European Research Infrastructures (including e-Infrastructures)
THE INVISIBLE THREAT: CYBERSECURITY Web viewthe capability to shut down financial services, gas and...
Transcript of THE INVISIBLE THREAT: CYBERSECURITY Web viewthe capability to shut down financial services, gas and...
Running head: THE INVISIBLE THREAT
IA 2 THE INVISIBLE THREAT: CYBERSECURITY
Pamela Beaty
National Cybersecurity Policy and Law CSEC 9021
University of Maryland University College
Saundra McDavid
June 09, 2014
1
THE INVISIBLE THREAT: CYBERSECUITY
THE INVISIBLE THREAT: CYBERSECURITY
Table of Contents
Page #
1. Abstract 3
2. Introduction 4
3. Post 9-11 6
4. Revising Bush Initiative 8
5. Obama’s 60 Day Review of Bush’s Directives 9
6. The Making of a Cyber Weapon: Stuxnet. 10
7. Pass the Bill 14
2
ABSTRACT
Over the past ten years the federal government has struggled with protecting its own IT
system. During former President George H.W. Bush and William Clinton’s reign, both parties
periodically sought to address cybersecurity threats by enacting legislative laws and policies;
however technology along with the sophistication of attacks has changed since the Bush and
Clinton era. After 1990, cybersecurity changed from an ‘annoying problem’ to a national
security issue. President Barak Obama has coined the Internet as a digital infrastructure. The
current advancement of technology and the revelations of state actors conducting attacks against
US companies call for the Obama’s administration to make substantial improvements in updating
previous predecessors’ guidance regarding cybersecurity. The Stuxnet worm that attack Iran’s
industrial Programmable Logic Controllers (PLC) in Iran was created during the Bush era and
accelerated during Obama’s. Although neither administration has claimed responsibility for
shutting down Iran’s nuclear facility, this drone-like computer virus was far sophisticated than
any virus is an example of the new face of cyber war in the 21st century: sophisticated, invisible
and deadly. Despite the administration taking the initiative to advance cybersecurity technology
and embracing the public’s demands by declassifying previous directives policies, the Obama
administration is still unprepared to protect US communications and critical infrastructure. As
cybercrime and the risk of digital infrastructure increases, it is imperative for the government to
form a ‘brain thrust’ that consists of computer scientists, the private sector and the international
community to improve communications within the private sector, the international community
and the federal government. Beginning with a history of analysis from previous policies and past 3
cyber conflicts it is time for the government to proscribe a course of action in order to protect
communications network and our nation’s critical infrastructure.
The Invisible Threat: Cybersecurity
There have been a significant number of breaches in cybersecurity in the past few years
that could affect not only the private and public sector but also our nation’s critical
infrastructures. The efforts of protecting critical infrastructures took a positive step in the 1990’s
when President William Clinton issued Presidential Directive 39 (PDD 39) in response to a
domestic terrorist attack at the Oklahoma City bombing in 1995. PDD 39 outlined
counterterrorism and made protection of critical infrastructures a national priority. At a speech
before the U.S. Naval Academy in 1998, President Clinton provided a more detailed description
of foreign and domestic terrorism and how PDD 39 would help to counter the threat. President
Clinton stated to a group of U.S. Navy academy graduates that “If the U.S. fails to take strong
action, then terrorists, criminals and hostile regimes could invade and paralyze these vital
systems, disrupt commerce, threatening health, or weakening our capacity to function in a crisis
(Clinton, 1998).” The directive also discussed promoting partnerships between government and
owners of the infrastructures. Today cyber threats come from foreign and domestic groups and
individuals whose motives for attacking networks vary. Financial institutions have had their
websites come under direct denial of service (DDoS) attacks from individuals and groups. More
than eighty to ninety percent of cyber related critical infrastructures are owned by the private
sector (Eckert, 2005, p.179). Private sector companies who own critical infrastructures firewalls,
malware protection tools are constantly being tested for vulnerabilities by hackers whom they
believe are working for or with state actors such as Iran and China. Reports from security firms,
the private sector and from the federal government indicates China, Iran and Russia may have 4
the capability to shut down financial services, gas and electric systems, and possibly nuclear
plants. Critical infrastructures are prime targets for criminal elements due to lack of upgrades on
these types of servers. The fact that almost every significant activity (social media, US
government, military) depend on the security of the Internet is an overall threat to our nation’s
social and economic well-being. The use of the Internet is in the mist of unprecedented
technological changes. Building a safer network will require cooperation from the international
community, the private sectors and government agencies. As the threat to cyberspace grows, the
urgency in investing wisely in protecting, detecting, mitigating, and recovering from cyber
threats is imminent. The changing nature of technology and the aggressiveness of criminal
elements call for a periodic review and update on laws and policies that will promote information
sharing on cybersecurity.
