Note: This is an historic document. We are no longer maintaining the content, but it may have value for research purposes. Pages linked to from the document may no longer be available.
Testimony to the
September 30, 1999
1. Introduction
The CERT® Coordination Center (CERT/CC) is part of the Survivable Systems Initiative of the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University. The CERT/CC was established nearly eleven years ago, after an Internet "worm" stopped 10% of the computers connected to the Internet. This program—the first Internet security incident to make headline news—was the wake-up call for network security. In response, the CERT/CC was established at the SEI. Its charter was to work with the Internet community to respond to computer security events, raise awareness of computer security issues, and prevent security breaches. While continuing to respond to incidents, the CERT /CC provides training, investigates tools and techniques that enable typical users and administrators to effectively protect systems from damage caused by intruders, conducts research leading to increased security of the Internet, and serves as a model to others establishing incident response teams. The CERT/CC is now recognized by both government and industry as a neutral, authoritative source of information assurance information and expertise.
In the first full year of operation, 1989, The CERT/CC responded to 132 computer security incidents. In the first half of 1999 alone, the staff has already responded to 4,400 incidents. In total, the CERT/CC staff has handled well over 20,000 incidents and analyzed more than 1,200 computer vulnerabilities. This testimony is based on that first-hand experience.
Electronic Commerce
Doing business over the Internet is quick, easy, and inexpensive—compelling reasons for companies to turn to electronic commerce. As of April this year, an estimated 23 million shoppers are online in the United States. Last year, they spent more than $6 billion. An additional $15.6 billion was exchanged in business-to-business transactions. Those figures are expected to rise significantly every year for the foreseeable future, with much of the growth coming from the continued expansion of the Internet. An additional 13 million hosts connected to the Internet between January and July of this year, bringing the estimated total to 56.2 million. As for individual users, the number of adults online in the U.S. has nearly doubled since 1997 (31.3 million in Jan. 1997; 61.5 million in Jan. 1999). Cyber dialogue, a market research firm, reports that 63% of the online population are daily users. This group is behind 87% of all ad clicks, 90% of dollars spent online, and 95% of offline store and mail order sales that begin with online information gathering.
With an e-commerce transaction comes an exchange of information that requires protection from exposure or tampering and the need to stay open for business—protection against network "downtime" and denial-of-service attacks. But the current state of Internet security is cause for concern. Vulnerabilities associated with the Internet put users at risk. Security measures that were appropriate for mainframe computers and small, well-defined networks inside an organization are not effective for the Internet, a complex, dynamic world of interconnected networks with no clear boundaries and no central control. Furthermore, security issues are not well understood and are rarely given high priority by software developers, vendors, network managers, or consumers.
Evidence of the current security situation can be found in the results of several surveys. For example, of 500 organizations contacted for the 1999 CSI/FBI survey, 62% reported computer security breaches within the last year. Of those, 38% reported from 2 to 5 incidents, and 26% reported 10 or more incidents. Those reporting their Internet connection as a frequent point of attack rose for a third straight year, from 37% in1996 to 57% in 1999. Twenty-six percent reported theft of proprietary information (an increase of 8 percent over 1998).
The cost of computer security breaches is rising, too. Financial losses regularly exceed $100 million a year. The top causes are loss of proprietary information ($42.5 million) and financial fraud ($39.7 million). The 1999 CSI/FBI Survey, which provided this information, also found that 96% of the 521 survey respondents have Web sites, and 30% of them provide e-commerce services. Of the Web and e-commerce sites, 20% had detected unauthorized access or misuse of the sites within the last 12 months. Even more worrisome is the fact that 33% answered that they didn’t know if their site had been compromised.
A survey published by Information Security magazine (July 1999) found that companies conducting business online are 57% more likely to suffer leaks of proprietary information than companies that aren’t on the Web. And the rate at which intruders are breaching corporate networks has nearly doubled in the last year. Overall, companies suffered an average loss of $256,000 to security breaches last year. Of the 745 organizations surveyed, 91 quantified their financial losses for a total of $23.3 million.
