‫לוחמת סייבר – איום הסייבר‬
‫המדינתי‬
‫ד"ר נמרוד קוזלובסקי‪ ,‬עו"ד‬
‫‪.1‬‬
‫‪.2‬‬
‫‪.3‬‬
‫‪.4‬‬
‫‪.5‬‬
‫‪.6‬‬
‫מקרי בוחן להתקפות סייבר‬
‫מודל האיום‬
‫תשתיות קריטיות בהודו כמקרה בוחן‬
‫תפישת סייבר לאומית‬
‫שינוי פרדיגמת אבטחת המידע‬
‫איך צריכה חברה להיערך?‬
‫בהחלט אפשר לשתק מדינה בהתקפה‬
‫דיגיטלית משולבת‬
‫(סגן שר ההגנה האמריקני לשעבר גורדון אינגלנד‪ ,‬מתוך 'גלובס'‪)14/2/2012 ,‬‬
‫‪©All Right Reserved to Altal Security Ltd., 2011.‬‬
Greece
Interception
Georgia
dDoS
Brazil
Critical
Infrastructure
Iran
Stuxnet
COMODO
Certification
Theft
Australia
Hacking
Korea
2005
2007
Estonia
dDoS
2008
2009
China
Ghostnet
2009
2010
China
DNS
Redirection
2010
NSDQ
Interception
2011
GPS
manipulation
RSA
Algorithm
Theaft
©All Right Reserved to Altal Security Ltd., 2011.
Threat Cycles
External
Intrusion Purpose
Internal
Through
Engineering
network
Infrastructure
management
IT
Infrastructure
Information
Focused
damage or
Mass damage
Theft/
Manipulation/
Injection/
Deletion
Enablers
Technology
Human
Fault
Fault
Organization Process-Based
Faulty
Immediate/ Trigger-based
©All Right Reserved to Altal Security Ltd., 2011.
Critical Infrastructure Threats and security model
Security Layers
Vulnerabilities
Vulnerabilities
Application Security
Services Security
Vulnerabilities
Access Control
Authentication
Non-Repudiation
Data Confidentiality
Destruction
Corruption
Communication Security
Removal
Data Integrity
Availability
Privacy
Disclosure
Infrastructure
End-user Plane
Control Plane
Management Plane
Threats
Interruption
Attacks
8 Security Dimensions
©All Right Reserved to Altal Security Ltd., 2011.
Manufacturer
Enemy/
Competitor/
Hostile entity
OEM
Shipment and
Supply
Integrator/
Managed Services
Critical infrastructure
network
State/
Stakeholders /
©All Right Reserved to Altal
Security
Ltd., 2011.
Intrusion
destination
‫ זמינה וזולה‬,‫תקיפות ע"י טכנולוגיה פשוטה‬
Personal computer
intrusion
Remote network
intrusion
External
impersonation
Unintentional
Data Leakage
Data Mining
Network Social
Engineering
Hardware/
Software Burying
Commuter and
Storage Theft
Copy by Internals
©All Right Reserved to Altal Security Ltd., 2011.
Impersonation of legit
activity in all layers
Not necessarily
immediate effect
Not necessarily
Identifiable destruction
Action
Personal
computer
intrusion
Remote
network
intrusion
Computer
and Storage
Theft
Data
Mining
Unintentional
Data Leakage
Network
Social
Engineering
External
impersonation
Copy by
Internals
Purpose
Code Embed/
Manipulation
Hardware Hiding
Monitoring
Mapping and
analysis
Traffic redirection
Re-transmission on
existing
infrastructure
Communication
Re-transmission via
RF
Threat
Destruction
Voice Interception
Data Interception
Future control
Focused Blockings
©All Right Reserved to Altal Security Ltd., 2011.
Closed-Garden Networks
(Military, Gov)
Critical Infrastructure
(Power, Nuclear)
Industrial Open Infrastructure
(Water, Transportation, Telecom)
Interconnectivity
Complexity
Openness
©All Right Reserved to Altal Security Ltd., 2011.
©All Right Reserved to Altal Security Ltd., 2011.
