CERT Centers, Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 SEI is sponsored by the U.S. Department of Defense ©

Slides:

Advertisements

Similar presentations

S3-1 © 2001 Carnegie Mellon University OCTAVE SM Process 3 Identify Staff Knowledge Software Engineering Institute Carnegie Mellon University Pittsburgh,

Advertisements

UNCLASSIFIED Cybercrime: The Australian Experience Australian Cybercrime Online Reporting Network (ACORN) Conference Assistant Commissioner Tim Morris.

Intelligence Analysis Anne Lavery Principal Analyst ACPOS NIM/MoPI Team.

DoD and Cyber-Terrorism Eric Fritch CPSC 620. What is cyber-terrorism? "The premeditated, politically motivated attack against information, computer systems,

© 2003 Carnegie Mellon University slide 1 Building CSIRT Capabilities and the State of the Practice Georgia Killcrece CSIRT Development Team CERT ® Training.

S2-1 © 2001 Carnegie Mellon University OCTAVE SM Process 2 Identify Operational Area Management Knowledge Software Engineering Institute Carnegie Mellon.

Networked Systems Survivability CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA © 2002 Carnegie.

© Carnegie Mellon University The CERT Insider Threat Center.

Cyber Security and the Smart Grid George W. Arnold, Eng.Sc.D. National Institute of Standards and Technology (NIST) U.S. Department of Commerce

CERT Centers, Software Engineering Institute Carnegie Mellon University Pittsburgh, PA SEI is sponsored by the U.S. Department of Defense ©

DHS, National Cyber Security Division Overview

1`1 Hacking and Information Warfare. 2 Overview Information Warriors  Who Are They  What Do They Do Types of Threat PsyOps Civil Affairs Electronic.

Web Defacement Anh Nguyen May 6 th, Organization Introduction How Hackers Deface Web Pages Solutions to Web Defacement Conclusions 2.

1  Carnegie Mellon University System Security and U. Rich Pethia Software Engineering Institute Carnegie Mellon University Pittsburgh, PA

Security Alert: Latest Trends in Global Attacks, Sources and Impact Vince Steckler Vice President, Asia Pacific.

CERT ® System and Network Security Practices Presented by Julia H. Allen at the NCISSE 2001: 5th National Colloquium for Information Systems Security Education,

S5-1 © 2001 Carnegie Mellon University OCTAVE SM Process 5 Identify Key Components Software Engineering Institute Carnegie Mellon University Pittsburgh,

(c) 2006 Carnegie Mellon University95752: Introduction to Information Security Management Tim Shimeall, Ph.D Office.

EECS Presentation Web Tap: Intelligent Intrusion Detection Kevin Borders.

1 Case Study ESTABLISHING NATIONAL CERT By Saleem Al-Balooshi Etisalat - AE.

STATE OF THE PRACTICE OF INTRUSION DETECTION TECHNOLOGIES Presented by Hap Huynh Based on content by SEI.

1 Incident Analysis. 2 Why Incident Analysis? Bad Guys! Threats growing Vulnerabilities Increasing Internet now part of the social fabric Impact of major.

The Survivable Network Analysis Project: Project Introduction Nancy R. Mead CERT/Coordination Center Software Engineering Institute Carnegie Mellon University.

National Institute of Standards and Technology Computer Security Division Information Technology Laboratory Threat Information Sharing; Perspectives, Strategies,

Security Awareness Challenges of Security No single simple solution to protecting computers and securing information Different types of attacks Difficulties.

Protecting Mainframe and Distributed Corporate Data from FTP Attacks: Introducing FTP/Security Suite Alessandro Braccia, DBA Sistemi.

© 2002 Carnegie Mellon UniversityAttackers: 1 Attackers and Defenders.

© 2007 Carnegie Mellon University Secure Coding Initiative Jason A. Rafail Monday, May 14 th, 2007.

Computer Science and Engineering 1 Csilla Farkas Associate Professor Center for Information Assurance Engineering Dept. of Computer Science and Engineering.

© 2001 Carnegie Mellon University S8A-1 OCTAVE SM Process 8 Develop Protection Strategy Workshop A: Protection Strategy Development Software Engineering.

1  Carnegie Mellon University Protecting Information Infrastructures Rich Pethia Software Engineering Institute Carnegie Mellon University Pittsburgh,

Introduction to Computer Ethics

Cyber Security Nevada Businesses Overview June, 2014.

