-
Notifications
You must be signed in to change notification settings - Fork 1
/
Cyber_Security_Policy_Catalog.html
executable file
·419 lines (411 loc) · 60.6 KB
/
Cyber_Security_Policy_Catalog.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
<!DOCTYPE html>
<html><head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Notes-FCS_Cyber_Security_Policy_Catalog</title>
<link rel="stylesheet" href="https://stackedit.io/style.css">
</head>
<body class="stackedit">
<div class="stackedit__left">
<div class="stackedit__toc">
<ul>
<li><a href="#notes---fundamentals-of-cyber-security--cyber-security-policy-catalog">Notes - Fundamentals of Cyber Security :: Cyber Security Policy Catalog</a>
<ul>
<li><a href="#cyber-governance-issues">Cyber Governance Issues</a>
<ul>
<li><a href="#internet-corporation-for-assigned-names-and-numbers-icann">Internet Corporation for Assigned Names and Numbers (ICANN)</a></li>
<li><a href="#net-neutrality">Net Neutrality</a>
<ul>
<li><a href="#cyber-security-policy-issues-concerning-net-neutrality">Cyber Security Policy Issues Concerning Net Neutrality</a></li>
</ul>
</li>
<li><a href="#internet-names-and-numbers">Internet Names and Numbers</a>
<ul>
<li><a href="#internet-addresses">Internet Addresses</a></li>
<li><a href="#domain-name-system-dns">Domain Name System (DNS)</a></li>
<li><a href="#domain-name-system-security-extensions-dnssec">Domain Name System Security Extensions (DNSSEC)</a></li>
<li><a href="#concerned-cyber-security-policy-issues">Concerned Cyber Security Policy Issues</a></li>
</ul>
</li>
<li><a href="#copyright-and-trademarks">Copyright and Trademarks</a></li>
<li><a href="#email-and-messaging">Email and Messaging</a>
<ul>
<li><a href="#email-spamming--phishing">Email Spamming & Phishing</a></li>
<li><a href="#security-of-emails--messages">Security of Emails & Messages:</a></li>
<li><a href="#concerned-cyber-security-policy-issues-1">Concerned Cyber Security Policy Issues</a></li>
</ul>
</li>
</ul>
</li>
<li><a href="#cyber-user-issues">Cyber User Issues</a>
<ul>
<li><a href="#malvertising">Malvertising</a>
<ul>
<li><a href="#what-is-malware">What is malware?</a></li>
<li><a href="#malware-history---early-malware">Malware History - Early Malware</a></li>
<li><a href="#concerned-cyber-security-policy-issues-2">Concerned Cyber Security Policy Issues</a></li>
</ul>
</li>
<li><a href="#impersonation">Impersonation</a>
<ul>
<li><a href="#cyber-security-policy-issues-concerning-impersonation">Cyber Security Policy Issues Concerning Impersonation</a></li>
</ul>
</li>
<li><a href="#appropriate-use">Appropriate use</a>
<ul>
<li><a href="#cyber-security-policy-issues">Cyber Security Policy Issues</a></li>
</ul>
</li>
<li><a href="#cyber-crime">Cyber Crime</a></li>
<li><a href="#classification-of-cyber-crimes">Classification of Cyber Crimes</a>
<ul>
<li><a href="#insider-attack">Insider Attack</a></li>
<li><a href="#external-attack">External Attack</a></li>
<li><a href="#unstructured-attacks">Unstructured Attacks</a></li>
<li><a href="#structured-attacks">Structured Attacks</a></li>
<li><a href="#reasons-for-commission-of-cyber-crimes">Reasons for Commission of Cyber Crimes</a></li>
<li><a href="#cyber-security-policy-issues-1">Cyber Security Policy Issues</a></li>
</ul>
</li>
<li><a href="#geolocation">Geolocation</a>
<ul>
<li><a href="#cyber-security-policy-issues-concerning-geolocation">Cyber Security Policy Issues Concerning Geolocation</a></li>
</ul>
</li>
<li><a href="#privacy--cyber-conflict-issues">Privacy & Cyber Conflict Issues</a></li>
<li><a href="#intellectual-property-theft">Intellectual property Theft</a></li>
<li><a href="#cyber-espionage">Cyber Espionage</a></li>
<li><a href="#cyber-sabotage">Cyber Sabotage</a>
<ul>
<li><a href="#cyber-security-policy-issues-concerning-cyber-sabotage">Cyber Security Policy Issues Concerning Cyber Sabotage</a></li>
</ul>
</li>
<li><a href="#cyber-warfare">Cyber Warfare</a></li>
<li><a href="#cyber-terrorism">Cyber Terrorism</a></li>
</ul>
</li>
<li><a href="#appendix">Appendix</a>
<ul>
<li><a href="#ip-address-classes">IP Address Classes</a></li>
<li><a href="#more-resources-on-impersonation-attacks">More Resources on Impersonation Attacks</a></li>
<li><a href="#malware-timeline">Malware Timeline</a></li>
</ul>
</li>
</ul>
</li>
</ul>
</div>
</div>
<div class="stackedit__right">
<div class="stackedit__html">
<h1 id="notes---fundamentals-of-cyber-security--cyber-security-policy-catalog">Notes - Fundamentals of Cyber Security :: Cyber Security Policy Catalog</h1>
<h2 id="cyber-governance-issues">Cyber Governance Issues</h2>
<p>The Internet began as the Advanced Research Projects Agency Network (ARPANET), a U.S.-military-funded network designed to survive a nuclear attack. It quickly became a tool for sharing information among computer science researchers in the military, its contractors, and its academic collaborators. The Internet Engineering Task Force (IETF) published as these new protocols as Requests for Comments, which allowed others to quickly learn and extend them.</p>
<h3 id="internet-corporation-for-assigned-names-and-numbers-icann">Internet Corporation for Assigned Names and Numbers (ICANN)</h3>
<p>The vast majority of Internet infrastructure and functions are decentralized, certain centralized planning and coordination functions are required. The most visible are the allocation of names ( like <a href="http://www.whitehouse.gov">whitehouse.gov</a>) and numbers (Internet Protocol address). These coordination functions were initially performed at Stanford Research Institute. In 1972, these functions were transitioned to the Internet Assigned Numbers Authority (IANA). The National Telecommunications and Information Administration (NTIA), an agency of the U.S. Department of Commerce, announced a non profit organization the Internet Corporation for Assigned Names and Numbers (ICANN) in 1998 to govern the IANA functions. The Internet is a U.S. creation, and the US Govt. has been leery to relinquish all control over the basic Internet coordination functions. ICANN technically remained a U.S. government (USG) contractor until the signing of the Affirmation of Commitments (AoC) a Memorandum of Understanding between the USG and ICANN on principles of multistakeholder Internet governance in 2009. The key cyber security policy issue is the Internet governance model and, in particular, the modality of participation by world governments. If governments disagree on the central coordination functions and begin to use different standards/procedures, the Internet may fragment into multiple or partially connected pieces. On October 1, 2016, ICANN ended its contract with the NTIA and entered the private sector.</p>
<h3 id="net-neutrality">Net Neutrality</h3>
<p>Most people get their high-speed internet access from only a few telecommunications giants When we send or receive data over the internet, we expect those companies to transfer that data from one end of the network to the other. Period. We don’t expect them to analyze or manipulate it.</p>
<p>Network neutrality means applying well-established “common carrier” rules to the internet in order to preserve its freedom and openness. Common carriage prohibits the owner of a network that holds itself out to all-comers from discriminating against information by halting, slowing, or otherwise tampering with the transfer of any data (except for legitimate network management purposes such as easing congestion or blocking spam). At times few cyber security policies and net neutrality principles seem to be at odds.</p>