The White House Office of Science and Technology estimates an annual cost of $100 million for U.S. losses of proprietary information. The American Society for Information Science (ASIS) estimates that the losses may exceed $250 billion. Additional, costly damage can be done by changing price lists, discount rates, or interest rates. Untold costs in loss of business can occur when customers lose faith in a company’s ability to protect information such as credit card numbers, names, addresses, credit information, and the like. Just last month (August 1999) PC Magazine reported on the "real security hot buttons," commenting that "All of the recent online shopping studies confirm that privacy and security are the most important issues to consumers by far. You wouldn’t trust a bank that didn't lock its doors at night; why would you trust a Web site that was similarly open?"
Here are just a few examples of security breaches that have been reported in the press. In addition to these examples, the CERT/CC handles reports of breaches at e-commerce sites daily.
It is obvious from these examples and the ongoing activity of the CERT Coordination Center that there is much work to be done to secure our electronic networks adequately to meet the needs of the expanding e-commerce marketplace.
2. Key Factors in the Current State of Internet Security
The current state of Internet security is the result of many factors. A change in any one of these can change the level of Internet security and survivability.
The next section contains further information about the vulnerabilities of the Internet and thus of the information infrastructure as a whole.
3. Assessment of Internet Vulnerabilities
Because the Internet was not originally designed with security in mind, it is difficult to ensure the integrity, availability, and privacy of information. The Internet was designed to be "open," with distributed control and mutual trust among users. As a result, control is in the hands of users, not in the hands of the provider; and use cannot be administered by a central authority. Finally, the Internet is digital, not physical. It has no geographic location and no well-defined boundaries. Traditional physical "rules" are difficult or impossible to apply. Instead, new knowledge and a new point of view are required to understand the workings and the vulnerabilities of the Internet. Below are examples of recent malicious attacks on the Internet, followed by an examination of why the Internet is so attractive to intruders.
3.1. Attack Strategies Illustrating Internet Vulnerabilities
Some attacks are intended to harass a site and deny it the ability to transact business on the Internet. Other attacks enable intruders to gain privileged access to a system so that it effectively belongs to them. With their unauthorized privileges, they can, for example, use the system as a launch platform for attacks on other sites. Still other attacks are designed to reveal sensitive information, such as passwords or trade secrets. We describe three attack strategies below. Our descriptions are neither theoretical nor abstract; rather, they present, at a high level, actual attacks reported to the CERT Coordination Center regularly1.
SYN Attacks: Denial of Service
A SYN attack is an attack against a computer that provides service to customers over the Internet. SYN refers to the type of message (Synchronize) that is used between computers when a network connection is being made. In this attack, the enemy runs a program from a remote location (anywhere in the world) that jams the service on the victim computer. This is known as a denial-of-service attack because the effect of the attack is to prevent the service-providing computer from providing the service. The attack might prevent one site from being able to exchange data with other sites or prevent the site from using the Internet at all. Increasingly, companies are depending on Internet services for day-to-day business, from email to advertising to online product delivery. Some companies’ business is entirely dependent on the Internet.
SYN attacks have been used successfully against a wide variety of targets, but they have the greatest impact against the companies that do business on the Internet. These Internet service providers, or ISPs, provide Internet connection services to government, businesses, and individuals. A SYN attack against an ISP usually results in disruption of Internet service to all the service provider’s customers.
This type of attack is very difficult to prevent because it exploits a design flaw in the basic technology used for Internet communication today. Experts are currently working on techniques to reduce the problem somewhat, but preventing these attacks from occurring in the future will require a change in the way Internet communications are accomplished by the computers using the Internet. This is likely to take several years.
IP Spoofing: Masquerading
In an attack known as IP spoofing, attackers run a software tool that creates Internet messages that appear to come, not from the intruder’s actual location, but from a computer trusted by the victim. IP, which stands for Internet Protocol, refers to the unique address of a computer. When two computers trust each other, they allow access to sensitive information that is not generally available to other computer systems. The attacker takes advantage of this trust by masquerading as the trusted computer to gain access to sensitive areas or take control of the victim computer by running "privileged" programs. Information that has been compromised through IP spoofing includes credit card information from a major Internet service provider and exploitation scripts that a legitimate user had on hand for a security analysis.