© 2001 by Carnegie Mellon University SS5 -1 OCTAVE SM Process 5 Background on Vulnerability Evaluations Software Engineering Institute Carnegie Mellon.

INTERACTIVE ANALYSIS OF COMPUTER CRIMES PRESENTED FOR CS-689 ON 10/12/2000 BY NAGAKALYANA ESKALA.

Networked Systems Survivability CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA © 2002 Carnegie.

Software Engineering Institute Carnegie Mellon University Pittsburgh, PA Sponsored by the U.S. Department of Defense © 2000 by Carnegie Mellon.

Cyber Insecurity Under Attack Cyber Security Past, present and future Patricia Titus Chief Information Security Officer Unisys Corporation.

Conficker Update John Crain. What is Conficker? An Internet worm  Malicious code that is self-replicating and distributed over a network A blended threat.

Networked Systems Survivability CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA © 2002 Carnegie.

Networked Systems Survivability CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA © 2002 Carnegie.

1 Figure 10-4: Intrusion Detection Systems (IDSs) Actions  Alarms  Interactive analysis Manual event inspection of raw log file Pattern retrieval 

CERT Centers, Software Engineering Institute Carnegie Mellon University Pittsburgh, PA SEI is sponsored by the U.S. Department of Defense ©

TLP:Green FIRST/TF-CSIRT Technical Colloquium January 25 th – 27 th, 2016 Prague, CZ TLP:Green.

STRATEGIC INTELLIGENCE MANAGEMENT Chapter by Hamid Jahankhani Chapter 21 - Developing a Model to Reduce and/or Prevent Cybercrime Victimization among the.

By, CA K RAGHU, PAST PRESIDENT – INSTITUTE OF CHARTERED ACCOUNTANTS OF INDIA.

Cyber Security – Anatomy of a Hack

BY: AUSTIN NEIGH. WHAT IS CYBER WARFARE? Hacking that is politically motivated to conduct sabotage or espionage Form of information warfare Typically.

1  Carnegie Mellon University Overview of the CERT/CC and the Survivable Systems Initiative Andrew P. Moore CERT Coordination Center.

1. Definition : Malicious code refers to a program that is covertly inserted into another program with the intent to Malicious activities. 2.

Prevent - Stopping People Becoming Terrorists or Supporting Terrorism Detective Chief Superintendent Alan Lyon National Coordinator Prevent

S7-1 © 2001 Carnegie Mellon University OCTAVE SM Process 7 Conduct Risk Analysis Software Engineering Institute Carnegie Mellon University Pittsburgh,

Building Global CSIRT Capabilities Barbara Laswell, Ph. D

CYBERSECURITY INCIDENCE IN THE FINANCIAL SERVICES SECTOR March 28, 2017 Presented by Osato Omogiafo Head IT Audit.

Computer Security Incidents

Major Event Response Time Declining

Process Maturity Profile

California Cybersecurity Integration Center (Cal-CSIC)

Secure Coding Initiative

Cyber Security coordination in Europe CERT-EU’s perspective

Metrics-Focused Analysis of Network Flow Data

بهترین راهکار را انتخاب کنید...

Cybersecurity Awareness

11/17/2018 9:32 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN.

Threat Trends and Protection Strategies Barbara Laswell, Ph. D

CRITICAL INFRASTRUCTURE CYBERSECURITY

Computer Security Incidents

Enhanced alerting and collaborative incident management

Intrusion Detection system

AIR-T11 What We’ve Learned Building a Cyber Security Operation Center: du Case Study Tamer El Refaey Senior Director, Security Monitoring and Operations.

Presentation transcript:

CERT Centers, Software Engineering Institute Carnegie Mellon University Pittsburgh, PA SEI is sponsored by the U.S. Department of Defense © 2000 by Carnegie Mellon University Intelligence - page 1 Cyber Intelligence Analysis

© 2000 by Carnegie Mellon University Intelligence - page 2 A Different Internet Armies may cease to march Stock may lose a hundred points Businesses may be bankrupted Individuals may lose their social identity Threats not from novice teenagers, but purposeful military, political, and criminal organizations

© 2000 by Carnegie Mellon University Intelligence - page 3 Purpose of Intelligence 1. Identify the need for action 2. Provide the insight and context for deciding among courses of action 3. Provide information on the effectiveness of pursuing the selected course of action

© 2000 by Carnegie Mellon University Intelligence - page 4 Change of View

© 2000 by Carnegie Mellon University Intelligence - page 5 Content / Context of Intelligence

