Joint Meeting of the
Los Angeles Chapters of ACM,
and IEEE Computer Society

Wednesday, March 6, 2002

Trends in Information Security

Presented by Roberta Gotfried,
Raytheon Company

The field of computer security began over 20 years ago in the form of a highly formal discipline aimed at protecting confidentiality of government classified information as the use of computers grew. Since that time, computer security has evolved as an engineering discipline through a series of incarnations, each one addressing a new set of objectives and new sets of threats - all the time trying to keep up with the rapidly changing world of computing and information systems. Now, privacy and cyber terrorism have taken a pre-eminent place in the field, with much wider public awareness.
This talk will review the evolution of the field of information security, look at recent trends in information security and look at what might lie ahead.

Ms. Roberta Gotfried is currently Director of Information Assurance Programs for Raytheon Electronic Systems and Chair of the Raytheon-wide Information Security and Information Management TIG. She has over 20 years of experience leading research and development of technology programs in software systems. She has lead research and development activities in information security for real-time systems for the last 10 years. She was a Principal Investigator and the lead system security engineer for numerous technology programs, including the DARPA-funded PROSE development for high performance computers and the Information Assurance Reliability Model program and is Program Manager for several research programs in embedded systems information technology. She was also Principal Investigator on the Secure Avionics Architecture Concept Development Program, to define the system security requirements for the Joint Strike Fighter.

She started out with the question "What is information assurance?". It is like the blind men and the elephant; it depends on your previous experience. You may think of it as encryption, multilevel security, intrusion detection or system integrity and they are all part of the "information assurance" elephant. Information assurance is concerned with confidentiality (preventing disclosure), integrity (preventing unwanted modifications), availability of system resources, authentication and non-repudiation (providing accountability and traceability). In the early the idea was to build a fortress around your computer to prevent undesired access, but this was not practical when interactive computing and the Internet became necessary. The network and software vulnerabilities are all too real. Now everyone is becoming concerned with security, as hacker activities are all too real and increasing in frequency. We can look forward to emerging threats of cyber warfare by nations and political groups.

Attack information is readily available on the web including code that can be used for attacks. There are hacker conferences that allow everyone to share the techniques and tools of how to do things. The attackers have a wide range of motivations for attacks. Some are "script kiddies" who look for on-line information, but don't have much real knowledge. Others are skilled coders and hackers with considerable talent. Criminal motivations are on the increase, and politically motivated attacks from nation-states and terrorist groups are expected. So far few terrorist groups have made cyber attacks although they do use the Internet to organize and communicate. Attacks from terrorist sympathizers and people who are anti-capitalist have been more common. It is easy to disguise the origin of attacks. Any conflict will attract thrill seekers without many skills who are not big threats but can cause economic loss. There are numerous world conflicts where sympathizers on both sides try to disrupt the other side and spread propaganda such as Pakistan/India, Israel/Palestine, former Yugoslavia/NATO and US/China after the spy plane incident. There were cyber attacks both against the US and the Taliban after September 11, 2001. Some lessons from recent events are that cyber attacks accompany physical attacks; the attacks are increasing in volume, sophistication, and coordination; and cyber attackers are attracted to high value targets.

Trends in cyber attacks were discussed. Buffer overflows are a common method of attack and a lot of popular software is vulnerable to buffer overflows. Viruses and worms are examples of malicious code and Ms. Gotfried presented many examples. Code Red exploited Microsoft IIS buffer overflow vulnerabilities. Code Red was indiscriminate in its probing, but Code Red II improved its probing mechanism and added a "back door" to infected machines so that hackers could enter a machine and gain control of it. Countermeasures to cyberwarfare are to monitor activities, log events, develop an incident management plan, contact authorities and do ingress and egress filtering. Firewalls and routers are becoming more resistant to attacks. One improvement is that people are starting to take security seriously.

Some disturbing facts are that the US is particularly vulnerable to attack because of its dependence on IT and connectivity. As quickly as new products come out, vulnerabilities are discovered and in spite of increased awareness many systems remain vulnerable, sufficient resources are still not spent on system protection, and people don't know what to do in case of intrusion. There are not enough qualified professionals and education about the problem, and market forces don't favor increased robustness of products. You should apply and follow "best practices" for computer and physical security, apply regular software updates, and install worm protection, intrusion detection systems and firewalls. You should expect more frequent and devastating cyber attacks in the future.

For information go to:
www.cert.org (Computer Emergency Response Team/Coordination Center)
www.nipc.gov (National Infrastructure Protection Consortium)
www.sans.org (System Administration, Network and Security Institute)
www.incidents.org
www.cerias.purdue.edu (Center for Education and Research in Information Assurance and Security)
cve.mitre.org
A recommended publication is:
Cyber Attacks During the War on Terrorism, by Michael A. Vatis, Institute for Security Technology Studies at Dartmouth College.

Roberta Gotfried may be contacted at rlgotfried@raytheon.com
This was the seventh meeting of the LA Chapter year. If you weren't there you missed an excellent presentation on a very important topic. Ms. Gotfried's presentation showed that things will be difficult enough if you are prepared for cyber attacks, but might be catastrophic if you are not.

Mike Walsh, LA ACM Secretary