Post 9-11
In 1939, a group of physicists wrote a letter to President Franklin Delano Roosevelt
(FDR) with Albert Einstein’s signature (PBS, 2012). The letter urged Roosevelt to consider
research development in building a nuclear weapon. During the 1940’s, Americans feared
Adolph Hitler’s power and German’s advancement in uranium enrichment research. Several
physicists including some who fled Germany feared German scientists were developing a
uranium enriched weapon. FDR consulted with his military advisors which resulted in what was
then a classified plan called the Manhattan Project. The Bush’s administration planning for
cyber war has been linked to the invention to the Manhattan Project. After the post-terrorism
events, President Bush’s second term in office provided him with the opportunity to implement
policies that included high-tech advancement and policies to protect the networks against
cybersecurity threats. In 2003, President Bush signed National Presidential Security Directive 16 5
(NPSD) without the public’s knowledge. Similar to the Manhattan project, this doctrine ordered
the government to develop guidelines for determining when and how the government would
launch cyberattacks against networks. Speculations of Iraq developing biological and nuclear
weapons led to the development of NPSD 16. In 2003, the United States planned a cyberattack
that would have frozen Iraq’s financial system which would have shut down Iraq’s President
Saddam Hussein’s cash flow. The plan was cancelled due to the Iraq’s bank system’s connection
to networks in France and the United States. In January 2003, the Bush administration consulted
with cyber experts, government officials and the academia at a meeting held at the Massachusetts
Institute of Technology (MIT). Harvey M. Sapolsky, MIT professor stated, “A lot of institutions
and people are worried about becoming subject to the same kinds of attack in reverse (Graham,
2003, p.2).” Fear of retaliatory attacks and collateral damage are one of many reasons why the
U.S. government did not use cyber warfare during the Iraq war.
By early 2007, senior government and military officials experienced in cyber warfare began to
implement strategies to launch cyberattacks against Iraq. In 2007, President Bush authorized
information warfare to use against Iraq. Information warfare encompassed using a computerized
system to attack Iraq’s network. Bush ordered the National Security Agency (NSA) to attack
Iraq’s cellular phones and computers Iraqi insurgents were using to emplace bombs. Iraq’s
electronic devices also allowed insurgents to post videos of the attack of Coalition Forces (CF)
on the Internet. Mike McConnell, former director of NSA and U.S. Army General Petraeus who
led the surge in Iraq, were two senior officials who believed cyber war was the future. The use
of cyber war enabled military planners to capture/kill some of the most influential insurgents in
Iraq by cutting off or jamming their electronic devices. A spike in the number of attacks in
government agencies networks and intelligence reports from the National Security Agency 6
(NSA) led the Bush administration to sign the National Security Presidential Directive
54/Homeland Security Presidential Directive 23 (NSPD54/HSPD 23) . This document was
designed to protect federal government systems intrusions, and to anticipate future attacks
(Sharp, 2003, p.3). The Comprehensive National Cyber security Initiative (CNCI) was
established under NSPD 54HSPD 23. This initiative outlined defense mechanisms to protect US
networks against cyberattacks. The directive also included expanding cyber education and
developing strategies to protect the nation against malicious activities in cyber space. The
overall goal of CNCI was to secure the U.S. in cyberspace.
Revising Bush’s Initiative
In 2010, President Obama’s administration declassified a portion of CNCI’s project.
President Obama cited the administration’s reason for declassifying the project was to foster a
transparent relationship between the private sector, the American public, and the government.