Unfortunately, there are many computer programs and services that rely on other computers to "speak the truth" about their address and have no other mechanism for disallowing access to sensitive information and programs. The CERT Coordination Center has received many reports of attacks in which intruders (even novice intruders) used this technique to gain access to computer systems with the help of publicly available IP spoofing computer programs.
Sniffers: Violating Privacy and Confidentiality
For most users of computer networks, including the Internet, the expectation is that once a message is sent to another computer or address, it will be protected in much the same way letters are protected in the U.S. Postal Service. Unfortunately, this is not the case on the Internet today. The messages are treated more like postcards sent by a very fast, efficient pony express. Information (such as electronic mail, requests for connections to other systems, and other data) is sent from one computer to another in a form easily readable by anyone connected to a part of the network joining the two systems together. For Internet data, these messages are routed through the networks at many locations, any one of which could choose to read and store the data as it goes by. The CERT/CC has handled many incidents in which an intruder ran a program known as a sniffer at a junction point of the Internet.
The sniffer program records many kinds of information for later retrieval by the intruder. Of specific interest to most intruders is the user name and password information used in requests to connect to remote computers. With this information, an intruder can attack a computer on the Internet using the name and password of an unsuspecting Internet user. Intruders have captured hundreds of thousands of these user name/password combinations from major companies, governments sites, and universities all over the world.
To prevent attacks of this type, encryption technology must be used for both the access to other computers around the Internet (cryptographic authentication) and the transmission of data across the Internet (data encryption).
3.2. Attractiveness of the Internet to Intruders and Attackers
Compared with other critical infrastructures, the Internet seems to be a virtual breeding ground for attackers. Although some attacks seem playful (for example, students experimenting with the capability of the network) and some are clearly malicious, all have the potential of doing damage. Unfortunately, Internet attacks in general, and denial-of-service attacks in particular, remain easy to accomplish, hard to trace, and a low risk to the attacker.
Internet Attacks Are Easy
Internet users place unwarranted trust in the network. It is common for sites to be unaware of the amount of trust they actually place in the infrastructure of the Internet and its protocols. Unfortunately, the Internet was originally designed for robustness from attacks or events that were external to the Internet infrastructure, that is, physical attacks against the underlying physical wires and computers that make up the system. The Internet was not designed to withstand internal attacks—attacks by people who are part of the network; and now that the Internet has grown to encompass so many sites, millions of users are effectively inside.
The Internet is primarily based on protocols (rules and conventions) for sharing electronically stored information, and a break-in is not physical as it would be in the case of a power plant, for example. It is one thing to be able to break into a power plant, cause some damage, then escape. But if a power plant were like the Internet, intruders would be able to stay inside the plant undetected for weeks. They would come out at night to wander through the plant, dodging a few guards and browsing through offices for sensitive information. They would hitch a ride on the plant’s vehicles to gain access to other plants, cloning themselves if they wished to be in both places at once.
Internet attacks are easy in other ways. It is true that some attacks require technical knowledge—the equivalent to that of a college graduate who majored in computer science—but many successful attacks are carried out by technically unsophisticated intruders. Technically competent intruders duplicate and share their programs and information at little cost, thus enabling naive "wanna-be" intruders to do the same damage as the experts.
In addition to being easy and cheap, Internet attacks can be quick. In as little as 45 seconds, intruders can
Internet Attacks Are Difficult to Trace
As discussed in the IP spoofing example, attackers can lie about their identity and location on the network. Information on the Internet is transmitted in packets, each containing information about the origin and destination. Again, a packet can be compared to a postcard—senders provide their return address, but they can lie about it. Most of the Internet is designed merely to forward packets one step closer to their destination with no attempt to make a record of their source. There is not even a "postmark" to indicate generally where a packet originated. It requires close cooperation among sites and up-to-date equipment to trace malicious packets during an attack.
Moreover, the Internet is designed to allow packets to flow easily across geographical, administrative, and political boundaries. Consequently, cooperation in tracing a single attack may involve multiple organizations and jurisdictions, most of which are not directly affected by the attack and may have little incentive to invest time and resources in the effort.