<h4 id="cyber-security-policy-issues-concerning-net-neutrality">Cyber Security Policy Issues Concerning Net Neutrality</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.1.1</p>
</blockquote>
<ul>
<li>The operation of the DNS Root Server System shall be performed under contract with some entity or entities.</li>
<li>The Internet Center for Assigned Names and Numbers (ICANN) shall be required to allocate a percentage of its revenues for security and resilience.</li>
<li>ICANN shall turn over responsibility for Internet name and number space to the International Telecommunications Union (ITU).</li>
<li>ISPs shall filter at their client connections to ensure that source address in incoming traffic is within some legitimate network prefix range allocated to the corresponding customer.</li>
</ul>
<h3 id="internet-names-and-numbers">Internet Names and Numbers</h3>
<h4 id="internet-addresses">Internet Addresses</h4>
<p>With so many devices connected to the internet, we require some mechanism to uniquely identify every device that is connected to the internet. Also we require some centralized system which takes care of this mechanism so that the signs which are used to identify each device are not duplicate; else the whole purpose is defeated. To take care of this, we have a centralized authority known as <strong>Internet Assigned Numbers Authority (IANA)</strong>, which is responsible for assigning a unique number known as <strong>IP(Internet Protocol)</strong> address.</p>
<p>An IPv4 address is a 32-bit binary number which is divided into four octets and each octet consists of 8 binary digits and these octet are separated by a dot(.). An example of an IPv4 address is <code>11110110.01011010.10011100.1111100</code></p>
<p>Each 8-bits in an octet can have two binary values i.e. 0 and 1. Therefore, each octet can have min value 0 to max value 256 and in total have 256 different combinations. In decimal, the above IP address is expressed as <code>123.45.78.125</code></p>
<p>An IPv4 address consists of two parts viz. Network and Host. Network part identifies the network different network and the host part identifies a device of a particular network. IPv4 address are running out due to expoetinally increasing number of devices so a newer IPv6 address represented as eight groups, separated by colons, of four hexadecimal digits. The full representation may be shortened;</p>
<p>For example: <code>2001:0db8:0000:0000:0000:8a2e:0370:7334</code> becomes <code>2001:db8::8a2e:370:7334</code> was drafted and implemented as defualt now as days.</p>
<h4 id="domain-name-system-dns">Domain Name System (DNS)</h4>
<p>Whenever we browse any website on the internet, we type name something like <code>www.uou.ac.in</code> and we rarely deal with IP address like <code>104.28.2.92</code> but the fact is even if we type <code>http://104.28.2.92</code> in the URL, it will land us to the same webpage.</p>
<p>We are comfortable using and remembering the names instead of a number. Moreover, these IP address changes over time and some of the sites have multiple IP address. Also, the transfer of the data over internet is only possible using IP addresses because the routing of the packet of data sent over internet is done using IP address. <strong>Domain Name System(DNS)</strong> take cares of this translation job to simplify and to save us from remembering these changing IP address numbers.</p>
<p>Whenever we type an address like <code>http://www.uou.ac.in</code>, the process of DNS name resolution, takes place in the background. The computer keeps the track of recently visited sites and locally maintains a (routing table) database in the DNS cache. In case, the IP address of the site you have requested for is not found in the DNS cache of our local computer, then it proceeds to find it in the DNS server of the Internet Service Provider(ISP). These DNS servers of ISP also maintain the cache of the recently visited pages. Just in case, the information is not found here also, the DNS server of the ISP forward the query to the root nameservers. The root name servers publish the root zone file to other DNS servers and clients on the Internet. The root zone file describes where the authoritative servers for the DNS top-level domains (TLD) are located. There are currently 13 root name servers.</p>
<p>These root nameservers directs the query to the appropriate Top-Level Domain(TLD) nameservers by reading the last part of the URL first. In our example the URL was <code>http://www.uou.ac.in</code>. The last part is <code>.in</code> Some of the examples of TLD name servers are <code>.com, .biz, .org, .us, .in,</code> etc. These TLD nameservers acts as a switchboard and direct the query to the appropriate authoritative nameserver maintained by each domain. These authoritative nameserver maintains DNS records along with other useful information. This address record is returned back to the requesting host computer via TLD nameservers, nameservers, ISP’s DNS server. These intermediary server keeps the record of this IP address in their DNS cache, so that if the same request is encountered again, they don’t have to go through this process again. If the same URL is requested again, the DNS cache of the local host computer will return the IP address of the URL.</p>
<h4 id="domain-name-system-security-extensions-dnssec">Domain Name System Security Extensions (DNSSEC)</h4>
<p>A major concern with Internet names and numbers is that of either accidental or intentional diversion of Internet traffic to unauthorized destinations. For example, the translation from Internet names to Internet numbers can be subverted by a cyber attack called <em><strong>DNS poisoning</strong></em>. DNS poisoning refers to the corruption of a DNS server so that it stores an incorrect address for a given computer name. The incorrect address is usually a malicious site designed to look just like the website on the computer named in the query. allows attackers to divert legitimate user traffic to malicious sites without their knowledge, and without touching the user’s computer, simply by attacking the DNS server that the user queries for addresses.</p>
<p>DNS was not designed with security in mind and is vulnerable to poisoning, man-in-the-middle attacks. Thus the DNSSEC were created to address these concerns. The process uses public-private key cryptography to authenticate DNS records with the authoritative source. For DNSSEC to work effectively, a DNS server public key must be distributed in such a manner that users can verify its integrity. Then users can encrypt queries that can only be decrypted by the target DNS server, and DNS servers can encrypt responses with a private key.</p>
<p><em><strong>Digital Signature</strong></em>, the public-private key technology allows the key holder to sign data with the private key in such a way that allows the public key to be used to verify the digital signature. Because the public key is known to anyone, digital signatures do not facilitate confidentiality, merely data provenance and integrity.</p>
