Доклад на Националния институт за изследвания по сигурността - САЩ

EXECUTIVE CYBER INTELLIGENCE REPORT: JULY 15, 2014

This report was prepared by The Institute for National Security Studies (INSS) and The Cyber Security Forum Initiative (CSFI) to create better cyber situational awareness (Cyber SA) of the nature and scope of threats and hazards to national security worldwide in the domains of cyberspace and open source intelligence. It is provided to Federal, State, Local, Tribal, Territorial and private sector officials to aid in the identification and development of appropriate actions, priorities, and follow-­up measures.

USA

U.S. engaged in talks with China regarding cyber spying activity

Senior U.S. officials, who participated in meetings with the Chinese last week, stated either side did not raise the case of the hacking into the Office of Personnel Management. The Chinese, angered by the indictment in May of five members of the People’s Liberation Army on charges of cyber espionage, refused a request by the Americans to restart a joint cyber working group.

China suspended the work of the group that brought together American and Chinese negotiators to discuss cyber issues and has complained that the National Security Agency documents made public by Edward Snowden showed the United States had used cyber espionage to gain economic advantage.

DOD bolstering cyber security resources within civilian and military networks

The DoD’s cyber-warriors are working to bolster cyber security resources within civilian and military networks of individual countries, which are defined by the Department of Defense as those countries who are particularly more susceptible to cyber-attacks.

Acting Deputy Assistant Secretary of Defense for Cyber Policy, U.S. Army Maj. Gen. John Davis, said several international allied countries faced a “significant impact… [or] existing threats” of active cyber-attacks particularly those in the Pacific, which are at risk of cyber-attacks from China and Russia.

Additionally, General Davis said U.S. allies in the Middle East and Asia-Pacific regions were the primary focus of U.S.-led cyber defense efforts. The U.S. government has claimed those nations are responsible for offensive cyber operations against American allies, as well as attempted intrusions into U.S. networks.

At the same time, DoD officials are working to improve NATO’s ability to respond to attacks against nations within the alliance. They are collaborating in a slew of cyber working groups to determine joint approaches and strategies to defend against attacks. NATO allies created a “Cyber Incident Response Center” meant to act as a reporting and coordination hub for cyber operations in the case of an attack against NATO or its members.

ISRAEL

Operation Protective Edge hits cyber realm

As Operation Edge rages on, hackers have increased their attempts to breach Israel, and while most of the attacks were unsuccessful, some hackers did succeed in their attempts. The IDF blog and spokesman Twitter account was hacked by the Syrian Electronic Army (SEA).

The SEA defaced the blog by posting a message opposing Israel’s alleged crimes against the Palestinians and Syria. On the IDF blog and Twitter, SEA published a fake tweet claiming: “possible nuclear leak in Dimona, after 2 rockets would have hit the nuclear facility in Dimona.”

It was revealed that hackers used an APT (advance persistent threat) attack and phishing mails to get access into the account. Another popular website hacked was the Haaretz website. In response to these cyber-attacks, the Israeli hacker team Israel Elite Force is beginning their own response attack called #OpIsraelRetaliate taking place on July 17.

In an article published on pc.co.il, Professor Yitzhak Ben Yisrael claims that since the start of the Operation there was an increase of 900% in cyber-attacks against Israel. Before the Operation began, there had been 100,000 a day, yet during the Operation the number has risen to over a million.

Operation Protective Edge in cyber industry

The Israeli cyber industry also reacted to the Operation, and a number of applications were created to deal with the situation. One application developed presented a red color system alarm for iPhone, Android, and other chrome browsers that no matter where a person is, he/she will be able to know if there is a siren going off in his/her region or in other places. Another development created was an app for finding a bomb shelter, basement, or shelter within close region.

AFRICA

South Africa’s cyber crime increases

A recent report compiled by McAfee, found cyber-crime is having a significant economic impact on South Africa. The impact is costing the country over R5.8 billion each year – a situation believed to continually be getting worse.

DDoS attacks are seen as a key concern by 66% of South African organizations. This is higher than the global average, which is 58%. It also reveals that while the majority of South African organizations do have a DDoS defense plan in place, only 20% believe they have sufficient resources to counteract such an attack.

Cyber security issues take center stage at 5th Kenya Internet Governance Forum

The 5th annual Kenya Internet Governance Forum held in the beginning of July at Strathmore University forcused on cyber security issues. The theme of the forum was ‘Connecting Counties for Enhanced Multi-Stakeholder Internet Governance.’ The key points raised focused on the emerging legal concerns and challenges relating to cyber security.