© 2000 by Carnegie Mellon University Intelligence - page 6 What is Cyber Intelligence? Internet Behavior Intrusions/Responses Threats/Counters Vulnerabilities/Fixes Operators/GroupsVictims Stimuli/Motives Opportunities

© 2000 by Carnegie Mellon University Intelligence - page 7 Strategic Intelligence Analysis Provides “Big Picture” assessment Trend Analysis Sector Threat assessments Potential Damage assessments Categorization of Attacks and Attackers Identification of Anomalies

© 2000 by Carnegie Mellon University Intelligence - page 8 Tactical Intelligence Analysis Linking element between macro- and micro-level analysis Cluster and pattern analysis Temporal patterns Profiling Analysis of intrusion methods Commonality of targets Reinforces and compliments Strategic Analytic efforts

© 2000 by Carnegie Mellon University Intelligence - page 9 Using CERT/CC Data Year ,756 Incidents 16,129 Probes/Scans 2,912 Information Requests 261 Hoaxes, false alarms, vul reports, unknown 2454 Incidents with substantive impact on target Profiled 639 incidents, all active during July-Sept 2000 (profiling work is ongoing) Many different dimensions for analysis and trend generation (analysis work is ongoing)

© 2000 by Carnegie Mellon University Intelligence - page 10 Immediate Data Observations Increasing trend of incidents per month (some incidents carry over between months) Increasing diversity of ports used in incidents Shifts in services used in incidents Shifts in operating systems involved in incidents Generic attack tools adapted to specific targets

© 2000 by Carnegie Mellon University Intelligence - page 11 Service Shifts

© 2000 by Carnegie Mellon University Intelligence - page /2 4 /00 7/1/00 7/8/00 7/15/007/22/00 7/29/00 8/5/00 8/12/00 8/19/00 8/26/00 9/2/00 9/9/00 9/16/00 Weekly Incidents

© 2000 by Carnegie Mellon University Intelligence - page 13 Weekly Incidents by Target

© 2000 by Carnegie Mellon University Intelligence - page 14 Monthly Incidents by Target

© 2000 by Carnegie Mellon University Intelligence - page 15 Weekly Incidents by OS

© 2000 by Carnegie Mellon University Intelligence - page 16 Monthly Incidents by Operating System

© 2000 by Carnegie Mellon University Intelligence - page 17 Weekly Incidents by Impact

© 2000 by Carnegie Mellon University Intelligence - page 18 Monthly Incidents by Impact

© 2000 by Carnegie Mellon University Intelligence - page 19 Drivers for Weekly Incidents /2 4 /00 7/1/00 7/8/00 7/15/007/22/00 7/29/00 8/5/00 8/12/00 8/19/00 8/26/00 9/2/00 9/9/00 9/16/00 Independence Day Labor Day Advisory/ Alert New Toolkits DefCon

© 2000 by Carnegie Mellon University Intelligence - page 20 Operational Intelligence Analysis Overlaps with Tactical Analysis Technical assessments of intrusion methods Specific investigation of intruders Identification of vulnerabilities to support mitigation Attribution

© 2000 by Carnegie Mellon University Intelligence - page 21 Example: Signed Defacement Defaced Health-care web site in India "This site has been hacked by ISI ( Kashmir is ours), we want a hospital in Kashmir" and signed by Mujahideen-ul-dawat. Post-dates activity by Pakistani Hackers Club Level of activity is not significant Claim of identity may be significant

© 2000 by Carnegie Mellon University Intelligence - page 22 Example: Coordinated Automated Attack Probe Victim 2 Identity Victim Compromise & Coopt Probe Remote, fast-acting Adapts existing tools Limited deployment Sophisticated reporters

© 2000 by Carnegie Mellon University Intelligence - page 23 A Problem Too Big Cannot remain technical specialty Cannot remain localized activity Cannot remain responsive to incidents Cannot remain centrally controlled or performed Distributed, ongoing, multifaceted problem demands distributed, ongoing, multifaceted strategy

© 2000 by Carnegie Mellon University Intelligence - page 24 Cyber Intelligence Products Fused analysis reports Demographics and situational awareness In-depth studies Technology of intelligence

© 2000 by Carnegie Mellon University Intelligence - page 25 For Further Contact 24-hour hotline: FAX: Tim Shimeall - CERT - Direct voice: US mail:CERT Analysis Center Software Engineering Institute Carnegie Melon University 4500 Fifth Avenue Pittsburgh, PA USA