<p>The below figure illustrates Message sequence diagram for DNSSEC.</p>
<pre class=" language-mermaid"><svg id="mermaid-svg-f54DogZAV8bXFEuu" width="100%" xmlns="http://www.w3.org/2000/svg" height="689" style="max-width: 1397.5px;" viewBox="-166 -10 1397.5 689"><style>#mermaid-svg-f54DogZAV8bXFEuu{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#000000;}#mermaid-svg-f54DogZAV8bXFEuu .error-icon{fill:#552222;}#mermaid-svg-f54DogZAV8bXFEuu .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-f54DogZAV8bXFEuu .edge-thickness-normal{stroke-width:2px;}#mermaid-svg-f54DogZAV8bXFEuu .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-f54DogZAV8bXFEuu .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-f54DogZAV8bXFEuu .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-f54DogZAV8bXFEuu .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-f54DogZAV8bXFEuu .marker{fill:#666;stroke:#666;}#mermaid-svg-f54DogZAV8bXFEuu .marker.cross{stroke:#666;}#mermaid-svg-f54DogZAV8bXFEuu svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-f54DogZAV8bXFEuu .actor{stroke:hsl(0,0%,83%);fill:#eee;}#mermaid-svg-f54DogZAV8bXFEuu text.actor > tspan{fill:#333;stroke:none;}#mermaid-svg-f54DogZAV8bXFEuu .actor-line{stroke:#666;}#mermaid-svg-f54DogZAV8bXFEuu .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-f54DogZAV8bXFEuu .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-f54DogZAV8bXFEuu #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-f54DogZAV8bXFEuu .sequenceNumber{fill:white;}#mermaid-svg-f54DogZAV8bXFEuu #sequencenumber{fill:#333;}#mermaid-svg-f54DogZAV8bXFEuu #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-f54DogZAV8bXFEuu .messageText{fill:#333;stroke:#333;}#mermaid-svg-f54DogZAV8bXFEuu .labelBox{stroke:hsl(0,0%,83%);fill:#eee;}#mermaid-svg-f54DogZAV8bXFEuu .labelText,#mermaid-svg-f54DogZAV8bXFEuu .labelText > tspan{fill:#333;stroke:none;}#mermaid-svg-f54DogZAV8bXFEuu .loopText,#mermaid-svg-f54DogZAV8bXFEuu .loopText > tspan{fill:#333;stroke:none;}#mermaid-svg-f54DogZAV8bXFEuu .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(0,0%,83%);fill:hsl(0,0%,83%);}#mermaid-svg-f54DogZAV8bXFEuu .note{stroke:hsl(60,100%,23.3333333333%);fill:#ffa;}#mermaid-svg-f54DogZAV8bXFEuu .noteText,#mermaid-svg-f54DogZAV8bXFEuu .noteText > tspan{fill:#333;stroke:none;}#mermaid-svg-f54DogZAV8bXFEuu .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-f54DogZAV8bXFEuu .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-f54DogZAV8bXFEuu .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-f54DogZAV8bXFEuu:root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;}#mermaid-svg-f54DogZAV8bXFEuu sequence{fill:apa;}</style><g></g><g><line id="actor95" x1="75" y1="5" x2="75" y2="678" class="actor-line" stroke-width="0.5px" stroke="#999"></line><rect x="0" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" rx="3" ry="3" class="actor"></rect><text x="75" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="75" dy="0">Browser on PC</tspan></text></g><g><line id="actor96" x1="312" y1="5" x2="312" y2="678" class="actor-line" stroke-width="0.5px" stroke="#999"></line><rect x="237" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" rx="3" ry="3" class="actor"></rect><text x="312" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="312" dy="0">ICANN root "."</tspan></text></g><g><line id="actor97" x1="512" y1="5" x2="512" y2="678" class="actor-line" stroke-width="0.5px" stroke="#999"></line><rect x="437" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" rx="3" ry="3" class="actor"></rect><text x="512" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="512" dy="0">DNS for .com.</tspan></text></g><g><line id="actor98" x1="712" y1="5" x2="712" y2="678" class="actor-line" stroke-width="0.5px" stroke="#999"></line><rect x="637" y="0" fill="#eaeaea" stroke="#666" width="150" height="65" rx="3" ry="3" class="actor"></rect><text x="712" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="712" dy="0">Alice</tspan></text></g><g><line id="actor99" x1="937.5" y1="5" x2="937.5" y2="678" class="actor-line" stroke-width="0.5px" stroke="#999"></line><rect x="837" y="0" fill="#eaeaea" stroke="#666" width="201" height="65" rx="3" ry="3" class="actor"></rect><text x="937.5" y="32.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="937.5" dy="0">DNS for www.bayuk.com</tspan></text></g><defs><marker id="arrowhead" refX="9" refY="5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z"></path></marker></defs><defs><marker id="crosshead" markerWidth="15" markerHeight="8" orient="auto" refX="16" refY="4"><path fill="black" stroke="#000000" stroke-width="1px" d="M 9,2 V 6 L16,4 Z" style="stroke-dasharray: 0, 0;"></path><path fill="none" stroke="#000000" stroke-width="1px" d="M 0,1 L 6,7 M 6,1 L 0,7" style="stroke-dasharray: 0, 0;"></path></marker></defs><defs><marker id="filled-head" refX="18" refY="7" markerWidth="20" markerHeight="28" orient="auto"><path d="M 18,7 L9,13 L14,7 L9,1 Z"></path></marker></defs><defs><marker id="sequencenumber" refX="15" refY="15" markerWidth="60" markerHeight="40" orient="auto"><circle cx="15" cy="15" r="6"></circle></marker></defs><text x="194" y="80" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;">query for ".com."</text><text x="194" y="99" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;"> key verifier</text><line x1="75" y1="135" x2="312" y2="135" class="messageLine0" stroke-width="2" stroke="none" marker-end="url(#arrowhead)" style="fill: none;"></line><text x="194" y="150" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;">recieve .com.</text><text x="194" y="169" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;"> verifier</text><line x1="312" y1="205" x2="75" y2="205" class="messageLine0" stroke-width="2" stroke="none" marker-end="url(#arrowhead)" style="fill: none;"></line><text x="294" y="220" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;">query for ".com." address</text><line x1="75" y1="255" x2="512" y2="255" class="messageLine0" stroke-width="2" stroke="none" marker-end="url(#arrowhead)" style="fill: none;"></line><text x="294" y="270" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;">recive ".com." address and key</text><line x1="512" y1="305" x2="75" y2="305" class="messageLine0" stroke-width="2" stroke="none" marker-end="url(#arrowhead)" style="fill: none;"></line><g><rect x="-100" y="315" fill="#EDF2AE" stroke="#666" width="150" height="36" rx="0" ry="0" class="note"></rect><text x="-25" y="320" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="noteText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 14px; font-weight: 400;"><tspan x="-25">verify.com.</tspan></text></g><text x="394" y="366" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;">Checking with John...</text><line x1="75" y1="401" x2="712" y2="401" class="messageLine0" stroke-width="2" stroke="none" marker-end="url(#arrowhead)" style="fill: none;"></line><text x="394" y="416" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;">Yes... John, how are you?</text><line x1="712" y1="451" x2="75" y2="451" class="messageLine0" stroke-width="2" stroke="none" marker-end="url(#arrowhead)" style="fill: none;"></line><g><rect x="-116" y="461" fill="#EDF2AE" stroke="#666" width="166" height="36" rx="0" ry="0" class="note"></rect><text x="-33" y="466" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="noteText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 14px; font-weight: 400;"><tspan x="-33">verify.bayuk.com.