Preface

Acknowledgments

1. Introduction

National Cyber Threats, Vulnerabilities, and Attacks

Botnet Threat

National Cyber Security Methodology Components

Deception

Separation

Diversity

Consistency

Depth

Discretion

Collection

Correlation

Awareness

Response

Implementing the Principles Nationally

Protecting the Critical National Infrastructure Against Cyber Attacks

Summary

Chapter Review Questions/Exercises

2. Deception

Scanning Stage

Deliberately Open Ports

Discovery Stage

Deceptive Documents

Exploitation Stage

Procurement Tricks

Exposing Stage

Interfaces Between Humans and Computers

National Deception Program

The Deception Planning Process Against Cyber Attacks

Summary

Chapter Review Questions/Exercises

3. Separation

What Is Separation?

Functional Separation

National Infrastructure Firewalls

DDOS Filtering

SCADA Separation Architecture

Physical Separation

Insider Separation

Asset Separation

Multilevel Security (MLS)

Protecting the Critical National Infrastructure Through Use of Separation

Summary

Chapter Review Questions/Exercises

4. Diversity

Diversity and Worm Propagation

Desktop Computer System Diversity

Diversity Paradox of Cloud Computing

Network Technology Diversity

Physical Diversity

National Diversity Program

Critical Infrastructure Resilience and Diversity Initiative

Summary

Chapter Review Questions/Exercises

5. Commonality

Meaningful Best Practices for Infrastructure Protection

Locally Relevant and Appropriate Security Policy

Culture of Security Protection

Infrastructure Simplification

Certification and Education

Career Path and Reward Structure

Responsible Past Security Practice

National Commonality Program

How Critical National Infrastructure Systems Demonstrate Commonality

Summary

Chapter Review Questions/Exercises

6. Depth

Effectiveness of Depth

Layered Authentication

Layered E-Mail Virus and Spam Protection

Layered Access Controls

Layered Encryption

Layered Intrusion Detection

National Program of Depth

Practical Ways for Achieving Information Assurance in Infrastructure Networked Environments

Summary

Chapter Review Questions/Exercises

7. Discretion

Trusted Computing Base

Security Through Obscurity

Information Sharing

Information Reconnaissance

Obscurity Layers

Organizational Compartments

National Discretion Program

Top-Down and Bottom-Up Sharing of Sensitive Information

Summary

Chapter Review Questions/Exercises

8. Collection

Collecting Network Data

Collecting System Data

Security Information and Event Management

Large-Scale Trending

Tracking a Worm

National Collection Program

Data Collection Efforts: Systems and Assets

Summary

Chapter Review Questions/Exercises

9. Correlation

Conventional Security Correlation Methods

Quality and Reliability Issues in Data Correlation

Correlating Data to Detect a Worm

Correlating Data to Detect a Botnet

Large-Scale Correlation Process

National Correlation Program

Correlation Rules for Critical National Infrastructure Cyber Security

Summary

Chapter Review Questions/Exercises

10. Awareness

Detecting Infrastructure Attacks

Managing Vulnerability Information

Cyber Security Intelligence Reports

Risk Management Process

Security Operations Centers

National Awareness Program

Connecting Current Cyber Security Operation Centers to Enhance Situational Awareness

Summary

Chapter Review Questions/Exercises

11. Response

Pre- Versus Post-Attack Response

Indications and Warning

Incident Response Teams

Forensic Analysis

Law Enforcement Issues

Disaster Recovery

National Response Program

The Critical National Infrastructure Incident Response Framework

Transitioning from NIPP Steady State to Incident Response Management

Summary

Chapter Review Questions/Exercises

APPENDIX A. National Infrastructure Protection Criteria

Deception Requirements

Separation Requirements

Commonality Requirements

Diversity Requirements

Depth Requirements

Response Requirements

Awareness Requirements

Discretion Requirements

Collection Requirements

Correlation Requirements

APPENDIX B. Case Studies

John R. Vacca

Case Study 1: Cyber Storm

Case Study 2: Cyber Attacks on Critical Infrastructures—A Risk to the Nation

Case Study 3: Department of Homeland Security Battle Insider Threats and Maintain National Cyber Security

Case Study 4: Cyber Security Development Life Cycle

Case Study 5

REVIEW. Answers to Review Questions/Exercises, Hands-On Projects, Case Projects, and Optional Team Case Projects by Chapter

Chapter 1: Introduction

Chapter 2: Deception

Chapter 3: Separation

Chapter 4: Diversity

Chapter 5: Commonality

Chapter 6: Depth

Chapter 7: Discretion

Chapter 8: Collection

Chapter 9: Correlation

Chapter 10: Awareness

Chapter 11: Response

Index