In the Great Game, Cyber Security Matters

At the beginning of this blog I discussed the relevance of cyber security to our lives in the 21st century. I talked about information and how all of Cyber Security is concerned with the protection of that information. While I think I did a good job of explaining why that matters to you, what this matters even more too takes place on a scale where winning and losing can mean the difference between life and death. When Cyber Security takes place in the great game played between nations and governments the stakes are high – and that is where Cyber Security really matters.

In the world of military, politics, and diplomacy information is a currency worth more than gold bullion. Allow me to explain. Sun Tzu described war as the, “art of deception”. There is that quote that says, “Knowledge is power.” Famous contributors to medicine have always warned us, “What you don’t know can kill you.” Do you get the idea?
Information means everything in international affairs. The country with the highest technological, economic, and geographical effectiveness is the country that not only survives for longer than its peers, but at a much higher quality of life as well. While it’s unfortunate we can’t all hold hands and “kumbaya” together, the consequences of being behind in this competition for scarce resources has a huge impact on every single person living within society and therefore information becomes premium! Imagine if the poorest country in the world had access to the same technological concepts as the richest country in the world? Obviously, it’s not as simple as this but that information could have a huge impact on that poor country.

As you can begin to see and understand how valuable this information is. Every day, that information is a target for someone else! The U.S and her allies rely, as well as every other country in the world, relies on keeping the information that benefits them secret from their enemies. Politicians every day are the targets of hackers and malicious intruders. Even your personal information can be used, not only against you, but against the country itself. Imagine if the banking systems across the United States were reduced to in person, cash only transactions? U.S diplomacy would grind to a halt as the country scrambled to get its economy and her people back on their feet again.

Cyber Security is an incredibly important subset in world affairs whether you can see it or not. As information is passed along, bought, traded, bribed, coerced, stolen, and manipulated in ways to benefit some and not for others the price of failing to secure this information can be drastic.

Are Users as Smart as their Smart Phones?

In the 21st century you can see smart phones everywhere around you. As cliché s it is, hackers see this too. But where you or I might see nothing but your friends ignoring you to check Facebook or Clash of Clans a hacker sees nothing but more opportunities to strike. Think about the sensitive information you have stored on your phone! Are you, and is everyone else around you on their phone, protecting that data correctly? In 2012, a group of researchers from the University of South Australia proceeded to ask and attempt to answer this question.

The Research
The researchers acquired a sample of 250 mobile users of varying ages and backgrounds. They proceeded to survey the participants in, what they deemed, the five major areas of mobile security. This includes general security (such as theft), security against malware, unauthorized access, Wi-Fi and Bluetooth security, and handling phishing attacks as well. While the most common uses for smart phones among the participants were SMS and phone calls, it is interesting to note that banking and purchasing applications was also very popular. Obviously social media and general internet browsing were on the third and fourth most popular items, the research identified that it was mainly the younger participants were the ones that heavily used their mobile devices for these two purposes.

The Results
Not too shockingly, the research found that a majority of their participants exhibited unsafe behaviors in their smart phone usage. In the study, more than half the participants failed to use any type of locking mechanism for their phone and when they did, they utilized a four digit pin only, which is, in reality, extremely vulnerable to brute force hacking techniques. While most participants were disciplined in not installing apps or accepting downloads from unauthorized sources, only 16 percent of participants actively used malware detection or removal apps. Only a small percentage of users exhibited poor behavior in responding to phishing attacks and when it came to Wi-fi security only 16 percent of users admitted to connecting to unknown Wi-fi networks. Not too surprisingly, the study confirmed that participants who exhibited risky behavior in one aspect were more likely to exhibit risky behavior in other areas.

What It Means
In their own conclusion, the researchers mention the routine activity theory (RAT) and its proposal about victim suitability. RAT proposes that one of the main factors in criminal activity is that crime occurs when “a suitable target is in the presence of a motivated offender and without a capable guardian” (J. Imgraben et al). The key here is that smart phone users need to limit their exposure to “motivated offenders” by reducing the opportunity for them to become a “suitable target”. Enabling user authentication, more so than just a simple 4-digit pin, can greatly reduce criminal motivation, even if your phone is lost or stolen. The researchers indicated that certain apps can reduce criminal acts by increasing the likelihood of getting caught and reducing the rewards of offending. Installing anti-malware applications, remote wiping apps, or even a simple locating app in the event of a lost or stolen phone are key ways of doing both of the above. The researchers concluded that many users are simply unaware of the risks they are taking in their behaviors. They even concluded that there is a suitable market creating incentives for smart device usage and technology that limits risk and/or crime.