</tspan></text></g><text x="506" y="512" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="messageText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 16px; font-weight: 400;">query for .bayuk.com. address</text><line x1="75" y1="547" x2="937.5" y2="547" class="messageLine0" stroke-width="2" stroke="none" marker-end="url(#arrowhead)" style="fill: none;"></line><g><rect x="962.5" y="557" fill="#EDF2AE" stroke="#666" width="219" height="36" rx="0" ry="0" class="note"></rect><text x="1072" y="562" text-anchor="middle" dominant-baseline="middle" alignment-baseline="middle" class="noteText" dy="1em" style="font-family: "trebuchet ms", verdana, arial, sans-serif; font-size: 14px; font-weight: 400;"><tspan x="1072">typically dns.bayuk.com</tspan></text></g><g><rect x="0" y="613" fill="#eaeaea" stroke="#666" width="150" height="65" rx="3" ry="3" class="actor"></rect><text x="75" y="645.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="75" dy="0">Browser on PC</tspan></text></g><g><rect x="237" y="613" fill="#eaeaea" stroke="#666" width="150" height="65" rx="3" ry="3" class="actor"></rect><text x="312" y="645.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="312" dy="0">ICANN root "."</tspan></text></g><g><rect x="437" y="613" fill="#eaeaea" stroke="#666" width="150" height="65" rx="3" ry="3" class="actor"></rect><text x="512" y="645.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="512" dy="0">DNS for .com.</tspan></text></g><g><rect x="637" y="613" fill="#eaeaea" stroke="#666" width="150" height="65" rx="3" ry="3" class="actor"></rect><text x="712" y="645.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="712" dy="0">Alice</tspan></text></g><g><rect x="837" y="613" fill="#eaeaea" stroke="#666" width="201" height="65" rx="3" ry="3" class="actor"></rect><text x="937.5" y="645.5" dominant-baseline="central" alignment-baseline="central" class="actor" style="text-anchor: middle; font-size: 14px; font-weight: 400; font-family: Open-Sans, "sans-serif";"><tspan x="937.5" dy="0">DNS for www.bayuk.com</tspan></text></g></svg></pre>
<h4 id="concerned-cyber-security-policy-issues">Concerned Cyber Security Policy Issues</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.1.2</p>
</blockquote>
<ul>
<li>All DNS names shall be associated with individuals or corporations who are accountable for services provided under them.</li>
<li>DNS server operators shall be licensed, and failure to maintain proper security controls shall result in loss of license.</li>
<li>Operators of border gateway protocol routers shall be penalized for routing traffic to locations that are not registered for them.</li>
<li>Government telecommunications regulatory agencies shall recommend and enforce effective and efficient means of securing telecommunications infrastructure.</li>
</ul>
<h3 id="copyright-and-trademarks">Copyright and Trademarks</h3>
<h3 id="email-and-messaging">Email and Messaging</h3>
<p>Emails can be used blatantly to impersonate a company. Email impersonation may happen from a person’s own inbox due to malicious software or servers not requiring the presentation of a key for authentication or as long as any one server in the email relay between a sender and receiver supports a text-only-based command strings (email protocols).</p>
<h4 id="email-spamming--phishing">Email Spamming & Phishing</h4>
<p>In the early days of the Internet, users would use the word “spam” to describe content they had no wish to see, and excessive unwanted multiple postings elicited “spam” as the reply from angry users. The term <em><strong>spam</strong></em> now generically refers to any unwanted email content (Furr 1990). Internet watchdogs keep records of spam in order to identify perpetrators with the goal of reducing it. But, any Internet user knows, these efforts are largely unsuccessful in preventing spamming but these days email detection is at near perfect rate.</p>
<p><em><strong>Phishing</strong></em>, refers to baiting, or luring, Internet users to click on links that take them to malicious websites. The malicious sites may be domain squatting look-alikes that collect user names and passwords. They may download malware. They may be fraudulent scams to trick users into transferring money from their bank accounts. When a specific set people like high net worth individuals or CxO’s of organizations are targeted by phishing emails, it is called <em><strong>spearphishing</strong></em>, in analogy with whales as the target.</p>
<h4 id="security-of-emails--messages">Security of Emails & Messages:</h4>
<p>Sometimes we would like e-mail to be more secure. To define and implement a more secured email protocols, we need to understand the exposures & threats invovled in ordinary e-mail.</p>
<h5 id="threats-to-e-mail">Threats to E-mail</h5>
<ul>
<li>Message interception (confidentiality)</li>
<li>Message interception (blocked delivery)</li>
<li>Message interception and subsequent replay</li>
<li>Message content modification</li>
<li>Message origin modification</li>
<li>Message content forgery by outsider</li>
<li>Message origin forgery by outsider</li>
<li>Message content forgery by recipient</li>
<li>Message origin forgery by recipient</li>
<li>Denial of message transmission</li>
</ul>
<h5 id="requirements-and-solutions">Requirements and solutions</h5>
<p>Following protections must be taken for protection in emails</p>
<ul>
<li>Message confidentiality (the message is not exposed enroute to the receiver)</li>
<li>Message integrity (what the receiver sees is what was sent)</li>
<li>Sender authenticity (the receiver is confident who the sender was)</li>
<li>Nonrepudiation (the sender cannot deny having sent the message)</li>
</ul>
<p><em>Technologies available to companies that wish to secure email communications</em></p>
<ul>
<li><strong>Sender Policy Framework (SPF)</strong> was developed from 2000 with publication as an experimental RFC 4408 in 2006. The basic principle is that the domain owner publishes details of mail servers that legitimately send Email on behalf of the domain via DNS text (TXT) records. The intent is that if a message is received from a server not included in these DNS records, then the receiving Email server can presume the message has not been sent by a server in use by the domain and take appropriate ‘counter-spam’ action.</li>
<li><strong>Sender ID Framework (SIDF)</strong>, which utilizes DNS to identify the authorized email server for a domain and does not allow email from a domain unless the sending server is identified in the DNS records for the domain when a valid signature is expected. SIDF is generally considered obsolete with its role now fulfilled by <em><strong>DMARC</strong></em>.</li>
<li><strong>DomainKeys Identified Mail (DKIM)</strong> goes a step further and allows an encryption key to be stored in DNS, so companies can set rules to permit, rejection, deletion, or tag unsigned or improperly signed messages from a given business partner.</li>
<li><strong>Transport Layer Security (TLS)</strong>, which is called an opportunistic protocol because it can be set to require the highest level of security that is available on the server with which it communicates.</li>
