Note: This is an historic document. We are no longer maintaining the content, but it may have value for research purposes. Pages linked to from the document may no longer be available.
Report to the President's Commission on Critical Infrastructure Protection
James Ellis, David Fisher, Thomas Longstaff, Linda Pesante, and
Body of Report
At this writing, government, commercial, and educational organizations depend on computers to such an extent that day-to-day operations are significantly hindered when the computers are "down." Currently many of the day-to-day operations depend upon connections to the Internet, and new connections are continuously being made to the Internet. In July 1996, an estimated 12,900,000 computers worldwide were connected to the Internet, compared with 130,000 in 1989 and 1,000,000 in 1992 - just four years ago.1
In the future, government, commerce, schools, and individuals are likely to be as dependent on the Internet as they are on telephone, FAX, and desktop computers today. Accordingly, Internet security and survivability will become increasingly critical to the stability and well-being of the nation.
Use of the Internet enhances the ability of organizations to conduct their activities in a cost-effective and efficient way. However, along with increased capability and dependence comes increased vulnerability. It is easy to exploit the many security holes in the Internet and in the software commonly used in conjunction with it; and it is easy to disguise or hide the true origin and identity of the people doing the exploiting. Moreover, the Internet is easily accessible to anyone with a computer and a network connection. Individuals and organizations worldwide can reach any point on the network without regard to national or geographic boundaries.
Computers have become such an integral part of American business and government that computer-related risks cannot be separated from general business, health, and privacy risks. Valuable government and business assets are now at risk over the Internet. For example, customer and personnel information may be exposed to intruders. Financial data, intellectual property, and strategic plans may be at risk. The widespread use of databases leaves the privacy of individuals at risk. Increased use of computers in safety-critical applications, including the storage and processing of medical records data, increases the chance that accidents or attacks on computer systems can cost people their lives.
Techniques that have worked in the past for securing systems will not be effective in the world of unbounded networks, mobile computing, distributed applications, and dynamic computing that we are beginning to see. In the past, use of the Internet was closely linked to telecommunications, with most Internet access achieved through dial-in ports. Today, that link is less significant; there is rapid movement toward increased use of interconnected networks for a broad range of activities, including commerce, education, entertainment, operation of government, and supporting the delivery of health and other human services. Although this trend promises many benefits, it also poses many risks. In short, interconnections are rapidly increasing, and dial-in access isn't required to exploit vulnerabilities in systems, compromise information, or launch denial-of-service attacks.
There are ways to address the problem of Internet security and survivability. Although no single approach is sufficient, a combination of approaches can reduce the risks associated with our ever-increasing dependence on the Internet and the possibility of a sustained attack on it.
In this report, we refer to both the information infrastructure and the Internet. The information infrastructure is the total collection of digital technology, protocols (rules and conventions), and information on which business, commerce, government, and individuals depend. It includes the "cyber" component of the other critical national infrastructures; but it is also an infrastructure in its own right, with unique characteristics and vulnerabilities. The Internet is the collection of loosely connected networks worldwide that are accessible by individual host computers through a variety of gateways, routers, dial-up connections, Internet access providers, and Internet service providers. The Internet is both an underlying technology and an integral part of the information infrastructure.
In the next section, we describe key factors that contribute to the current state of Internet security. Section 3 provides an assessment of Internet vulnerabilities, along with reasons the Internet is attractive to attackers. In Section 4 we give examples of several ways in which critical national infrastructures depend on the Internet now and will depend on it in the future, and predict the impact a sustained attack on the Internet would have on those infrastructures. Finally, in Section 5 we offer recommendations for improving the security and survivability of the Internet, thus improving the nation's ability to protect its critical infrastructures.
2. Key Factors in the Current State of Internet Security
The current state of Internet security is the result of many factors. In this section, we discuss the key contributing factors. A change in any one of these can change the level of Internet security and survivability.
The next section contains further information about the vulnerabilities of the Internet and thus of the information infrastructure as a whole.
3. Assessment of Internet Vulnerabilities
Because the Internet was not originally designed with security in mind, it is difficult to ensure the integrity, availability, and privacy of information. The Internet was designed to be "open," with distributed control and mutual trust among users. As a result, control is in the hands of users, not in the hands of the provider; and use cannot be administered by a central authority. Finally, the Internet is digital, not physical. It has no geographic location and no well-defined boundaries. Traditional physical "rules" are difficult or impossible to apply. Instead, new knowledge and a new point of view are required to understand the workings and the vulnerabilities of the Internet.
