The Broader Picture Laws Governing Hacking and Other Computer Crimes Consumer Privacy Employee Workplace Monitoring Government Surveillance Cyberwar and Cyberterror Hardening the Internet Against Attack

Figure 12-5: Cyberwar and Cyberterror Threats Attacking the IT infrastructure Using computers to attack the physical infrastructure (electrical power, sewage, etc.) Using the Internet to coordinate attacks

Figure 12-5: Cyberwar and Cyberterror Conducted by governments Direct damage Disrupting command and control Intelligence gathering Propaganda Industrial espionage Integrating cyberwar into war-fighting doctrines

Figure 12-5: Cyberwar and Cyberterror Cyberterrorism By semi-organized or organized groups Psychological focus Indirect economic impacts (for example, losses because of reduced travel after September 11, 2001, terrorist attacks) Goals are publicity and recruitment Indiscriminate damage

Figure 12-5: Cyberwar and Cyberterror Cyberterrorism Hacktivism—politically motivated attacks by unorganized or loosely organized groups Who is a terrorist? Spectrum from activism to full cyberterror

The Broader Picture Laws Governing Hacking and Other Computer Crimes Consumer Privacy Employee Workplace Monitoring Government Surveillance Cyberwar and Cyberterror Hardening the Internet Against Attack

Figure 12-5: Cyberwar and Cyberterror Building a National and International Response Strategy National governments Coordinated responses Intelligence gathering Research and training Economic incentives Private enterprise Importance of hardening individual firms Requiring hardening to meet responsibilities

Figure 12-5: Cyberwar and Cyberterror Hardening the Internet Hardening the telecommunications infrastructure with decentralization and other methods International cooperation is needed because of worldwide attackers Hardening the underlying telecommunications system Adding security to dialogs with VPNs

Figure 12-5: Cyberwar and Cyberterror Hardening the Internet Hardening Internet protocols IETF is making progress by adding confidentiality, authentication, and other protections to core Internet protocols Generally not using digital certificates in a public key infrastructure for strong authentication

Figure 12-5: Cyberwar and Cyberterror Hardening the Internet Making the Internet forensic ISPs might be forced to collect and retain data for long periods of time ISPs might be forced to do egress filtering to stop attacks at the source The cost to ISPs would be high