This means that it is easy for an adversary to use a foreign site to launch attacks at U.S. systems. The attacker enjoys the added safety of the need for international cooperation in order to trace the attack, compounded by impediments to legal investigations. We have seen U.S.-based attacks on U.S. sites gain this safety by first breaking into one or more non-U.S. sites before coming back to attack the desired target in the U.S.
Internet Attacks Are Low Risk
Failed attempts to break into physical infrastructures involve a number of federal offenses; such events have a long history of successful prosecutions. This is not the case for Internet intrusions. Because attacks against the Internet typically do not require the attacker to be physically present at the site of the attack, the risk of being identified is reduced. In addition, it is not always clear when certain events should be cause for alarm. For example, what appear to be probes and unsuccessful attacks may actually be the legitimate activity of network managers checking the security of their systems. Even in cases where organizations monitor their systems for illegitimate activity, which occurs in only a small minority of Internet-connected sites, real break-ins often go undetected because it is difficult to identify illegitimate activity. Finally, because intruders cross multiple geographical and legal domains, an additional cloud is thrown over the legal issues involved in pursuing and prosecuting them.
3.3. A Note About Loss of Confidence in the Internet
As described earlier, the Internet was designed to survive the disruption of its transport mechanism; but once data was somehow successfully delivered, users believed it to be legitimate. The "internal" attacks now possible enable an intruder to modify programs and configuration files in subtle ways so that they still appear to work. The programs may even appear to be unmodified but will fail under circumstances specified by the intruder. After a successful computer system intrusion, it can be very difficult or impossible to determine precisely what subtle damage, if any, was left by the intruder.
Loss of confidence can result even if an intruder leaves no damage because the site cannot prove none was left. With some infrastructures, such as electricity, gas, and emergency services, once an overt denial-of-service attack has been resolved and the service returned, consumers immediately regain trust in the service they receive. But the Internet is highly susceptible to a loss-of-confidence crisis.
Only recently have some vendors begun using a cryptographic technique (checksums) that makes it possible to determine whether files or programs have been modified, and providing features that prevent modification of system files.
In summary, intruders on the Internet continue to prey on the lack of security in many of the products and protocols in use on the Internet today. As the U.S. becomes more dependent on the Internet, the potential impact of a successful Internet-based attack against the U.S. increases.
4. Implications for Public Policy
Pennsylvania has been successful in attracting high-technology businesses. It is now in a position to leverage the investment it has already made in high tech to take advantage of the explosive growth in electronic commerce. By launching innovative programs, Pennsylvania has opportunity to take the national lead in e-commerce development.
When launching these programs, Pennsylvania will need to address issues of public policy, information security, and network survivability (that is, the network must continue to provide essential services even in the face of attack). In this section we examine ways in which the government could address the issues of network survivability and security. The problem is serious and complex, and a combination of approaches must be used to reduce the risks associated with the ever-increasing dependence on the Internet and the possibility of a sustained attack on it.
4.1. Context for Public Policy Decisions
In developing Internet and e-commerce policy, the problems normally associated with setting public policy are complicated by rapidly changing technology, the unpredictability of the future, and the fact that complicated trade-offs are involved. The risk that public policy may have adverse effects is much higher than for more mature areas of technology and commerce, and may arise from any of several sources:
4.2 Specific Recommendations
We offer recommendations for public policy in four areas: reporting and monitoring threats and vulnerabilities, education and security measures for "safe computing," research and development, and use of standards. Each set of recommendations addresses a different aspect of Internet use and security; all help to improve the state of Internet security and ensure that the information infrastructure is strong.
4.2.1. Reporting and Monitoring Threats and Vulnerabilities
The nature of threats to the Internet is changing rapidly and will continue to do so for the foreseeable future. The combination of rapidly changing technology, rapidly expanding use, and the continuously new and often unimagined uses of the Internet creates a volatile situation in which the nature of threats and vulnerabilities is difficult to assess and even more difficult to predict.
To help ensure the survivability of the Internet, and the information infrastructure as a whole, it is essential to continuously monitor and analyze cybersecurity threats and vulnerabilities. Specific ways the government can contribute are listed below.