James Imgraben, Alewyn Engelbrecht & Kim-Kwang Raymond Choo (2014) Always connected, but are smart mobile users getting more security savvy? A survey of smart mobile device users, Behaviour & Information Technology, 33:12, 1347-1360, DOI: 10.1080/0144929X.2014.934286

The First Computer Worm

In the world of Cyber Security it is difficult to track down just one name worthy of mention. Looking back over the short history of the Internet, it seems that groups of researchers or even whole institutions contributed to different pieces of cyber security as a whole as opposed to one single person. But, that's a boring answer, so I introduce to you the person who created the first computer worm.

Robert Morris.

Robert Morris, for all intents and purposes, was just your average geek. I mean come on, you didn't really come to this blog post expecting anything less did you? However, unlike most nerds and geeks you'll find these days, Morris was born to an arguably even nerdier and geekier father! Robert Morris Sr. was a computer scientist who helped create the famous Unix operating system and eventually become to work as the head of the National Computer Security Center, the NSA's chief department on all things computer security. The senior Morris was no joke himself.

Robert Morris Jr., his blood flowing with the same DNA of his clearly intelligent father, set out on a path to make his own mark on the Internet in a completely different way. As a graduate student at Cornell University, Morris decided he wanted to gauge the size of the Internet by building a program that would bounce from computer to computer. Thus, Robert Morris created the first ever computer worm. This worm, designed initially to be harmless and simply tell him how many computers there existed on a current network, ended up becoming a destructive virus. The worm would copy itself so many times on one computer it would become unstable and no longer work. It would then travel to another computer, and so and so forth until virtually the entire Internet had crawled to a halt. Although people warnings about the worm were published, they never made it through the backed up Internet traffic casued by the worm. Even after Morris had engineered a solution realizing the mistake he made, he had no way to get it distributed. Morris wound up in court a few months later and found himself on three years of probation with 400 hours of community service to serve. Not bad for accidentally taking down the Internet..

The “Morris Worm”, as it effectively became know, took advantage of several known vulnerabilities in the Unix operating system (I bet you his dad was real happy his son was breaking his stuff!) and even weak password vulnerabilities. While not an intentional research study, the importance of this mere accident can't be over stated. The Morris worm brought the term “computer security” into reality at a time when the Internet was young and naive. It made computer scientists and the military and government realize what was at stake with such vulnerable systems.

The Internet was a lot smaller back then and the realities of a single successful attack made organizations realize that Computer Security was no joke. The Internet was lucky it had been Robert Morris who had started that worm as well. If a malicious hacker hellbent on causing trouble had released such a virus the impact could be have been significant. The positive effects this "white hat" hacker ultimately had on the field of Cyber Security was huge. Data security awareness became a practical application rather than an theory, for example. Awareness in general about the risks and problems associated with vulnerable systems eventually snowballed on into the huge field of Cyber Security we see today, and that's all thanks to Robert Morris.

Cyber Attack by the Chinese

Just earlier this month Cyber Security made headlines, as it usually tends to do in this century. Typically, cyber attacks are often news-worthy reports due to the fact that the victims of these attacks are often high-profile organizations whose work is often considered "important" in some sense. Whether the victims are large corporations contributing to our economy or a government intelligence agency contributing to the defense of our country, the nature of cyber attacks often leave these organizations as targets.

What Happened

The National Weather Service recently confirmed that they had been the victim of a cyber attack. The attack occurred in late September but was covered up by NWS and wasn't officially disclosed until recently. The news is reporting that "mission critical" information had been targeted relating to weather-data passed to U.S Air Force systems and even systems that pass information distress signals for search and rescue operations (Johnson, A NBC News). I'm sure you can already begin to see the impact this attack could have. What I'm not sure people understand is why the NWS and it's parent organization, NOAA, would attempt to cover up this attack. Being that the nature of cyber attacks revolves around secrecy and deception, when attacks like this occur the response is usually built around damage control. The NWS is a large organization whose product is heavily relied upon by many consumers, many of whom are among the U.S military and government. The weather on your phone, local news station, and the very systems that guide the Navies aircraft carriers rely on the information provided by the NWS. For this reason, when this attack occurred, the NWS as an organization did their best to minimize the success of the attack by keeping it very hush-hush, which may have helped them out but also limits the response in reacting to the vulnerabilities created from this attack. This is an often misunderstood side of cyber warfare and is crucial to the nature of the business itself. Lack of awareness leads to vulnerabilities and vulnerabilities lead to more attacks.

