1. Information Warfare Theory of Information Warfare

2. Reading list This lecture Denning Chapters 2
Denning, D. E. Stuxnet: What Has Changed? Future Internet 2012, 4, (.pdf)
CSCE Farkas

3. Information Warfare: Only intentional attacks + offensive operations
Information Security: “The protection of information against unauthorized disclosure, transfer, modification, or destruction, whether accidental or intentional.” (U.S. federal standards)
Information assurance: Information security + defensive information warfare
Information Warfare: Only intentional attacks + offensive operations
CSCE Farkas

4. Information Dominance
Information Dominance - a condition that results from the use of offensive and defensive information operations to build a comprehensive knowledge advantage at a time, place, and on decision issues critical to mission success – from the IW Site,
CSCE Farkas

5. WIN-LOSE NATURE OF OPERATIONS
Information Warfare
Information resources
Players
Offensive operations
Defensive operations
WIN-LOSE NATURE OF OPERATIONS
CSCE Farkas

6. Way of Thinking S. R. Covey: 7 Habits of Highly Effective People
Habit 4: Think Win-Win
Character-based code for human interaction and competition
Win-lose  zero-sum game, competing for limited resources
Win-win  the ultimate winner?
How are these direction affecting our (cyber) future?
CSCE Farkas

7. Value of Resources Exchange value Operational value
Determined by market value
Quantifiable
Operational value
Determined by the benefits that can be derived from using the resource
May no be quantifiable
May not be the same value for each player (offensive and defensive players)
Actual (before) and potential (after) value
Give examples!
CSCE Farkas

8. Players Offense: motives, means, opportunity Defense: protection
Insiders, hackers, criminals, corporations, government, terrorists
Defense: protection
Federal Bureau of Investigation
U.S., Secret Service
Department of Treasury
Department of Defense
National Institute of Standards and technology
ROLE OF GOVERNMENT
CSCE Farkas

9. Offensive Information Warfare
Target: particular information resources – resources does not need to be owned or managed by the defense
Objective: increase the value of the resource for the offense and decrease it for the defense
Gain: financial, strategic, thrill, etc.
Loss (defense): financial, tactical, strategic, reputation, human loss, etc.
CSCE Farkas

10. Cost of Information Warfare
Monetary expense
Personal time
Risk of getting caught
Punishment
Resources used
Measuring cost of cyber attacks
CSCE Farkas

11. Offense Increase availability of resource
Decrease integrity of resource
Decrease availability of resource for defense
CSCE Farkas

12. Defense Prevent availability of resource for offense Ensure integrity
Ensure availability
CSCE Farkas

13. Offense: Increased availability
Collection of secret:
Espionage (illegal) and intelligence (may be legal)
Piracy
Penetration (hacking)
Superimposition fraud
Identity theft
Perception management
CSCE Farkas

14. Offense: Decrease Availability for Defense
Physical theft
Sabotage
Censorship
CSCE Farkas

15. Offense: Decreased Integrity
Tampering
Penetration
Cover up
Virus, worm, malicious code
Perception management
Fabrication, forgeries, fraud, identity theft, social engineering
CSCE Farkas

16. Defense Prevention: keeps attacks from occurring
Deterrence: makes attack unattractive
Indications and warning: recognize attacks before it occurs
Detection: recognize attacks
Emergency preparedness: capability to recover from and response to attacks
Response: actions taken after the attack
CSCE Farkas

17. Playgrounds to Battlegrounds

18. IW Activities Context of human actions and conflict Domains:
Play: hackers vs. owners
Crime: perpetrators vs. victims
Individual rights: individuals vs. individuals/organizations/government
National security: national level activities
CSCE Farkas

19. Play Playing pranks Actors: hackers/crackers/phreakers
Motivation: challenge, knowledge, thrill
Culture: social/educational
“global networks”
publications
forums
Law
CSCE Farkas

20. Crime Intellectual Property Crimes Fraud Fighting crime
IT targets: research and development, manufacturing and marketing plan, customer list, etc.
Attacker: insiders, formal insiders
1996: Economic Espionage Act (U.S. Congress)
Fraud
Telemarketing scam, identity theft, bank fraud, telecommunication fraud, computer fraud and abuse
Fighting crime
CSCE Farkas

21. Crime Actors: Trade secrets Identity theft Law Employees Temp. staff
Vendors
Suppliers
Consultants
Trade secrets
Identity theft
Law
CSCE Farkas

22. Individual Rights Privacy Free speech Secondary use of information
Harmful/disturbing speech
Theft and distribution of intellectual property
Censorship
CSCE Farkas

23. National Security Foreign Intelligence
Peace time: protecting national interests
Open channels, human spies, electronic surveillance, electronic hacking (?)
War time: support military operations
U.S. Intelligence Priorities:
Intelligence supporting military needs during operation
Intelligence about hostile countries
Intelligence about specific transnational threats
Central Intelligence Agency (CIA)
Primary targets in U.S.A.: high technology and defense-related industry
CSCE Farkas

24. War and Military Conflict
IT support, e.g., sensors, weapons, surveillance, etc.
Psyops and perception management
Physical weapons (?)
Cyber space battle (?)
Unmanned devices (?)
CSCE Farkas

25. Terrorism Traditional: New forms:
Intelligence collection
Psyops and perception management
New forms:
Exploitation of computer technologies
Internet propaganda
Cyber attacks (electronic mail flooding, DOS, etc.)
Protection of national infrastructure
CSCE Farkas

26. Project
CSCE Farkas

27. Sample Projects Title: Mobile application security
Title: Military Open Source Intelligence
Title: Signal Security
Title: Social Networking and Cyber Security
Title: Peer-to-Peer File Sharing and Fair Use
Title: Security for Unmanned Systems
Title: (Semantic) Web Security
Title: Electronic Distribution of Copyrighted Materials via Peer-to-Peer Anonymous Networks
Title: Echelon
Title: Deception Detection Data Origin Authentication
Title: Surveillance System and Legal Evidence
CSCE Farkas