National Level
Threat Analysis
Synchronization
Technology
Development
Efficient
Enforcement
Requires National Involvement
©All Right Reserved to Altal Security Ltd., 2011.
‫הגנה פאסיבית‬
Network security Structure and security
standards are known
Does not consider up-to-date attack
scenarios
National Interest not in
focus
Trusted User
IT oriented security
technologies
Protected Asset
Known (standard)
Infrastructure
Perimeter
Security Structure does not dramatically
change (but upgraded)
©All Right Reserved to Altal Security Ltd., 2011.
Technologies are not tailored to be
compatible with new threat model
©All Right Reserved to Altal Security Ltd., 2011.
Source: Bell, Staying
Source: Book Excerpt: Customer Data Integration and Master Data Management for Global Enterprise,
Information Management
Shared
Inter-sector information
sharing (Private-Public
sharing model)
Distributed sensors
system (connecting the
‘dots’)
Shared monitoring and
analytics of incidents
Pro-Active
Traps/ Honey-pots
Initiate attacks to identify
reaction
Humint in external R&D
arrays
Hiding capabilities in
target systems
Monitor patterns/Profiles
Integrative
Integrated cross- sectors
analysis
One coordinating entity
for all sectors
Integrated incentive
structure for defense
Central incident
response ”brain”
©All Right Reserved to Altal Security Ltd., 2011.
‫התקפות‬
‫מדינה‬
‫התקפות מצד‬
‫גורמי טרור‬
‫התקפות מצד גורמי פשיעה‬
‫(כולל שילוב של גורמים‬
‫פנימיים)‬
‫התקפות מצד קבוצות מאוגדות‬
‫(האקטיביסטים)‬
‫התקפות מצד גורמים חובבניים ‪ /‬קבוצות האקרים‬
‫‪©All Right Reserved to Altal Security Ltd., 2011.‬‬
‫הגדרת‬
‫מדיניות‬
‫הכרת ובחינת‬
‫מדיניות נוכחית‬
‫בדיקת התאמה‬
‫לתקנים ורגולצית‬
‫אבטחת מידע‬
‫קביעת‬
‫רמת סיכון‬
‫הגדרת סיכוני‬
‫אבטחת מידע‬
‫בחינת השפעת‬
‫הסיכונים על‬
‫החברה‬
‫שליטה‬
‫והגנה‬
‫בחינת מערכות‬
‫ניתור‪ ,‬מבדקי‬
‫הקשחה‬
‫הדרכת מנהלים‪,‬‬
‫הצפנה ומידור‬
‫מידע‪ ,‬חסימה‬
‫ומניעת שירותים‬
‫‪©All Right Reserved to Altal Security Ltd., 2011.‬‬
‫סקר כללי‬
‫בחינה כללית של תהליכי העבודה‬
‫בחינת והגדרת האיומים הרלוונטיים‬
‫סקר תהליכים‬
‫ראיונות‪ -‬תהליך עסקי‪/‬טכנולוגי‪/‬אבטחת מידע‬
‫סקירת פונקציונאליות תהליכית‬
‫סקירה ארכיטקטונית וטכנולוגית של פתרונות ‪IT‬‬
‫בדיקות נקודתיות‬
‫בניית תרחישי איום‬
‫סיכום‪ -‬המצאת מסמך‪ ,‬מצגת והצגת ממצאי הסקר‬
‫‪©All Right Reserved to Altal Security Ltd., 2011.‬‬
Information security
organizational structure
Information Assets
Human resources
security
Physical Security
Logical Access Controls
User Management
Securing Procurement
and Test-bed
Security management of
Vendors
Endpoints (Terminals)
management
Servers Management
Databases Management
Application Security
Smartphone Security
Protecting from internet
threats
Telecom Network
Security
Change Management
procedure/ monitoring
Storage & backup
security
Audit & control – LOGS
Management
Securing Lawful
interception
Suggested technologies
Risk Management
Incident handling
Network certification
process
Forensics method
©All Right Reserved to Altal Security Ltd., 2011.
©All Right Reserved to Altal Security Ltd., 2011.