Why Does this Matter?

This may not be the most pressing news headline that you've heard about this week, let alone this month. The impact, while arguably large, is rare that it will directly affect you to the point of you cursing the Chinese. Instead, this attack highlights an ongoing theme in foreign relations, cyber warfare as the new means of engagement between nation states. As the 21st century has evolved into the information age, so too have governments and societies. Information, that crucial life-blood of society we talked about last time, can be the difference between economic superiority or political unrest and civil distress. Imagine an extreme case where the internet was shut off entirely, the U.S economy is likely to grind o a halt and critical systems we take for granted everyday would become ineffective. Not to mention the logistics and effectiveness of the U.S military would be rendered near useless. While this information attack on the NWS was not an extreme example, it still serves as an example of the undercurrents in foreign affairs taking place around us everyday. The U.S Navy is one of the largest diplomatic tools the U.S has to effect political pressure on China, and a successful attack on the systems that this Navy relies on would be a big success for the Chinese. This is only on of the many known cyber attacks by the Chinese and probably one of even more unknown attacks that have been successful. Cine has often used cyber warfare to leverage their own interests and is likely to continue doing so in the future. If you're not getting it by now, Cyber Warfare is here, and here to stay.

What is Cyber Security and Does it even Matter?

Cyber security. Cyber space. Cyber warfare. Cyber threats. Cyber attacks.

I'm sure some of those words sound familiar. In fact, unless you've been living under a rock for the entirety of the last decade I'm willing to bet you probably have heard of a Cyber-something at some point or another. I probably wouldn't be willing to spend my money any further than that however.

To be completely honest, unless you're a big fan of Revenge of the Nerds, most topics that delve deep into the technical aspects of computers probably confuse or bore you to death and I don't blame you. But if we're being serious, this stuff matters. In the world we live in, where technology is infused into your daily life and the activities you take for granted rely on their connectivity to the Internet, it matters a lot. Sometimes, even the biggest ROTN fans don't actually know anything about the topic of cyber security except what they'll be tested on in their senior-level college security class. Over the course of this blog, my aim is to bring up fresh and interesting topics in cyber security and present them to you in a meaningful way.

I will say, I'm not here to be a fear monger and warn you of impeding cyber doom that will lead to World War III, because, really, that type of talk is irrational. I really don't want to give you a lecture on password writing because that's boring, but that stuff is good to know and I will if I have too. What I really want to do is open up the discussion about cyber security and how it relates to our current, ever changing world. Whether you're a victim of nerd persecution or not, my hope is you'll learn something following this blog. 
So what does cyber security really mean? What cyber-anything really is about is information. That's all anything related to computers and the Internet ever is. To put it very simply, your Facebook application on your phone is just relaying public data to you in a user friendly, socially interactive way. The debit card you carry in your wallet is simply data that links to a bank account holding your money. The current events taking place in Syria being relayed through twitter, the temperature in your car being adjusted by an internal computer, or the satellites sending your local news channel weather updates is all information being processed, communicated, and acted on in different ways.

That information, information that is crucial to your daily life, is why cyber security matters. As technology continues to grow year after year, the threat of an attack that can take control of your car or steal all your banking information grows as well. As individual countries and the global economy rely on technology more and more, even foreign policy is directly affected by cyber security.

Imagine what you could do if you could control this information. This is what a cyber attack is doing. The impact cyber attacks can have, and therefore the impact of security as well, is wide and broad and encompasses many fields and industries. I put a few links through this post in the hopes of instigating discussion. If you chose to comment on this blog post, I want to hear what you think. Are you scared? Do you really even care? Are you a self-proclaimed expert or computer illiterate? What do you really know about cyber security? Take a look at this flipboard and see for yourself how many headlines there are about cyber security.