<li><strong>Domain-Based Message Authentication, Reporting And Conformance (DMARC)</strong> introduces the idea of ‘domain alignment’ between the ‘From’ and ‘Mail From’ addresses. DMARC is designed to complement and bolster SPF and DKIM and uses both as its means of validating Email. DMARC provides a reporting mechanism so that a domain owner can gain visibility of how recipients are handling mail quoting their domain name. And a formal statement of the action the domain owner would like the recipient to take in the case of a message failing the DMARC checks.</li>
</ul>
<h4 id="concerned-cyber-security-policy-issues-1">Concerned Cyber Security Policy Issues</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.1.4</p>
</blockquote>
<ul>
<li>All entities that participate in electronic commerce shall offer customers the ability to verify their email server via standard protocols.</li>
<li>All email communications on behalf of or concerning the organization shall utilize organizationsupported email services.</li>
<li>Delivery and read receipts on email shall provide proof of electronic information delivery.</li>
<li>Individuals shall have the ability to place their email addresses on a list which would make it illegal for marketers to send them unwanted email.</li>
</ul>
<h2 id="cyber-user-issues">Cyber User Issues</h2>
<p>Security issues for cyber users have mostly arisen from unintended side effects of the e-commerce race to participate in new markets. E-commerce transactions flow between the shopper, the shopper’s computer, the network connection between shopper and e-commerce web server, the e-commerce web server, and e-commerce vendor internal network, and the connections between the e-commerce vendor and the service providers they need to close the transaction, such as a credit card payment clearing company. All of these connections are created using software, and any of that software may have a bug or a flaw that allows an intruder to observe cyber user data flow or disrupt the e-commerce transaction. In many of these points of connectivity, observation of data flow provides information that may be used for later attacks. It is the attacker’s goal to exploit one or more of the three other players for illegal gains. Using vulnerabilities in software, application configurations, hardware, and even user habits, an attacker will seek to exploit these vulnerabilities to the attacker’s advantage. e-Commerce attacks are constantly occurring as the product of three archetypes: <em><strong>exploiters, enablers, and expeditor</strong></em>.</p>
<p><strong>Exploiters</strong> carry out data theft and fraud. <strong>Enablers</strong> are businesses whose practices allow it. <strong>Expeditors</strong> are technologists who identify the root cause from a technical point of view, though they may be attackers or defenders. The exploiters not only exploit the consumer, an identity theft victim, but also exploit low-level social misfits, such as meth addicts. They enlist the social misfits to withdraw unwitting consumers’ cash out of automatic teller machines or to order luxuries on the unwitting consumers’ credit cards. The stories sporadically include tales of victories of law enforcement “expeditors” who figure out how the exploiters did it. The moral of every sad story is that the enabler did not sufficiently protect data within its custody, while an evil genius controlling three or more layers of organized criminal structure above the social misfits is never actually caught. The consumer is left with damaged credit, as well as loss of time and money, while the enabler claims that “adequate” risk measures are in place to secure the enterprise.</p>
<p>Cyber user security issues can be divided into the below six subsections.</p>
<h3 id="malvertising">Malvertising</h3>
<p>Malvertising is an anagram of the words “malicious” and “advertising.” e-Commerce businesses that rely on advertising typically are designed to attract consumers in a desired demographic, the advertising “target.” One method of reaching the target is to identify web pages frequented by the target and purchase ads directly on those web pages. The web page owner/seller may require that the ad be provided to them for placement, or they could simply link to a site provider by the ad buyer and direct the user’s browser to access the buyer’s web content directly. This easy access to the Internet consumer has attracted criminals seeking to install malware.</p>
<h4 id="what-is-malware">What is malware?</h4>
<p>Malware = Malicious + Software, Malware is any piece of hardware, software or firmware that is intentionally included or introduced into a computer system for unauthorized purposes usually without the knowledge or consent of the user. Software can be considered malware even if it is not actually malicious. The perceived intent of the author is a consideration.</p>
<p>Malware includes viruses, trojans, worms, hoaxes, logic bombs, etc. Be careful with terminology <em><strong>!A virus is malware but not all pieces of malware are viruses!</strong></em></p>
<h4 id="malware-history---early-malware">Malware History - Early Malware</h4>
<ul>
<li>[ late 1940’s - early 50’s] Von Neumann designed a finite automata with 200,000 cells which could exist in one of twenty-nine states and could self-replicate.</li>
<li>[1979] - Christopher Langton writes a self-replicating computer “organism” on an Apple II desktop.</li>
<li>1980’s saw the rise of the first true viruses, such as Elk Cloner [refer to appendix for complete timeline].</li>
</ul>
<p>A less frequently reported but still significant profit margin e-commerce criminal activity that comes under the heading of malvertising is <em><strong>coupon fraud</strong></em>. Criminals often copy or modify coupons to increase values, decrease purchase requirements, defeat or eliminate security codes, extend or eliminate expiration dates, and/or alter disclaimers, terms and conditions or create complete fake coupons.</p>
<h4 id="concerned-cyber-security-policy-issues-2">Concerned Cyber Security Policy Issues</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.2.1</p>
</blockquote>
<ul>
<li>e-Commerce marketing that includes redirection of individual computers to sites via links that they did not intentionally follow shall be illegal.</li>
<li>It shall be illegal to install and run software on machines owned by someone else.</li>
<li>All legitimate software execution shall be recognizable to the average computer user.</li>
<li>Internet coupons shall identify the authorized consumer by name, address, and a unique identification number.</li>
</ul>
<h3 id="impersonation">Impersonation</h3>
<p>Impersonation deals with various types of impostors on the Internet, from anonymous postings to account hijacking. An <strong>impersonation attack</strong> is a form of fraud in which attackers pose as a known or trusted person to dupe an employee into transferring money to a fraudulent account, sharing sensitive information (such as intellectual property, financial data or payroll information), or revealing login credentials. Threat actors may impersonate family, friends, colleagues, and legitimate businesses and banks, including executives, vendors, and customers, also as officials from government agencies.</p>