In this section, we give examples of recent malicious attacks on the Internet and examine why the Internet is so attractive to intruders.
3.1. Attack Strategies Illustrating Internet Vulnerabilities
3.1.1. SYN Attacks: Denial of Service
SYN attacks have been used successfully against a wide variety of targets, but they have the greatest impact against the companies that provide connections to the Internet. These Internet service providers, or ISPs, provide Internet connection services to government, businesses, and individuals. A SYN attack against an ISP usually results in disruption of Internet service to all the service provider's customers.
This type of attack is very difficult to prevent because it exploits a design flaw in the basic technology used for Internet communication today. Experts are currently working on techniques to reduce the problem somewhat, but preventing these attacks from occurring in the future will require a change in the way Internet communications are accomplished by the computers using the Internet. This is likely to take several years.
3.1.2. Internet Protocol (IP) Spoofing: Masquerading
Unfortunately, there are many computer programs and services that rely on other computers to "speak the truth" about their address and have no other mechanism for disallowing access to sensitive information and programs. The CERT® Coordination Center has received many reports of attacks in which intruders (even novice intruders) used this technique to gain access to computer systems with the help of publicly available IP spoofing computer programs.
This attack technique is being addressed by fundamental changes in the way computers communicate over the Internet. The Internet Engineering Task Force (IETF) Proposed Standard for the Next Generation Internet Protocol (IPng) is being designed to provide integral support for authenticating hosts and protecting the integrity and confidentiality of data.
Although early implementations of IPng are underway, the IP spoofing technique is likely to remain effective for years.
3.1.3. Sniffers: Violating Privacy and Confidentiality
The sniffer program records many kinds of information for later retrieval by the intruder. Of specific interest to most intruders is the user name and password information used in requests to connect to remote computers. With this information, an intruder can attack a computer on the Internet using the name and password of an unsuspecting Internet user. Intruders have captured hundreds of thousands of these user name/password combinations from major companies, governments sites, and universities all over the world.
To prevent attacks of this type, encryption technology must be used for both the access to other computers around the Internet (cryptographic authentication) and the transmission of data across the Internet (data encryption).
3.2. Attractiveness of the Internet to Intruders and Attackers
3.2.1. Ease of Internet Attacks
The Internet is primarily based on protocols (rules and conventions) for sharing electronically stored information, and a break-in is not physical as it would be in the case of a power plant, for example. It is one thing to be able to break into a power plant, cause some damage, then escape. But if a power plant were like the Internet, intruders would be able to stay inside the plant undetected for weeks. They would come out at night to wander through the plant, dodging a few guards and browsing through offices for sensitive information. They would hitch a ride on the plant's vehicles to gain access to other plants, cloning themselves if they wished to be in both places at once.
Internet attacks are easy in other ways. It is true that some attacks require technical knowledge--the equivalent to that of a college graduate who majored in computer science--but many successful attacks are carried out by technically unsophisticated intruders. Technically competent intruders duplicate and share their programs and information at little cost, thus enabling naive "wanna-be" intruders to do the same damage as the experts. In addition to being easy and cheap, Internet attacks can be quick. In as little as 45 seconds, intruders can
3.2.2. Difficulty of Tracing Internet Attacks
Moreover, the Internet is designed to allow packets to flow easily across geographical, administrative, and political boundaries. Consequently, cooperation in tracing a single attack may involve multiple organizations and jurisdictions, most of which are not directly affected by the attack and may have little incentive to invest time and resources in the effort.
This means that it is easy for an adversary to use a foreign site to launch attacks at U.S. systems. The attacker enjoys the added safety of the need for international cooperation in order to trace the attack, compounded by impediments to legal investigations. We have seen U.S.-based attacks on U.S. sites gain this safety by first breaking into one or more non-U.S. sites before coming back to attack the desired target in the U.S.
3.2.3. Low Risk to Intruders
3.3. A Note About Loss of Confidence in the Internet
Loss of confidence can result even if an intruder leaves no damage because the site cannot prove none was left. With some infrastructures, such as electricity, gas, and emergency services, once an overt denial-of-service attack has been resolved and the service returned, consumers immediately regain trust in the service they receive. But the Internet is highly susceptible to a loss-of-confidence crisis.
