Band 11, Heft 4

The US power grid has been identified by security experts as a prime target for terrorist-based and state-sponsored cyber attacks. In addition to downing the grid, cyber attacks can also destroy and manipulate data systems, obtain sensitive intellectual property and steal trade secrets. Existing research has addressed the technical factors, such as vulnerabilities and poor intrusion detection systems, which lead to cyber attacks. However, it remains silent on the human factors in the cyber attack equation. This study uses a criminological framework, specifically Routine Activities Theory and Rational Choice Perspective to capture intelligent adversaries who plan and execute attacks based on their analysis of target suitability and guardianship efficacy. It uses a two-step methodology to identify adversary-, target-, and guardianship-specific factors that collectively impact decision-making processes. First, a document analysis of existing literature reveals nine factors (PARE RISKS) that influence adversarial decision-making: P revention measures, A ttacks and Alliances, R esults, E ase of Access, R esponse and Recovery, I nterconnectedness and Interdependencies, S ecurity Testing, Assessments and Audits, K nowledge, Skills, Research and Development, and S ystem Weaknesses. Second, surveys and interviews conducted between 2010 and 2012 with various hackers, penetration testers, and power grid representatives helps validate and refine the PARE RISKS framework. This study identifies (i) adversary-specific factors as resources (skills, money, and time), and research (targets and techniques); (ii) target-specific factors as accessibility (electronic and physical) and weaknesses (outdated architecture and inadequate testing/updates); and (iii) guardian-specific factors as prevention (quality of prevention and intrusion detection measures). It argues that altering each of these three elements of Routine Activities Theory can impact adversarial decision-making, which may help reduce the likelihood of power grid cyber attacks.

Practitioners, researchers and policy-makers involved with cyber security often talk about “security hygiene:” ways to encourage users of computer technology to use safe and secure behavior online. But how do we persuade workers to follow simple, fundamental processes to protect themselves and others? These issues are raised by behavioral scientists, to encourage worker, passenger and patient compliance. In this paper, we explore and summarize findings in social psychology about moral values and habit formation, and then integrate them into suggestions for transforming staff security behavior online.

Cloud manufacturing has recently become a hot research topic in the manufacturing industry. One of the key bottlenecks that hinders the development and application of cloud manufacturing is security. As the adoption and use of manufacturing cloud depends on its security mechanism to a large extent, we propose a new resource security method to enhance the security of cloud manufacturing services by providing resources exclusive access to cloud virtual machine and restricting cloud access from unauthorized users. To enable authorized users in the right location, right time and right network to access resources, a GeoAuthentication model that maps geographic location, access time, and subnetwork information into a secret key is proposed. We also propose conflict firewall in manufacturing cloud to separate users with conflict of interest.

Nowadays cyber criminalists’ interest in incorporation of steganography into armory of rogue hackers is on the rise and information hiding techniques are becoming the new black among Black Hats. In this paper we focus on analyzing the efficiency of the recently proposed IP telephony information hiding method called transcoding steganography (TranSteg) that enables hidden communication with a high steganographic bandwidth while retaining good voice quality. Specifically, we focus on analyzing which voice codecs would be the most favourable for TranSteg to minimize the negative influence on voice quality while maximizing the obtained steganographic bandwidth and limiting the risk of detection.

It is often difficult to meaningfully convey concepts like security incident management cycle, information sharing, cooperation, as well as the roles of people, processes and technology in cybersecurity courses. Serious gaming can help solve this problem, since it can provide a more immersive and interactive learning experience than traditional methods. This paper presents a light weight tabletop exercise format that has been successfully used in cybersecurity education to demonstrate these and many other concepts to Master level students in two European universities over the past 5 years. The term light weight is chosen to indicate the low work load and resource requirements for the instructor. The paper provides practical guidance on how to develop and execute such exercises. In addition, it lists observations of concepts and recommended discussion points that have been successfully demonstrated in class using this exercise format.