<p>Impersonation Attacks Constructed by <strong>Finding the Target</strong>, then <strong>Creating Credibility</strong> and later <strong>Executing the Attack</strong>. The final and the most important step is to choose a type of attack. These are top 3 tactics used by attackers:</p>
<ul>
<li>By Registering a Look-Alike Email Domain</li>
<li>Editing the Display Name: The majority of the mobile email clients only show the display name of the sender. This makes it quite easy for the attacker to edit their display name and trap the victim into their game. For example, the attacker sends the message using an email like <a href="mailto:xyz@gmail.com">xyz@gmail.com</a> but edits the display name to the person being impersonated.</li>
<li>Using a Free Email Account: This is another common tactic used by attackers. All they do is send a message through a free email account such as Gmail, Yahoo, etc. In the email, the sender indicates that they have been locked out of their official account and need immediate help in order to get a task done.</li>
</ul>
<h4 id="cyber-security-policy-issues-concerning-impersonation">Cyber Security Policy Issues Concerning Impersonation</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.2.2</p>
</blockquote>
<ul>
<li>All Internet communication shall be attributable to an individual. This policy would require identification and authentication as a condition for Internet connectivity. No anonymous access would be allowed.</li>
<li>Assuming a false identity on the Internet shall be prohibited.</li>
<li>Possession of credentials that correspond to another person’s digital identity shall be forbidden.</li>
<li>International and national standards organizations shall issue standards for identity assurance ratings, and these shall be required labels on e-commerce websites.</li>
</ul>
<h3 id="appropriate-use">Appropriate use</h3>
<p>It addresses common Internet behaviors that some deem antisocial, and may not be criminal simply because they have not yet been formally considered by legislators. In the software industry, end-user license agreements (<em><strong>EULAs</strong></em>) are used to specify the terms and conditions under which software is licensed to those who purchase it. These agreements typically limit the authority of the user to copy the software and limit the liability of the vendor for any faults in software operation. These agreements are typically presented in an automated fashion while a user is installing software.</p>
<p>One common method of software license verification is for the software to <em><strong>phone home</strong></em>, which is used to refer to the capability of software to access the software vendor’s website. Phone home features check attributes of the software installation with the vendor’s records of purchase. For example, if a purchaser has installed the software on more machines than permitted via the EULA, the software may disable itself. The opposite of a phone home feature is a <em><strong>command and control feature</strong></em>. A command and control feature allows a central administrator to control software on multiple computers. Each controlled computer is configured to listen to the network; that is, network listening is a technique that software uses to be alerted to Internet queries. Network listening features combine the Internet address of a computer with a subaddress, or port, that can be assigned by a computer operating system to a software process. A typical computer has <em>64,000 ports</em> that can be distributed among software processes, and the controlled software will select one that is not used by any common programs. Malware command and control features are sometimes referred to as <em><strong>RATs</strong></em>, an acronym for remote access tool that conveys its malicious purpose.</p>
<h4 id="cyber-security-policy-issues">Cyber Security Policy Issues</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.2.3</p>
</blockquote>
<ul>
<li>Any software installed on computers without the express consent of the owner shall be considered trespassing.</li>
<li>Software companies shall be prohibited from implementing phone home features by default.</li>
<li>All computer operating systems that allow phone home and command and control features in software running on that operating system shall give users a choice of whether to enable them.</li>
<li>Software shall not be installed in such a way that it runs without the user’s express knowledge.</li>
</ul>
<h3 id="cyber-crime">Cyber Crime</h3>
<p>The term cyber crime is used to describe an unlawful activity in which computer or computing devices such as smartphones, tablets, etc. which are stand alone or a part of a network are used as a tool or/and target of criminal activity.</p>
<h3 id="classification-of-cyber-crimes">Classification of Cyber Crimes</h3>
<p>The cyber criminal could be internal or external to the organization facing the cyber attack. Based on this fact, the cyber crime could be categorized into two types:</p>
<h4 id="insider-attack">Insider Attack</h4>
<p>An attack to the network or the computer system by some person with authorized system access is known as insider attack. It is generally performed by dissatisfied or unhappy inside employees or contractors. The motive of the insider attack could be revenge or greed. It is comparatively easy for an insider to perform a cyber attack as he is aware of the policies, processes, IT architecture and weakness of the security system. Moreover, the attacker have access to the network. Therefore, it is comparatively easy for an insider attacker to steel sensitive information, crash the network, etc. In most of the cases the reason for insider attack is when an employee is fired or assigned new roles in an organization, and the role is not reflected in the IT policies. This opens a vulnerability window for the attacker. The insider attack could be prevented by planning and installing an Internal intrusion detection systems (IDS) in the organization.</p>
<h4 id="external-attack">External Attack</h4>
<p>When the attacker is either hired by an insider or an external entity to the organization, it is known as external attack. The organization which is a victim of cyber attack not only faces financial loss but also the loss of reputation. Since the attacker is external to the organization, so these attackers usually scan and gathering information. An experienced network/security administrator keeps regular eye on the log generated by the firewalls as external attacks can be traced out by carefully analyzing these firewall logs. Also, Intrusion Detection Systems are installed to keep an eye on external attacks.</p>
<p>The cyber attacks can also be classified as structure attacks and unstructured attacks based on the level of maturity of the attacker.</p>
<h4 id="unstructured-attacks">Unstructured Attacks</h4>
<p>These attacks are generally performed by amatures who don‟t have any predefined motives to perform the cyber attack. Usually these amatures try to test a tool readily available over the internet on the network of a random company.</p>
<h4 id="structured-attacks">Structured Attacks</h4>