The pattern of secrecy defined the characteristics of Bush’s legacy. President Bush was criticized
during his tenure for expanding secrecy as part of the war on terrorism. President Obama
however wanted a more open dialogue with the public, After the September11 attacks, the seed
of distrust between America and the government began when Congress rushed to pass the Patriot
Act which expanded the government’s ability to track and detain suspected enemies in secret
including Americans. Civil libertarians and some conservative groups criticized the Bush
administration for failing to disclose some of their projects in cybersecurity and directives. Steve
Aftergood, who is in charge of the of the project on government secrecy for the Federation of
American scientists concurred some degree of secrecy is justifiable however during the Bush
administration he stated, “we are seeing far more secrecy than is warranted by national security
requirements(Graham, 2003).” The declassified project included new information on CNCI. The 7
Einstein project, part of the CNCI initiative, is a program that was designed to look for indicators
of cyberattacks by ‘sifting’ in Internet connections, including contents of emails. Einstein was
recently upgraded to Einstein 3 by the Obama administration. The goal of Einstein 3 is to
develop a next generation intrusion prevention system (Vijayan, 2010). President Obama stated
he planned to ensure the public that the plan would not violate privacy rights. Under CNCI, the
overall goal is to enhance advance warning capabilities and to develop an effective response to
deter attacks against federal and critical infrastructures.
Obama’s 60-Day Review of Bush’s Directives
No threat has grown faster and more complicated than cybersecurity. Before the end of
President Bush’s second term in office, his administration took bold steps to improve the overall
security of the nation’s networks. President Obama followed suit by hiring former Bush
appointees and revising some of Bush’s directives/initiatives on cybersecurity. After taking
office in 2009, Obama made protecting the nation’s digital networks and infrastructures a
priority and ordered a sixty day review of documents that entailed the government’s efforts to
protect vial information systems. The 60-Day Review led by a former Bush appointee (Melissa
Hathaway) offered an assessment and insights of what the United States must accomplish in
order to secure its digital future. The review was viewed as a critical step towards addressing the
challenges the government faced in securing information systems and outlined the importance of
partnerships. The report also recommended promoting education, more training, and
technological advancement in cyber security, but the report was not fundamentally different from
previous cybersecurity initiatives outlined from President Obama predecessors.
Let the Games Begin. During the last months of Bush’s presidential term, The New York Times
writer and author of the book Confront and Conceal, David Sanger reported that President Bush 8
authorized ‘Olympic Games,’ a covert program that was aimed to stop Iran’s electrical and
computer system (Sanger, 2012b ). Sanger’s intelligence information was based on interviews
with former American European and Israeli officials who were participants of the program.
Names were not provided due to the sensitive nature of the program. Olympic Games was
formulated in 2006 when President’s Bush’s options were limited. President Bush had
previously accused Iraq of staging nuclear weapons which proved false and Iran knew the
president had little credibility within the international community to publicly accuse another
country of reconstituting its nuclear program. Iran took advantage of this vulnerability and
increased its efforts in enriching its underground site in Nantz, Iran. Iran’s president even
invited the international community to visit the facility. The Bush administration began to fear
Iran was storing bomb grade material when Iran requested fuel for its civilian led nuclear
program when Iran was already receiving fuel from Russia. The program was so secret and
important to the Bush administration that before President Bush left office, President Elect
Obama was briefed on the covert program before taking oath. Bush then urged President Obama
to continue to focus on cybersecurity in particular conducting cyberattacks against Iran and to
continue strikes against Pakistan using unmanned aircrafts called drones. Obama agreed and
increased its efforts to attack against Iran using cyber warfare. After President Obama took the
presidential oath, Olympic Games under the Obama’s administration name was changed to
Stuxnet (Sanger, 2012). Despite Bush’s policies on cyber security, some security experts believe
the Obama Administration is considered the era of cyber war.
9
The Making of a Cyber weapon: Stuxnet
The Art of Cyber War. During his first months in office, President Obama secretly ordered
sophisticated attacks on Iran’s uranium enrichment facility. Some computer experts signify the
attack against Iran’s facility as America’s first sustained use of cyber weapons against an
adversary. Using human intelligence (HUMINT), imagery intelligence (IMINT), and foreign
allies (Israel, Germany) and a Universal Serial Bus (USB) also known as a flash drive, the U.S.
was able to gain access to Iran’s industrial computer controls. The National Security Agency
along with Israel’s cyber unit collaborated with the German company Siemens develop a code
which was tested at the Energy Departing using a replica of Iran’s facility. The test was deemed
successful. Thumb drives proved critical in spreading the attack as Israel using unwitting
employees at the facility in Iran to insert the thumb drive in a computer. In 2010, Iran reported
approximately 1,000 of its centrifuges at Iran’s Nuclear facility which is used for enriching
weapons-grade uranium was destroyed. Iran claimed the virus set back the program for at least
Israel the US intelligence agencies were blamed for the cyberattack and have yet to claim
responsibility. Some computer experts who have dissected Stuxnet stated that the program was
so complex that only government agencies were capable of designing it. Noted one intelligence
expert on cyber warfare, “To check out the worms, you have to know the machines; the reason
the worm has been effective is that the Israelis tried it out (Broad, Markoff, and Sanger, 2011).”