According to the Kenya Cyber Security Strategy released in February 2014, criminal organizations and hacktivists from all over the world are – and will continue to be – exploiting ICT vulnerabilities in Kenya as the country matures into an Information Society, adding that the country will face an increasingly evolving cyber threat landscape. Currently, Kenya ranks fifth in terms of hacking globally.

CHINA & APAC
New Australian Center for Cyber Security

A new cyber security center has been launched at the University of New South Wales in Canberra. ACCS brings together the largest group of cyber security researchers in the country and will be located at UNSW Canberra at the Australian Defence Force Academy.

The ACCS intends to be a unique, interdisciplinary cyber security research and teaching center. UNSW Canberra prides itself on bringing together leading edge research with practical real-world applications.

“ACCS is a perfect example of how university research can support the business community and government,” says Rector of UNSW Canberra, Professor Michael Frater. ACCS draws on the skills of some of the best cyber security experts in the country serving as an expert in legal, policy, and technical domains.

“UNSW applies this leadership through research; teaching; and engagement with the government, Defence, and business community,” says Director of ACCS, Professor Jill Slay.

North Korea expanding cyber power

In the last few years, North Korea has expanded its cyber power. Two years ago the cyber war unit of the Korean People’s Army had around 3,000 cyber soldiers and today has about 5,900. The country has doubled its cyber capability. The North Korean cyber unit seems to operate under the control of the General Bureau of Reconnaissance, which includes around 1,200 hackers.

According to the Seoul-based Yonhap News Agency, the country has established new cyber bases in China and other countries. North Korea had already launched several cyber-attacks, including malware and viruses in emails against South Korea, the United States, and Japan. North Korea is copying the Chinese cyber models by recruiting more and more hackers for its army. Despite its old infrastructures, North Korea is a significant cyber actor in the Asian region.

EUROPE

France creating national cyber reserve unit

As part of their national cyber defense program, France has decided to create a specialized national cyber reserve unit. Indeed this new cyber reserve unit will include volunteers of soldiers and analysts, teachers, students undertaking specialized masters in cyber-defense, and students in more general computer training.

The national cyber reserve will provide specific cyber training for managing a cyber crisis. The goal of this unit is to help different agencies in charge of the systems and network security of the country in case of cyber warfare or cyber conflict.

The concept of cyber reserve is not new, in fact the UK and other countries have already experienced it. Since 2009, France has improved its cyber defense systems and recruited more engineers and cyber specialists to protect its cyber borders. Like the UK, France is trying to be one of the most advanced countries in Europe for cyber defense.

Norway financial institutions under cyber-attack by Anonymous

Norway has been under cyber-attacks conducted by Anonymous Norway, which targeted the financial sector. The hacktivists launched a series of attacks against different Norwegian financial institutions, including the Danske Bank, Norges Bank, Sparebank, and famous insurance companies. However, non-financial corporations have also been targeted, such as Telecom Company and three national airlines.

According to the investigation performed by the Evry’s security team, the hackers were located outside of Norway and have exploited a vulnerability in the WordPress platform to achieve these attacks. However, they did not steal private information from users, the investigation reported; this is typical of normal hacktvist who are not interested in stealing information but rather in creating publicity for their social or political cause.

Evry’s security team added, “The scale is not the largest we have seen, but it is the first time it has hit so many central players in the finance sector in Norway.” Norway has great cyber defense capabilities, and its cyber defense force branch was established in 2012, with about 1,500 people located in 60 different locations.

Moreover, Norway has different computer response teams to handle cyber threats. However, beside its national cyber security policy, Norway is still vulnerable to cyber-attacks and needs to improve and strengthen its cyber security to ensure better protection of its critical infrastructure.

NATO approves establishment of military Cyber-Polygon-Base

NATO Defense Forces recently approved the creation of the military Cyber-Polygon-Base in Estonia, which would include the most advanced cyber-laboratory. The major cyber polygon will be deployed in Tallinn, and the preparations have already begun.

The polygon will be established on an already existing base, which was constructed in Estonia in 2012, where NATO Cyber Forces already conducted the “Cyber Coalition” and “Locked Shields” cyber exercises in 2013. It is likely one of main designations of this joint deployment is the protection from possible Russian aggression scenarios.