By John Riley
When President Obama appointed The Commission on Cyber Security to advise him on the subject, their report contained an ominous challenge: America’s failure to protect cyber space is one of the most urgent security problems facing the administration. This was no doubt influenced by the testimony of Dennis Blair, Director of National Intelligence, March 10, 2010, who said the intelligence community assessment is that a number of nations already have the capability to conduct crippling attacks against the United States.

In a recent Harvard law school paper, “Cyberlaw: Difficult Issues Winter 2010”, the scope of the problem was discussed. Their conclusion was that cyber security is perceived as an almost insurmountable problem. The group’s approach was to look at the vulnerable points in cyberspace by focusing on the most likely points of attack. They concluded the Internet is vulnerable to attack at several different key points, each with a different result and security concern:
Assessing the Internet’s vulnerability
The Internet is a large decentralized network which complicates its defense. “A clever hacker could shut down the Internet itself in an extreme case, or more conservatively can re-route the Internet to prevent users from getting where they need to go,” concluded the paper.
When a message is sent through the Internet network, there are many different paths it can take. The path it takes is not necessary the shortest path to its’ destination. Usually the path is determined by which avenue has the least traffic (resistance). To disconnect or disrupt traffic, hackers can reconfigure the message address.
Remedies are being explored. If network providers can be notified automatically when the virtual location of an Internet address changes, action can be taken to control the situation. A second approach is to handle broadcasts where changes of addresses can be detected as potential threats until they can be evaluated. That usually takes 24 hours and then they can be accepted as legitimate.
Assessing network endpoints vulnerability
SCADA Systems
Every computer connected to the Internet is an endpoint which makes it vulnerable to attack. Computer systems that oversee industrial computer systems are known as supervisory control and data acquisition systems (SCADA). These are the computer systems that control the power grids, traffic lights, regulate dams and other components of civilian infrastructure. According to John Avlon, Right Side News, November 13, 2009, several al Qaida computers were seized in Pakistan that show details of the SCADA systems in America. Authorities also found one al-Qaida safe house in that was devoted to the operational study of Internet attacks.
Servers
It is not necessary for an attacker to target individual computers. By singling out servers and providers, a terrorist can infect and compromise all computers connected to those servers. That includes internal computers and sensitive servers usually assumed to be shielded from unauthorized penetration by hackers. However, when infection occurs, regulators can step in and shut down the systems to prevent further distribution.
The most common approaches used by hackers are brute force password guessing attacks and web application attacks. If a valid username/password pair can be identified, it will enable the attacker to penetrate Microsoft SQL, FTP, and SSH servers. Microsoft applications have been a major hacker target in recent years.
Computers
One of the most attractive qualities of a computer is its’ ability to create things. However, it is also the computer’s greatest vulnerability. As the paper frames it, the issue becomes, “how do you preserve the generativity, while addressing the growing vulnerabilities that are innate to it?” It is not clear if there is an answer to the question.
Government Computers
In 2009, three incidents occurred that were quietly investigated: data about the Presidential helicopter appeared on Iranian laptops, the federal government’s job listing was taken, and a 19 year-old hacker breached Air Force, Navy, Department of Defense , NASA and MIT systems. This after the Pentagon had spent $100 million to protect its’ systems. As mentioned in the previous article, the problem was highlighted again earlier this year when it was revealed hackers broke into the Pentagon’s $300 million state-of-the-art Joint Strike Fighter program which raised significant military concerns.
The policy vulnerability
The National Security Cyberspace Institute reported March 5, 2010, that a study by the National Research Council, “Technology, Policy, Law and Ethics regarding the U.S. Acquisition and use of Cyberattck Capabilities” revealed the U.S. has no formal policy for dealing with foreign government-led threats against U.S. interests in cyberspace. It cites three key points:
1) The U.S. policy and legal framework for the United States’ use of cyber attacks is “ill-formed, undeveloped, and highly uncertain”.
2) “the decision-making apparatus for cyber attack and the oversight mechanists for that apparatus are inadequate”, and
3) “secrecy has prevented us from being able to effectively share information and debate about the nature and implications of cyber attacks.”
The Cyber Espionage (3 of 5): Threats are Many and Varied, will appear April 3.