1. Cyber Security Challenges
Dr. Aviel D. Rubin
Johns Hopkins University

2. Anecdote
A tour of the radiology department at UPenn

3. We are dependent on software & computer networks
Banking
Stock market mishap 2 weeks ago
(what would an intentional attack accomplish?)
Critical Infrastructure
Power, water, electric grid
E-commerce
Healthcare
Within an enterprise
HR functions
Customer lists
Secret business plans
E-voting

4. Example: Healthcare Government is forcing move to electronic records
Doctors who don’t comply will be penalized
Standards are being developed to link providers in healthcare information exchanges
Hospitals are increasing their automation
Devices are being networked together
Increasing reliance on software and networks for healthcare & healthcare information

5. Example: E-voting In 2004, 37 states used paperless e-voting
Security vulnerabilities were shown
Dramatic decrease in reliance on e-voting
However, in 2010, many states will allow Internet voting from overseas
Risks…

6. Vulnerabilities Software We don’t know how to avoid bugs
Botnets & Malware, viruses, worms
Usability of security/Human factors
Authentication
State of the art is mostly still passwords
Tokens are catching on – but not user friendly

7. Case in point: Botnets Mariposa botnet What did it do?
In 1 ½ months: over 11 million unique IP addresses of compromised hosts
What did it do?
Information theft: stole usernames/pws, banking details
Downloaded malware for DOS attacks
Found in computers at
More than ½ of Fortune 1,000 companies
More than 40 major banks
Spreads via: IM programs, USB keys, P2P networks, IE6 exploits, many other ways…
Not detected by many Anti-Virus products
Signature evolves

8. Mariposa Population 24 hours of sinkhole data, by origin country
Source: Arbor Networks

9. Global DDoS Traffic DDoS victims, measured traffic
Source: Arbor Networks

10. More threats Cross site request forgery Cross site scripting
DNS spoofing
BGP
Possibly single greatest vulnerability on the Internet

11. Side note Very unusual 3 suspects arrested for use of Mariposa
Not the authors, just unsophisticated users

12. Solutions No silver bullet… Software security tools
Software engineering processes, better programming languages, code audit, red teams
Adding cryptography to DNS and BGP
Long, slow process
Challenges include performance, adoption, legacy infrastructure
User education

13. Questions? Speaker information: Avi Rubin
Professor, Johns Hopkins University