Unlike other types of malware, Stuxnet was designed to target Industrial control facilities such as
factories, refineries or plants. Technical analysis of Stuxnet revealed the virus was a complex
piece of malware with multiple features that took cybersecurity to a new level. When President 10
Obama was breached during every phase of the attack it was during this stage President Obama
was learning the arts of cyber war. Sanger noted that President Obama was aware that every
attack he approved was pushing the United States into unfound territory which was similar to his
predecessor FDR who authorized the Manhattan Project. According to Sanger President Obama
acknowledged any word of US and its allies involved in the use of cyber weapons could possibly
“enable other countries, terrorists, hackers, to justify their own attacks (Sanger, 2012a).”
Michael V Hayden, former chief of the Central Intelligence Agency (CIA) was interviewed by
the news show 60 Minutes did not admit to U.S. involvement but commented that Stuxnet was “a
good idea and it was the first attack of a major nature in which a cyberattack was used to effect
physical destruction, rather than just slow another computer, or hack into it to steal data (The
Chertoff Group, 2012).” President Obama repeatedly advised his aides the risk in using cyber
warfare and the overuse of the weapon during his meetings with prominent computer experts in
the White House’s Situation Room. President Obama understood the repercussions behind using
a physical weapon; President Obama’s prognostication regarding the over usage came to fruition.
In the summer of 2010, it was revealed a new variant of the virus that was programmed for the
Natanz facility had entered ‘cyberspace.’ Reports from computer experts revealed an error in the
code enabled the virus to spread to computer. When the virus left the Natanz facility in Iran, the
virus failed to recognize the environment had changed and the bug began to replicate itself.
Engineers working on the project ‘allegedly with the US believed the Israelis modified the code
but not without leaving a trace or digital forensics of the virus. Although President Obama was
hesitant to use the Stuxnet virus against other adversaries such as China and Syria, one
intelligence official noted the techniques in Iran could one day be used to “disrupt Chinese
military plans, forces in Syria, and Al-Qaeda operations around the world (Sangerb, 2012).” 11
However if the U.S. uses this type of cyber weapon on its adversaries the U.S. must take into
account the political blowback that adversaries may attempt to use cyber weapons against the
U.S.
Future of Cyberwar. Michael Hayden acknowledged the U.S. has entered a new phase of
conflict in which we use cyber weapons to create physical destruction in someone else’s critical
infrastructure. Speculation about what Stuxnet means for cybersecurity will continue to be
dissected in both the technical and political environment. Stuxnet has raised the bar and has set a
precedent for future attacks and has shown that industrial systems are vulnerable. Cyber weapons
offer great potential for striking at enemies with less risk than using traditional military means. It
is unclear how much the Stuxnet program cost, but it was almost certainly less than the cost of
12
Figure 1: How Stuxnet Spreads (2012). Note: From The New York Times. Copyright 2012 by Guilbert Gates. Reprinted with permission (Educational purposes only).
single fighter-bomber. Yet if damage from cyberattacks can be quickly repaired, careful strategic
thought is required in comparing the cost and benefits of cyber versus traditional military attack.
One important benefit of cyberattack may be its greater opportunity to achieve goals such as
retarding the Iranian nuclear program without causing the loss of life or injury to innocent
civilians that air strikes would seem more likely to inflict. Nevertheless, cyberattacks do carry a
risk of collateral damage, with a risk of political blowback if the attacking parties are identified.
Difficulty in identifying a cyber attacker presents multiple headaches for responding. A key
strategic risk in cyberattack finally, lies in potential escalatory responses. Strategies for using
cyber weapons like Stuxnet need to take into account that adversaries may attempt to turn them
back against the U.S.
