AUGUST 2014

June was a tough month for the Information Warfare world.

I am sad to announce that we lost Dr. Dan Kuehl to an aggressive form of cancer. An innovative and early advocate of IW, he was a long-term professor at the National Defense University in Washington, DC, who developed and taught strategic-level Information Operations (IO) classes starting in the late 1990s. In this role, he taught thousands of senior-level officers and officials on the greater role that information can play in military and civil operations and missions. In the process, he coined the acronym DIME for Defense, Information, Military, and Economic when discussing the elements of power, and his moniker was “To Inform is to Influence”. A true believer in the future of IO in the DoD, Dan was always a leader in this realm. His death is a true loss to our community.

ABSTRACT

The possibility of accessing information related to an investigation at any time and from any place is getting increasingly important for security forces, especially the police. Thus, needs arise to store this information in a cloud, to protect these data from unauthorized access, and to allow access to only authorized persons—often only within a limited time period. The conceptual paper at hand describes a technique to store data in a cloud in a secure encrypted manner and grant the access rights adapted to current requirements.

ABSTRACT

Many tools and methods for steganalysis are prevalent in the research field. While no technique is 100% effective, combining multiple techniques is common practice. Techniques reliant on the same basis are often found to be less computationally efficient when used in combination as opposed to the combined use of techniques in separate categories. It is the goal of this paper to present many of the foundational techniques, explore their strengths and weaknesses, categorize the techniques, and present further theories on the combinational effectiveness of techniques within and outside of those categories.

ABSTRACT

This paper demonstrates a novel and complementary approach to exploiting physical-layer differences among wireless devices. This research records packets with standard-length IEEE 802.11b preambles using a software defined radio, manipulates the recorded preambles by shortening their length, then replays the altered packets toward the transceivers under test. Five transceiver types from three manufacturers are distinguishable by analysing differences in packet reception with respect to preamble length with greater than 99% accuracy using a small number of test packets.  The results demonstrate that preamble manipulation is effective for multi-factor device authentication, network intrusion detection, and remote transceiver type fingerprinting.

ABSTRACT

The decentralized architecture of ZigBee ad-hoc networks creates unique security challenges to ensure only authentic devices are granted network access. Non-parametric Random Forest (RndF) and Multi-Class AdaBoost (MCA) ensemble classifiers were introduced with RF-Distinct Native Attribute (RF-DNA) fingerprinting to enhance device authentication performance. Correct classification (%C) performance is improved up to 24% over other classifiers, with 10% improvement at the lowest SNR = 0.0 dB. Network intrusion tests correctly rejected 31/36 rogue devices vs. 25/36 and 28/36 with previously used classifiers. The key benefit of ensemble method processing is improved rogue rejection in noisy environments–gains of up to Gs = 18.0 dB are realized over other classifiers. Collectively considering demonstrated %C and rogue rejection capability, the use of ensemble methods improves ZigBee network authentication and enhances anti-spoofing protection afforded by RF-DNA fingerprinting.

ABSTRACT

The tools typically used in the planning phase of cyber defence provide only limited guidance for operational decision making. To overcome these shortcomings, the authors propose a more comprehensive and deliberate process of intelligence planning: the Intelligence Preparation of the Cyber Environment (IPCE), an adaptation of Intelligence Preparation of the Battlefield. This paper highlights how concepts used in IPB correspond to concepts in cyber security—in particular, the authors describe how ‘weather’ and ‘terrain’ map onto the concepts of ‘user’, ‘traffic’, and ‘network environment’. Finally, the methodology is demonstrated with a case study to illustrate how systems have widely different ‘environmental’ features.

ABSTRACT

The revelation of long-standing espionage operations by state actors against private entities over the past decade speaks to an application of cyber capabilities that shifts the focus from direct and ancillary use in high-intensity confrontations to indirect supply- chain attacks and economic warfare. By observing recent cyber-related events within the oil and gas industries, conclusions can be drawn on emerging patterns of attack and the increasing role of non-state actors in geopolitical conflicts proliferated by the growing weight of information as a means of expressing power. This analysis also presents the opportunity to scrutinize future implications of cyber conflict, with respect to both a current and historical context.

ABSTRACT

Control over most of the world’s data including national security, criminal investigations, medical secrets, intellectual property, and a host of other important rights and responsibilities is governed by a paradigm that is conducted in the Internet ‘cloud’. Based on empirical research and an analysis of international and national legal regimes, case decisions, and forensic case analysis, this paper explores the challenges of reaching into the cloud and the proactive measures that will be necessary to improve legal certainty in the global electronic marketplace. The paper then considers the international and national frameworks necessary for control over the predators in the cloud, and the nature and type of evidentiary and jurisdictional issues that may arise in courts of law and tribunals around the globe.

ABSTRACT

An operational-level cybersecurity strategy formation reveals ways of figuring out an optimal sequence of the most efficient and effective actions that may lead to the success of a cyber operation. Unfortunately, it is not well explored. This paper proposes a new operational-level cybersecurity-strategy-formation framework, which is capable of linking various strategies together in a systematic and consolidated way so that the most optimal and effective solution can be quickly selected. This paper also evaluates the proposed approach and suggests areas for further study.