Naval War College’s network in November, forcing the college to shut down its computer systems for several weeks. The Pentagon uses more than 5 million computers on 100,000 networks in 65 countries.

Jim Melnick, a recently retired Pentagon computer network analyst, told The Times that the Chinese military holds hacking competitions to identify and recruit talented members for its cyber army.

He described a competition held two years ago in Sichuan province, southwest China. The winner now uses a cyber nom de guerre, Wicked Rose. He went on to set up a hacking business that penetrated computers at a defence contractor for US aerospace. Mr Melnick said that the PLA probably outsourced its hacking efforts to such individuals. “These guys are very good,” he said. “We don’t know for sure that Wicked Rose and people like him work for the PLA. But it seems logical. And it also allows the Chinese leadership to have plausible deniability.”

In February a massive cyber attack on Estonia by Russian hackers demonstrated how potentially catastrophic a preemptive strike could be on a developed nation. Pro-Russian hackers attacked numerous sites to protest against the controversial removal in Estonia of a Russian memorial to victims of the Second World War. The attacks brought down government websites, a major bank and telephone networks.

Linton Wells, the chief computer networks official at the Pentagon, said that the Estonia attacks “may well turn out to be a watershed in terms of widespread awareness of the vulnerability of modern society”.

After the attacks, computer security experts from Nato, the EU, US and Israel arrived in the capital, Tallinn, to study its effects.

Sami Saydjari, who has been working on cyber defence systems for the Pentagon since the 1980s, told Congress in testimony on April 25 that a mass cyber attack could leave 70 per cent of the US without electrical power for six months.

He told The Times that all major nations – including China – were scrambling to defend against, and working out ways to cause, “maximum strategic damage” by taking out banking systems, power grids and communications networks. He said that there were at least a thousand attempted attacks every hour on American computers. “China is aggressive in this,” he said.

Programmed to attack

Malware: a “Trojan horse” programme, which hides a “malicious code” behind an innocent document, can collect usernames and passwords for e-mail accounts. It can download programmes and relay attacks against other computers. An infected computer can be controlled by the attacker and directed to carry out functions normally available only to the system owner.

Hacking: increasingly a method of attack used by countries determined to use electronic means to gain access to secrets. Government computers in Britain have a network intrusion detection system, which monitors traffic and alerts officials to “misuse or anomalous behaviour”.

Botnets: compromised networks that an attacker can exploit. Deliberate programming errors in software can easily pass undetected. Attackers can exploit the errors to take control of a computer. Botnets can be used for stealing information or to collect credit card numbers by “sniffing” or logging the strokes of a victim’s keyboard.

Keystroke loggers: they record the sequence of key strokes that a user types in. Logging devices can be fitted inside the computer itself.

Denial of service attacks: overloading a computer system so that it can no longer function. This is the method allegedly used by the Russians to disrupt the Estonian government computers in May.

Phishing and spoofing: designed to trick an organisation’s customers into imparting confidential information such as passwords, personal data or banking details. Those using this method impersonate a “trusted source” such as a bank or IT helpdesk to persuade the victim to hand over confidential information. (Michael Evans)

US boots up new unified cybersecurity center

US Homeland Security Secretary Janet Napolitano cut the ribbon on Friday on a state-of-the-art unified command center for government cybersecurity efforts.

The National Cybersecurity and Communications Integration Center (NCCIC) brings together various government organizations responsible for protecting cyber networks and infrastructure and private sector partners.

"This will be a 24/7, 365-day-a-year facility to improve our national efforts to prepare and respond to threats and incidents affecting critical information technology and communications infrastructure," Napolitano said.

She said the NCCIC will serve as the "central repository" for the cyber protection efforts of the civilian side of the federal government and its private sector partners.

Attending the ribbon-cutting ceremony for the NCCIC was the head of the US military's "cyber command," Lieutenant General Keith Alexander, director of the super-secret National Security Agency (NSA).

The high-security new NCCIC facility is located in an Arlington, Virginia, office building and includes a long narrow room dominated by giant wall-mounted video screens displaying maps and threat data. Facing the screens are dozens of computer work stations with multiple screens.

"Securing Americas cyber infrastructure requires a coordinated and flexible system to detect threats and communicate protective measures to our federal, state, local, and private sector partners and the public," Napolitano said.