Only recently have some vendors begun using a cryptographic technique (checksums) that makes it possible to determine whether files or programs have been modified, and providing features that prevent modification of system files.
In summary, intruders on the Internet continue to prey on the lack of security in many of the products and protocols in use on the Internet today. As the U.S. becomes more dependent on the Internet, the potential impact of a successful Internet-based attack against the U.S. increases. The next section describes examples of the possible effect of Internet attacks on several critical national infrastructures.
4. The Cascade Effect of a Sustained Attack on the Internet
Sustained attacks on the Internet can undermine other critical infrastructures in a cascade effect, the effect that occurs when an attack on one infrastructure causes damage to another. Moreover, it is currently not possible to prevent sustained Internet attacks but only to limit their impact.
In this section, we describe the cascade effect of attacks on the Internet. Damage can occur in a variety of ways. The examples we include are current today, but they also reflect what we expect to see more of in the future.
Historically, many critical national infrastructures were physically and logically separate systems that had little interdependence. As digital information became a more important part of how the infrastructures operated, a "cyber component" of each infrastructure grew. These cyber components are being connected in complex ways as the Internet, intranets,3 cable television, telephone service, and other information services are becoming interrelated through the physical hardware they use.
The relationships between infrastructures can take many forms. Often one infrastructure uses another as part of its underlying technology. For example, the telecommunications infrastructure relies on the power grid for electricity. It is possible to limit cascade effects by understanding the relationships and compensating for them, taking steps to limit the damage that can cascade from one infrastructure to the other. In the case of the power grid, many critical electronic components of the telecommunications grid are on battery backup to prevent disruption resulting from short-term power failures. In well-understood relationships, limiting factors contribute to the overall health of the infrastructures. In several of the cases discussed below, however, the relationships are not well understood; thus, there is no compensating means for limiting the effect of failure to one infrastructure.
A natural extension of the cascade effect, which we will not discuss here, is the effect of multiple, coordinated, sustained attacks on several infrastructures simultaneously. We leave it to the reader to imagine just how bad things could be if an adversary could control several key infrastructures simultaneously. In this report, however, we focus on the cascade effect of an attack that uses the Internet as a starting point.
Some of the factors contributing to the cascade effect of such an attack
are the following:
The results of the cascade effect include these:
The sections below give examples of the trend toward increased connections to the Internet. They also outline several ways that Internet-based attacks, or attacks on the Internet, could cascade to other infrastructures.
4.1. Increased Connections and Their Impact
The Internet is being used as a solution to the problem of sharing data across
the diverse systems that comprise the emergency services
infrastructure. In response to the need for better coordination during
national emergencies, the National Communications System is developing the
Emergency Response Link (ERLink) capability.4
ERLink is designed to use the Internet and other networked services to supply information to all relevant parties during an emergency, including government agencies, hospitals, the Red Cross, and law enforcement. As the Internet proves itself to be a cost-effective method of moving information among emergency service providers, and as these service providers become increasingly dependent on the Internet, any sustained at tack on the Internet could have a profound effect on the nation's ability to coordinate across the various organizations that provide emergency services. A sustained attack on the Internet would cause these organizations to revert to using the telecommunications infrastructure, especially FAX and phone service, which are far less effective because they do not automate the coordination of many parties simultaneously. Within five years, this fallback position may no longer be possible.
The medical services field is rapidly moving to the Internet to coordinate medical advice to local emergency health services nationwide in critical health situations, and even to provide remote delivery of medical services.
For example, some hospitals now use the Internet to coordinate patient transfers in major metropolitan areas. The National Institutes of Health uses the Internet to coordinate resources in the research and deployment communities. The Center for Disease Control uses the Internet to alert hospitals to national health risks. Disruption of these services through attacks on the Internet-connected systems, or through denial-of-service attacks on the Internet itself, could have an impact on the delivery of essential health services. In times of emergency or epidemic, the impact could be severe.
Other areas of medical computing are changing rapidly as well. Patient records are increasingly maintained in electronic form. Systems such as MEDNET, linking hospitals, doctors, and patients are becoming a critical component of the U.S. health care system.5
The Internet is now recognized as a critical part of the national health information infrastructure.6
Security for these systems is under investigation (see, for example, the case study performed at Beth Israel Hospital in Boston7).
