Cyberwarfare Defense Report For Western Interconnection Power Grid Essay

Per ADP 5-0, to understand something is to grasp its nature and significance. Understanding includes establishing context—the set of circumstances that surround a particular event or situation. ADRP 5-0 states that understanding is fundamental to the commander’s ability to establish a situation’s context. Information collection (to include reconnaissance and surveillance) is indispensable to building and improving the commander’s understanding. ADRP 3-0 states, the intelligence warfighting function is the related tasks and systems that facilitate understanding the enemy, terrain, weather, civil considerations, and other significant aspects of the operations environment

* Perform a vulnerability assessment scan on the targeted IP subnet to discover what the weakest link in the system.

IO seeks to integrate and synchronize information related capabilities with maneuver to target the enemy’s decision-making cycle

Penetration testing is the attempt to identify security weaknesses within the IT infrastructure of an

2. Active Attack: Active attacks are those attacks where the attacker takes malicious action in addition to passively listening to ongoing traffic e.g. attacker might choose to modify packets, inject packets or even disrupt network service. The misbehaving node has to bear some energy costs in order to perform some harmful operation like changing the data. Active attacks cause damage and are malicious which often threaten integrity, availability of the network. These type of attacks can be internal or external [7].

3. The reconnaissance phase can have many different faces, and depending on the goal of the attacker, various tools and applications can be used. Nslookup can be used to look up all the available host on a

using intelligence tactics laid out under the Act to have “...evidence indicating that a target is a

One of the Department of Homeland Security’s (DHS) most important missions is protecting critical infrastructure. Assessing CI vulnerabilities is critical to strengthening their capabilities and ensuring resiliency. Since most of them are privately owned, the Department partners with the private sector in conducting voluntary, non-regulatory vulnerability assessments (“Critical Infrastructure”, 2015). According to Homeland Security (2015), vulnerability assessments are the foundation National Infrastructure Protection Plan (NIPP) which outlines how the government and the private sector work together to manage risks to achieve security and resiliency goals (“Critical Infrastructure”, 2015). Protecting America’s electrical power grid is especially complicated because all of the other CIs depend on the energy sector’s

The week five and six major assignment was one of the most involved assignment which we have done so far in CIS610 – Information Warfare. This assignment required the student to take all of the reading and information which throughout the past six week and create a 2000 word paper which compares and contrast the policies, guidance, and operations of the United States, Russia, and China in their quest for information dominance. I started this assignment by gathering the information sources which I was going to use for the paper. When

The threat kill chain reveals the stages of a cyber attack from early reconnaissance to the goal of information exfiltration. The kill chain can also be used as an organizational tool to help continuously improve network defense (Kill Chain). Threats must progress through seven stages of the model; the first stage is reconnaissance. Reconnaissance occurs when the attacker does a background check on the target before attacking them. Most reconnaissance is accomplished with the help of the Internet and social media accounts. The second stage is the weaponization phase. In this phase, the attacker creates a remote access

The Special Reconnaissance (SR) adopts intelligence gathering and surveillance. This is the gathering and verification of important information about potential plans or intentions of terrorist groups and organized criminals. In addition, other relevant pieces of information such as hydrographic, geographic and meteorological features of a location are utilized in predicting the activities of terrorists.

Intelligence analysis?is the process of taking known information about situations and bodies of strategic, operational, or tactical importance, characterizing the known, and, with appropriate statements of probability, the future actions in those situations and by those entities (Richards, 2010).?The descriptions are drawn from what may only be available in the form of deliberately deceptive information; the?analyst?must correlate the similarities among deceptions and extract a common truth. Although its practice is found in its purest form inside national?intelligence agencies, its methods are also applicable in fields such as business intelligence?or?competitive intelligence.

Cyber warfare attacks can disable official websites and networks, disrupt or disable essential services, steal or alter classified data, and cripple financial systems -- among many other possibilities (definition of cyberwarfare) “.The Tech Target definition includes no reference of nation states. That is because cyber warfare has such a low barrier to entry, a teenager can effectively shut down or damage thousands or millions of dollars of digital infrastructure, something that a real world counterpart would take years to plan, would take weeks, and the only tools needed are a mouse, keyboard, and some type of motivation. Cyber warfare is constantly evolving, constantly becoming more of a threat and is, in fact, being employed right now as this sentence is being read.

There are several different forms of cyber weapons, all of which can be used for either an attack or espionage. There are principally five common practices. The first of three attacks that will be examined is spoofing.

The APT also might have taken advantage of the Passive Reconnaissance techniques to attack its target. By using tools, such as NSLOOKUP, TRACERT and WHOIS database, the APT could have gathered information about the domain names, computer names, IP addresses, DNS resource records, host names, SMTP servers, and Web servers. Once the APT had gathered all the data, it could have used more advance tools like NMAP. Tools such as NMAP allow the use of TCP fingerprinting, which could have led to the discovery of the operating systems that were running on computers at the power plant. The APT could have also used TELNET, FTP and HTTP to gain information about the Web servers, browsers, plugins, etc. With information on operating systems, open vulnerable ports, and the services at its disposal, the APT could have launched a DDoS, buffer overflow exploits, and other attacks against the target.