<p>These types of attacks are performed by highly skilled and experienced people and the motives of these attacks are clear in their mind. They have access to sophisticated tools and technologies to gain access to other networks without being noticed by their Intrusion Detection Systems(IDSs). Moreover, these attackers have the necessary expertise to develop or modify the existing tools to satisfy their purpose. These types of attacks are usually performed by professional criminals, by a country on other rival person or the country, terrorists, companies, etc.</p>
<p><a href="https://imgur.com/LJ2Fb0f"><img src="https://imgur.com/LJ2Fb0f.png" alt="Crimeware Marketplace"></a></p>
<h4 id="reasons-for-commission-of-cyber-crimes">Reasons for Commission of Cyber Crimes</h4>
<p>There are many reasons which act as a catalyst in the growth of cyber crime. Some of the prominent reasons are:</p>
<ul>
<li>[Money]: People are motivated towards committing cyber crime is to make quick and easy money.</li>
<li>[Fun]: The amateur do cyber crime for fun. They just want to test the latest tool they have encountered.</li>
<li>[Cyber Espionage]: At times, the government itself is involved in cyber trespassing to keep eye on other person/network/country. The reason could be politically, economically socially motivated.</li>
<li>[Revenge]: Some people try to take revenge with other person/organization/society/ caste or religion by defaming its reputation or bringing economical or physical loss. This comes under the category of cyber terrorism.</li>
<li>[Recognition]: It is pride if someone hacks the highly secured networks like defense sites or networks.</li>
<li>[Anonymity]: Many time the anonymity that a cyber space provide also motivates the person to commit cyber crime as it is much easy to commit a cyber crime over the cyber space and remain anonymous as compared to real world.</li>
</ul>
<p><a href="https://i.imgur.com/aLFliIy"><img src="https://i.imgur.com/aLFliIy.png" alt="Crimeware risk-profit tradespace"></a></p>
<h4 id="cyber-security-policy-issues-1">Cyber Security Policy Issues</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.2.4</p>
</blockquote>
<ul>
<li>The Internet shall not be used to incentivize violence against persons or property.</li>
<li>Individuals who are stalked, bullied, blackmailed, and/or harassed on the Internet shall be able to declare that the behavior is harassment under the law.</li>
<li>Individuals who use false identities or anonymous access to report false crimes or emergencies, as well as those who itness such events without reporting them, shall receive mandatory jail terms.</li>
<li>Existing international organizations—such as NATO, ASEAN, OAS, EU, and AU—shall include cyber crime as part of all their eliberations and treaties.</li>
</ul>
<h3 id="geolocation">Geolocation</h3>
<p><a href="https://i.imgur.com/czqzWRE"><img src="https://i.imgur.com/czqzWRE.png" alt="BotNet Attack Path"></a></p>
<h4 id="cyber-security-policy-issues-concerning-geolocation">Cyber Security Policy Issues Concerning Geolocation</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.2.5</p>
</blockquote>
<ul>
<li>Purposely hiding one’s physical location, or helping others hide their physical location, on the Internet shall not be criminalized. This policy would allow anonymization services, as well as the installation of proxy services on bots, to mask the source of Internet activities.</li>
<li>Those who allow their networks to be used by cyber criminals shall be guilty of aiding and abetting any crime committed. This policy would require all networks owners to identify all users and police their borders for unauthorized use.</li>
<li>Geolocational information coordinates for any mobile device shall be available to law enforcement. This policy would require mobile devices to allow access to geolocational information files, such as GPS coordinates, on mobile devices upon request.</li>
</ul>
<h3 id="privacy--cyber-conflict-issues">Privacy & Cyber Conflict Issues</h3>
<h3 id="intellectual-property-theft">Intellectual property Theft</h3>
<h3 id="cyber-espionage">Cyber Espionage</h3>
<p>Cyber spying or cyber espionage, is the act or practice of obtaining secrets and information without the permission and knowledge of the holder of the information from individuals, competitors, rivals, groups, governments and enemies for personal, economic, political or military advantage using methods on the Internet.</p>
<h3 id="cyber-sabotage">Cyber Sabotage</h3>
<p>Cyber sabotage is a phrase that reflects the damage potential from cyberspace terrorists. Any kind of enterprise may be targeted by saboteurs, from individuals to nation-states. It is not uncommon for disagreements among hackers to evolve into the cyber equivalent of gang wars, wherein rivals destroy each other’s information. uch activity may even escalate from the cyber to the physical world.</p>
<p>When cyber attackers bond over similar political or ethical causes, they<br>
are classified as hactivists. Objects of hactivist attacks may be corporate<br>
or non-for-profits or individuals. Nation-state threats aiming to exploit cyberspace vulnerabilities may target any component of the national infrastructure, including, but not limited to, the operation of industrial control systems, the integrity of banking transactions, or the readiness of military equipment.</p>
<h4 id="cyber-security-policy-issues-concerning-cyber-sabotage">Cyber Security Policy Issues Concerning Cyber Sabotage</h4>
<blockquote>
<p>listed below are few policy issues from textbook fig: 6.3.3</p>
</blockquote>
<ul>
<li>International humanitarian law shall apply to conflict in cyberspace.</li>
<li>Hactivists shall be considered a form of free speech.</li>
<li>Government-classified sensitive information shall not be available to any one individual without the oversight of at least one other.</li>
<li>Nations shall define their critical infrastructure sectors and create mechanisms to coordinate with these sectors to create smarter policies for cyber and industrial control system security.</li>
</ul>
<h3 id="cyber-warfare">Cyber Warfare</h3>
<p>Cyber warfare refers to the use of digital attacks – like computer viruses and hacking – by one country to disrupt the vital computer systems of another, with the aim of creating damage, death and destruction. Future wars will see hackers using computer code to attack an enemy’s infrastructure, fighting alongside troops using conventional weapons like guns and missiles.</p>
<p>Cyber warfare involves the actions by a nation-state or international organization to attack and attempt to damage another nation’s computers or information networks through, for example, computer viruses or denial-of-service attacks.</p>
<h3 id="cyber-terrorism">Cyber Terrorism</h3>
<p>Cyber terrorism is the convergence of cyberspace and terrorism. It refers to unlawful attacks and threats of attacks against computers, networks and the information stored therein when done to intimidate or coerce a government or its people in furtherance of political or social objectives.</p>
<p><a href="http://py563.cf/"><img src="https://i.imgur.com/BJlYOoS.png" alt="Prepared By Prajwal"></a></p>
<h2 id="appendix">Appendix</h2>
<h3 id="ip-address-classes">IP Address Classes</h3>
<p>IP addresses are classified into five categories based on the availability of IP range.</p>
<table>
<thead>
<tr>
<th>IPv4 Address Class</th>
<th>Address range</th>
<th>Supports</th>
</tr>
</thead>
<tbody>
<tr>
<td>Class A</td>
<td>1.0.0.1 to 126.255.255.254</td>