These investigations highlight the potential vulnerability of health records to intrusions on the Internet. Unfortunately, in some cases, this potential vulnerability has already become a reality. In 1993, Detective John Austin of New Scotland Yard reported two cases of electronic tampering of medical records.8
One case involved changing the results of cancer tests from negative to positive. The second involved the corruption of brain scan data to be used to guide surgery.
The move to Internet technologies is under way in transportation. For example, a major transportation company is using the Internet to control the flow of freight in a mission-critical application. The company uses JAVA with the Internet for connecting customers and suppliers to control the flow of freight through the national transportation infrastructure.9
Other segments of the transportation infrastructure, such as a trucking firm described in EDI Forum,10 are moving to Internet-based EDI (Electronic Data Interchange) systems to coordinate the transport of liquid and dry bulk materials. For parcel delivery, a major company now depends on Internet technologies to provide information to customers and coordinate delivery resources.11
Simple denial-of-service attacks on these Internet-based applications could disrupt the operation of companies and their delivery of freight. More sophisticated man-in-the-middle attacks that corrupt messages between suppliers, their customers, and transportation brokers could reroute transportation resources to undesired locations or away from areas of critical need. A sustained attack on the Internet that had the effect of altering the content of electronic messages would have a great impact on infrastructures whose well-being relies on those messages.
The banking and finance infrastructure is so dependent on computer networks that a successful cyber attack can drastically affect the banking and finance community. The trading markets, electronic funds transfer, and other critical financial functions are currently managed primarily through isolated networks, but this is changing because using shared networks such as the Internet is more cost-effective. The CERT® Coordination Center staff has visited several financial institutions that use Internet connections to provide information to existing and potential customers. The systems using the Internet do not directly control financial transactions, but are connected, through firewalls, to networks that also support systems critical to financial transactions. These firewalls are designed to permit some traffic to pass in order to allow maintenance of the Internet-connected systems. Unfortunately, there is no reason to believe that these firewalls are free of security flaws or that the firewalls have been configured in a foolproof way. Though the path from the Internet to the systems conducting financial transactions is probably not straightforward, there is always increased risk when air gaps between systems are replaced by electronics that allow the flow of data and control information.
4.2. Information Infrastructure
There are several types of relationships through which systems not considered directly connected to the Internet can suffer the cascade effect of an Internet attack. One relationship is that of an intranet distributing critical information and relying on the Internet for the underlying transport. If the Internet experienced a partial or full shutdown, the intranet riding on the Internet (but not logically connected) would suffer degraded or faulty service, resulting in a failure of that portion of the information infrastructure. A sustained denial-of-service attack against the Internet would disconnect a large portion of the information infrastructure and probably bring down the entire infrastructure.
As an example, a major delivery service uses an intranet riding on the Internet to coordinate the delivery of packages.12
If a sustained attack was made through the Internet on the network service providers supporting this intranet, the intranet itself would be shut down, making delivery impossible until the network was restored.
Today there are backup links in the information infrastructure that depend on dial-up access and leased lines; but if the current trends continue, these will be replaced within five years with intranets riding on the Internet. As a result, an attack on one part of the information infrastructure could have a devastating effect on the whole. (Also, the back-up links themselves are susceptible to attack.)
Adversaries who control a portion of the Internet can monitor the networks and activity of organizations without their knowledge. Adversaries can also "spoof," or masquerade as, legitimate organizations on the Internet; they can issue instructions, demands, threats, or other messages and make them appear to come from any source the adversaries chose. For example, an alleged cocaine dealer, William Londono, was released from Los Angeles County Jail on August 25, 1987, on the basis of a forged email message.13
Attacks that result in denial of service or control of systems are not the only threats to the infrastructure. Activities that reduce the integrity or privacy of information on the Internet would also be devastating to the information infrastructure as a whole. If there is reduced confidence in the transport of information in the infrastructure, the effectiveness of the infrastructure could be degraded to the point of uselessness. This achieves the same effect as a denial-of-service attack but is much more difficult to recover from.
Reliance on the Internet as the transport for the information infrastructure will grow over the next five years such that, in the absence of change, an attack on the Internet will have a drastic effect on the information infrastructure.
5. Implications for Public Policy
In this section we examine ways in which the government could address issues of network survivability and security. Although no single approach can ensure survivability of the Internet, and thus the information infrastructure, a combination of approaches can reduce the risks associated with the ever-increasing dependence on the Internet and the possibility of a sustained attack on it.