Pass the Bill
Summary. No threat has ever grown as fast as cybersecurity. Before the end of President
Clinton’s term in 2001, he warned the nation and advised his predecessor President Bush
regarding the imminent threat of cybersecurity. President Bush took bold steps to improve
security U.S. networks and President Obama followed suit by appointing some of Bush’s
appointees to tackle cybersecurity issues. Threats to government networks have increased in
recent years. Cyber -attacks are no longer imposed by teenage hackers but sophisticated criminal
elements targeting U.S. financial banking systems, and criminal infrastructures. President Bill
Clinton, George W. Bush and Barak Obama administrations have each recognized the
importance of protecting the cyber space and each administration experienced cyberattacks
during their presidential terms. During the Bush administration counterterrorism was the focal
point. During President Bush’s tenure many Americans were outraged that terrorist activities in
13
the US occurred on US soil. This outrage enabled President Bush to pass laws relating to
terrorism. It was during his last term in office the administration began to concentrate its efforts
on passing directives in order to protect the nation’s networks and critical infrastructures. These
directives along with some of Bush’s initiatives were passed without the public’s knowledge and
the seed of distrust between Americans and the Bush administration became the focal point at the
end of Bush second term. President Obama is near the end of his second term. During his 2008,
presidential campaign, Obama promised the Americans that his administration would a
cybersecurity strategy due to breaches of data and cybersecurity attacks on U.S. companies by
state actors. The recession, the war in Afghanistan, deadlocks with Congress on passage of
cyber bills and a possible uprising of Al-Qaeda insurgents in Iraq are one of many issues that
have diverted the administration to refocus its efforts. The recent cyberattacks in the last two
years and well publicized security breaches has cause the administration to devote once again its
attention on cybersecurity. The Obama administration has made great strides in creating a
cybersecurity strategy but will suffer a resistance from Congress and once again skepticism from
the public.
Conclusion: The late Mohandas Ghandi, the political leader of India who was inspirational in
freeing the people of India from British oppression believed that policy was temporary and
subject to be changed. He believed that if there was a policy in place than one should pursue it
with expedience. Troubled with ending the war in Afghanistan, the Eric Snowden event in
which classified documents were leaked to state actors, and the uprising of Al Qaeda in Iraq has
once again caused the administration to place cybersecurity on the backburner. To date, few
cyber bills have yet to be passed from the Obama administration, despite the fact that cyber
14
threats are growing at a fast pace. Disagreements between party lines have also caused
legislative acts to be deadlocked in the senate. Bickering between political parties must end as
the government will need to address implementing a mandate to secure its own network. One
way to address this issue is to implement security policies with accurate definitions that the
public and private sector can follow. Second, the U.S. should address the need to implement an
international security policy. The public and private sector must start to consider other vital
cyber supply chain assets that are subject to attacks such as smartphones and tablets. Most of
these types of components are made in China who poses a serious threat to our country. These
recommendations can only be accomplished with the cooperation of both political parties and the
international community.
15
References
Broad, W. J., Markoff, J., & Sanger, D. E. (2011, January 15). Israeli test on worm called crucial
in Iran nuclear delay. New York Times, 15, 2011.
Clinton, B. (1998, May). “President Bill Clinton Speaks To The Naval Academy At Annapolis.”
Present at the Naval Academy, Annapolis Maryland.
Eckert, S. (2005). Protecting Critical Infrastructure: The Role of the Private Sector. Guns
& Butter: The Political Economy of International Security, 179-201.
Gates, G. (2012). How stuxnet spreads [Image]. Retrieved from
http://search.proquest.com.ezproxy.umuc.edu/docview/1017924484?accountid=14580
Graham, G. (February 7, 2003). Bush orders guidelines for cyber-warfare. Washington Post
Retrieved from http://www.stanford.edu/class/msande91si/www-spr04/readings/week5/
bush_guidelines.html
Public Broadcasting Service. (2012). American Experience: The Presidents. [Review of the
DVD American Experience, The Presidents, produced by American Experience, 2012]
Sanger, D. E. (2012, Jun 1, 2012). Obama order sped up wave of cyberattack16
against iran. New York Times Retrieved from
http://search.proquest.com.ezproxy.umuc.edu/docview/1017924484?accountid=14580
Sanger, D. E. (2012b.). Confront and conceal: Obama's secret wars and surprising use of
American power. Random House LLC.
Sharp Sr., W. G. (2010). Past, Present, and Future of Cybersecurity, The. J. Nat'l Sec. L. &
Pol'y, 4, 13.
The Chertoff Group. (2012, March 2012). General Michael Hayden discusses the stuxnet virus
on 60 minutes. [video file]. Retrieved from http://www.youtube.com/watch?
v=8HK3XPXBbNk
Vijayan, J. (2010, March). Obama administration partially lifts secrecy on classified
cybersecurity project. Computerworld. Retrieved from
http://www.computerworld.com/s/article/9164818/Obama_administration_partially_lifts_
secrecy_on_classified_cybersecurity_project
17