<td>Supports 16 million hosts on each of 127 networks.</td>
</tr>
<tr>
<td>Class B</td>
<td>128.1.0.1 to 191.255.255.254</td>
<td>Supports 65,000 hosts on each of 16,000 networks.</td>
</tr>
<tr>
<td>Class C</td>
<td>192.0.1.1 to 223.255.254.254</td>
<td>Supports 254 hosts on each of 2 million networks</td>
</tr>
<tr>
<td>Class D</td>
<td>224.0.0.0 to 239.255.255.255</td>
<td>Reserved for multicast groups</td>
</tr>
<tr>
<td>Class E</td>
<td>240.0.0.0 to 254.255.255.254</td>
<td>Reserved for future use, or Research and Development Purposes.</td>
</tr>
</tbody>
</table><h3 id="more-resources-on-impersonation-attacks">More Resources on Impersonation Attacks</h3>
<ul>
<li><a href="https://www.egress.com/en-us/resources/cybersecurity-information/phishing/what-is-an-impersonation-attack">What is an impersonation attack? | Phishing | Egress US</a></li>
<li><a href="https://www.cyber.nj.gov/garden_state_cyber_threat_highlight/impersonation-scams">Impersonation Scams | New Jersey Cybersecurity & Communications Integration Cell (nj.gov)</a></li>
</ul>
<h3 id="malware-timeline">Malware Timeline</h3>
<blockquote>
<p>from [source]: Course - INFO43921 :: Malicious Software</p>
</blockquote>
<ul>
<li>[1981–1982] First Reported Computer Viruses: At least three separate viruses, including Elk Cloner, were discovered in games for the Apple II computer system, although the word virus wasn’t applied to this malicious code.</li>
<li>[1986] First PC Virus: The so-called Brain virus infected Microsoft DOS systems.</li>
<li>[1988] Morris Internet Worm: Robert Morris Jr. wrote the “Internet worm” in 1988 at Cornell University
<ul>
<li>Exploited multiple vulnerabilities to spread from machine to machine</li>
<li>Generated huge traffic and completely clogged the Internet</li>
<li>On the positive side: Exposed the vulnerability of the network designed to be resilient against such attacks (including a nuclear strike)</li>
<li>The “Morris Worm” opened the virus and worm flood gate for more deadly viruses and worms: Melissa, CIH Chernobyl, Worm.ExploreZip, BubbleBoy, The Love Bug.</li>
</ul>
</li>
<li>[1990] First Polymorphic Viruses: To evade antivirus systems, these viruses altered their own appearance every time they ran.</li>
<li>[1991] Virus Construction Set (VCS) - This tool hit the bulletin board system community and gave aspiring virus writers a simple toolkit to create their own customized malicious code.</li>
<li>[1994] Good Times Virus Hoax: This virus didn’t infect computers. Instead, it was entirely fictional. However, concern about this virus spread from human to human via word of mouth as frightened people warned others about impending doom from this totally bogus malicious code scam.</li>
<li>[1995] First Macro Viruses implemented in Microsoft Word macro languages, infecting document files.</li>
<li>[1996] Netcat released for UNIX: This tool written by Hobbit remains the most popular backdoor for UNIX systems to this day. Although it has legitimate uses, Netcat is often abused as a backdoor.</li>
<li>[1998] First Java Virus: The <em><strong>StrangeBrew</strong></em> virus infected other Java programs, bringing virus concerns into the realm of Web-based applications.</li>
<li>[1998] Netcat released for Windows: Written by Weld Pond, it is used as popular backdoor on Windows systems.</li>
<li>[1998] Back Orifice: This tool released by Cult of the Dead Cow (cDc), a hacking group, allowed for remote control of Windows systems across the network.</li>
<li>[1999] The Melissa Virus/Worm: Microsoft Word macro virus infected<br>
thousands of computer systems around the globe by spreading through e-mail. It was both a virus and a worm in that it infected a document file, and propagated via the network.</li>
<li>[1999] Back Orifice 2000 (BO2K): Version of Back Orifice for remote control of a Windows system.</li>
<li>[1999] Distributed Denial of Service Agents: The Tribe Flood Network (TFN) and Trin00 denial of service agents. These tools offered an attacker control of dozens, hundreds, or even thousands of machines with an installed zombie via a single client machine. With a centralized point of coordination, these distributed agents could launch a devastating flood or other attack.</li>
<li>[1999] Knark Kernel-Level RootKit: Someone called Creed released this tool built on earlier ideas for kernel manipulation on Linux systems. Knark included a complete toolkit for tweaking the Linux kernel so an attacker could very effectively hide files, processes, and network activity.</li>
<li>[2000] Love Bug: VBScript worm that shut down tens of thousands of systems as it spread via several MS Outlook weaknesses.</li>
<li>[2001] Code Red Worm: This worm spread via a buffer overflow in Microsoft’s IIS Web server product. Over 250,000 machines were infected in less than eight hours.</li>
<li>[2001] Kernel Intrusion System: This tool by Optyx simplified the manipulation of Linux kernels by including GUI and effective hiding mechanisms.</li>
<li>[2001] Nimda Worm: This extremely virulent worm included numerous methods for infecting Windows machines, including Web server buffer overflows, Web browser exploits, Outlook e-mail attacks, and file sharing.</li>
<li>[2002] Setiri Backdoor: Although never formally released, this Trojan horse tool has the ability to bypass personal firewalls, network firewalls, and Network Address Translation devices by co-opting as an invisible browser.</li>
<li>[2003] SQL Slammer Worm: In January 2003, this worm spread rapidly, disabling several Internet service providers in South Korea and briefly causing problems throughout the world</li>
<li>[2003] Hydan Executable Steganography Tool: In February, this tool offered its users the ability to hide data inside of executables using polymorphic coding techniques on Linux, BSD, and Windows executables. These concepts could also be extended for antivirus and intrusion detection system evasion.</li>
<li>[2005] Koobface: Malware that, after infecting a user’s PC, would attack their social media accounts like Facebook, MySpace and Twitter.</li>
<li>[2008] Conflicker: MS Windows targeting worm. Used bruteforce attacks on admin passwords to gain access and add infected nodes to a botnet.</li>
<li>[2010] Stuxnet: A worm targeted at Iran’s nuclear program. Believed to have been created by a large team of developers working for a nation state or group of them. Notable as it infected an air gapped system and only targeted specific types of industrial hardware.</li>
<li>[2007-2011] Zeus Trojan: Notable since the source code was released in 2011, allowing other authors to incorporate it. It has become the backbone of many different botnet malware and banking trojan campaigns.</li>
<li>[2013] Cryptolocker: Probably the first widespread successful example of ransomware.</li>
<li>[2014] Backoff: Malware designed to target Point of Sale systems in retail and other customer-facing scenarios.</li>
<li>[2016] Cerber: A particularly successful breed of ransomware.</li>
<li>[2017] Wannacry: A combination of existing malicious software including the leaked NSA exploit Eternal Blue, modified Zeus code and ransomware payload. This wormable malware spread quickly and managed to infect a significant number of computers including the majority of the UK’s hospital systems.</li>
</ul>
</div>
</div>
</body></html>