"Consolidating our cyber and communications operations centers within the NCCIC will enhance our ability to effectively mitigate risks and respond to threats," she added.

NCCIC combines two Homeland Security operational organizations: the US Computer Emergency Readiness Team (US-CERT) and the National Coordinating Center for Telecommunications (NCC).

US-CERT is a public-private partnership aimed to protecting and defending cyber infrastructure while the NCC is the operational arm of the National Communications System.

NCCIC will also integrate the National Cybersecurity Center (NCSC), which coordinates operations among the six largest federal cyber centers.

Napolitano, whose department has received the green light to hire up to 1,000 cybersecurity experts over the next three years, stressed the private sector participation in the NCCIC, noting they will have "offices in the same space."

US-CERT currently partners with a number of private sector companies such as telecommunications firms and others in monitoring cyber threats.

The opening of the NCCIC was the culmination of what has been dubbed "National Cybersecurity Awareness Month."

No single agency is currently charged with ensuring government information technology security and lawmakers have called for creating a powerful national cybersecurity advisor reporting directly to the president.

President Barack Obama has made cybersecurity a top priority and announced in May that he would name a "cyber czar" to defend against criminal, espionage and hacker attacks on US government and private computer networks.

Obama has not yet named the "cyber czar" but the 2010 Homeland Security Act that he signed on Wednesday included 397 million dollars for cybersecurity.

US government websites come under attack on a daily basis, according to the Department of Homeland Security, with the threats ranging from teenage hackers to criminal gangs to foreign governments.

US cyber center opens to battle computer attacks

By LOLITA C. BALDOR

Associated Press Writer
WASHINGTON —

The United States is well behind the curve in the fight against computer criminals, Sen. Joe Lieberman said Friday, as Homeland Security officials opened a $9 million operations center to better coordinate the government's response to cyberattacks.

Lieberman, chairman of the Senate Homeland Security and Government Affairs Committee, said legislation being drafted by his committee will require federal agencies and private companies to set up a system to share information on cyber threats.

And Lieberman, a Connecticut independent, said the Homeland Security Department must identify weaknesses in the systems that run power plants and other critical infrastructure.

As Lieberman laid out his proposal to Chamber of Commerce executives, Homeland Security Secretary Janet Napolitano unveiled the new National Cybersecurity and Communications Integration Center in northern Virginia.

Standing in front of a wall of broad video screens, that displayed vivid charts and maps of possible cyber threats and suspicious internet traffic, Napolitano said the watch center will allow the high-tech teams that monitor government networks to work better together.

With 61 computer stations spread across the room, the center will merge the U.S. Computer Emergency Readiness Team and the National Coordinating Center for Telecommunications.

U.S. officials have said that government computer systems are probed or scanned millions of times a day, and face an increasing threat from hackers, cyber criminals looking to steal money or information, and nation-states aimed at espionage or the destruction of networks that run vital services.

Officials have called for a more coordinated effort by the federal government to monitor and protect U.S. systems and work with the private sector to insure that transportation systems, energy plants and other sensitive networks are equally protected.

Sen. Susan Collins of Maine, the ranking Republican on the homeland security panel, said it will take more than a White House coordinator to secure the country's networks. And she pointed to the National Counterterrorism Center, which brings agencies together to assess terrorism data, as a good model for cyber coordination.

Napolitano told a crowd of federal workers and others at the new watch center that consolidating the cyber efforts will improve the government's ability to counter threats. Over time, the center - which will operate 24-hours a day - will also include the National Cybersecurity Center, which coordinates operations among the six largest federal cyber centers; the DHS Office of Intelligence and Analysis and representatives from the private sector.

President Barack Obama has declared computer security a priority, but he has been struggling for several months to appoint a new cyber coordinator. Several executives have turned it down, and critics and cyber experts say it is a nearly impossible job to fill.

White House spokesman Nick Shapiro said Obama is "personally committed to finding the right person for this job, and a rigorous selection process is well under way."

Lawmakers say the new coordinator, who Obama said would report to both the National Security Council and the National Economic Council, must be subject to Senate confirmation. The White House plan for the new policy adviser does not call for Senate confirmation because the person would be coordinating not unilaterally directing federal activities, Shapiro said.

Christopher Painter is currently serving as the acting senior director for cyber security in the White House.

Industrionage Enterprise Security