4.2.2. Education and Security Mechanisms for "Safe Computing"
The population on the Internet has changed drastically in the last few years. The combination of easy access and user-friendly interfaces have drawn users of all ages and from all walks of life. As a result, there are consumers on the Internet who have no more understanding of the technology than they do of the engineering behind other infrastructures. Similarly, many system administrators lack adequate knowledge about the network and about security, even while the Internet is becoming increasingly complex and dynamic.
To encourage "safe computing," there are steps we believe the government could take:
In particular, support programs that provide early training in security practices and appropriate use. This training should be integrated into general education about computing. Children should learn early about acceptable and unacceptable behavior when they begin using computers just as they are taught about acceptable and unacceptable behavior when they begin using libraries2. Although this recommendation is aimed at elementary and secondary school teachers, they themselves need to be educated by security experts and professional organizations. Parents need be educated as well and should reinforce lessons in security and behavior on computer networks.
Furthermore, the increasing need for such roles in organizations of many sizes and descriptions has led to assigning information security responsibilities to inexperienced personnel with little or no training. In the short term, the greatest need is for short "how to" and "what to be aware of" courses. In the long term, there should be undergraduate-level or master’s-level specialties in network and information security.
The mechanisms can be imposed at either the client or server side to limit who gains access to particular information. Security mechanisms can be highly selective and require mutual agreement between the parties before information can be communicated. Security mechanisms have the added advantages that they do not undermine commerce nor intrude on basic freedoms.
4.2.3. Research and Development
It is critical to maintain a long-term view and invest in research toward systems and operational techniques that yield networks capable of surviving attacks while protecting sensitive data. In doing so, it is essential to seek fundamental technological solutions and to seek proactive, preventive approaches, not just reactive, curative approaches. Specific suggestions are listed below.
4.2.4. Use of Standards
Successful generally accepted system security principles would establish a set of expectations about and requirements for good practice that would be well understood by system developers and security professionals, accepted by government, and recognized by managers and the public as protecting organizational and individual interests against security breaches and lapses in the protection of privacy. — Computers At Risk3
The Computers at Risk report in 1990 underscored the need for the creation of generally accepted system security principles, to guide system developers and users in deploying systems with some reasonable assurance of safety. Although some principles are now available, none is appropriate for widespread, practical use. Thus, the deployment of systems into the consumer, business, and safety-critical markets continues unabated, while users’ ability to compare one system’s security against another or against a minimum standard has shown little, if any, improvement. The need remains for a set of minimum security standards for Internet products.
In many security incidents, the CERT Coordination Center staff sees the same problems repeated:
The current situation is not encouraging. Consumers lack awareness and knowledge of technical security issues, and as more homes and businesses acquire computer systems, the median security knowledge naturally decreases. Without concrete guidelines that they can understand, average consumers cannot and do not demand any specific level of security when making purchases.
As a result, vendors do not feel market pressure to provide increased security. Consumers show more concern that systems are easily connected to their existing network and accessible than that they are safe from intruders. The available market choices are thus in the area of price, performance, and ease-of-use features. Consumers, in response, evaluate systems based on these features and work to gain knowledge and expertise in these areas instead of investigating security issues.
In the long term, consumer education is the best means to cause market forces to address this situation. In the short term, generally accepted standards can jump-start the process. These standards should address areas such as the following:
The government can take the following steps to encourage the use of minimum security standards:
5. Conclusion
The Internet has proven to be an engine that is driving a revolution in the way individuals and organizations conduct business. Internet-based electronic commerce is growing rapidly and promises to open markets for Pennsylvania businesses that would be difficult for them to penetrate using any other means. Capitalizing on this opportunity, however, brings a new set of risks—risks that must be effectively managed to allow consumers to have confidence in dealing with Pennsylvania’s cyber-merchants. Cybersecurity efforts focused on reporting and monitoring threats and vulnerabilities, education and security measures for "safe computing," research and development, and use of standards are needed to allow Pennsylvania to take its place as a leader in the new world of electronic commerce.
© 1999 Carnegie Mellon University
CERT and CERT Coordination Center are registered in the U.S. Patent and Trademark Office.