5.1. Context for Public Policy Decisions
The following general recommendations provide the context for the specific recommendations in Section 5.2. These general recommendations provide a foundation for making public policy decisions relating to the Internet and the information infrastructure.
5.1.1. Treat the information infrastructure as a separate, critical
It is important to develop policies and operational mechanisms that recognize the inherent differences between the physical world and cyberspace. Many of the concepts on which public policy is based do not apply in cyberspace. For example, it is unlikely that effective cybersecurity policy and operations can develop if ideas are based on the more mature, better understood, predictable, and stable context of physical security. Physical security focuses on issues of property damage, loss of life and physical movement, and physical accessibility. In contrast, cybersecurity is concerned with privacy, confidentiality, information integrity, and information accessibility. There is a lack of physical power in cyberspace that imposes a cooperative culture in which the power, leadership, rewards, and successes go to those who are most effective at cooperating and coming to mutual agreements. Cybersecurity issues also differ because of the immature technology, experimental nature, rapid expansion, and constantly changing use of the Internet.
5.1.2. Make national policy and operations decisions with the awareness that cybersecurity issues are international in scope and require international cooperation. The information infrastructure lacks the geographic locality necessary for applying the concept of national boundaries and for enforcing or changing regulations at these boundaries. The CERT® Coordination Center, for example, has found it both necessary and effective to work with similar organizations in other countries; and recent U.S. Senate hearings on security in cyberspace provide several anecdotes of incidents emanating from or conducted through foreign sites.
As noted above, cooperation and mutual agreement are the rule in cyberspace. To encourage safe practices on the Internet, the U.S. needs to develop policies jointly, cooperate with other jurisdictions, and come to mutual agreements.
5.1.3. Emphasize individual, commercial, and economic needs in public policy, as well as government and military needs. Cybersecurity threats relate directly to issues of privacy, integrity, confidentiality, and denial of service with their attendant financial, social, and loss-of-rights costs to individuals and companies. Cybersecurity policy that neglects these issues is unlikely to satisfy real national needs.
5.2 Specific Recommendations
5.2.1. Reporting and Monitoring Threats and Vulnerabilities
The population on the Internet has changed drastically in the last few years. The combination of easy access and user-friendly interfaces have drawn users of all ages and from all walks of life. As a result, there are consumers on the Internet who have no more understanding of the technology than they do of the engineering behind other infrastructures. Similarly, many system administrators lack adequate knowledge about the network and about security, even while the Internet is becoming increasingly complex and dynamic.
To encourage "safe computing," there are steps we believe the government could take:
14National Research Council, Computers at Risk: Safe Computing in the Information Age, National Academy Press, 1991, recommendation 3c, p. 37.
5.2.3. Research and Development
5.2.4. Use of Standards
Successful generally accepted system security principles would establish a set of expectations about and requirements for good practice that would be well understood by system developers and security professionals, accepted by government, and recognized by managers and the public as protecting organizational and individual interests against security breaches and lapses in the protection of privacy. --Computers at Risk15
The Computers at Risk report in 1990 underscored the need for the creation of generally accepted system security principles, to guide system developers and users in deploying systems with some reasonable assurance of safety. Although some principles are now available, none is appropriate for widespread, practical use. Thus, the deployment of systems into the consumer, business, and safety-critical markets continues unabated, while users' ability to compare one system's security against another or against a minimum standard has shown little, if any, improvement. The need remains for a set of minimum security standards for Internet products.
In many security incidents, the CERT® Coordination Center staff sees the same problems repeated:
The current situation is not encouraging. Consumers lack awareness and knowledge of technical security issues, and as more homes and businesses acquire computer systems, the median security knowledge naturally decreases. Without concrete guidelines that they can understand, average consumers cannot and do not demand any specific level of security when making purchases.
As a result, vendors do not feel market pressure to provide increased security. Consumers show more concern that systems are easily connected to their existing network and accessible than that they are safe from intruders. The available market choices are thus in the area of price, performance, and ease-of-use features. Consumers, in response, evaluate systems based on these features and work to gain knowledge and expertise in these areas instead of investigating security issues.
In the long term, consumer education (see Section 5.2.2) is the best means to cause market forces to address this situation. In the short term, generally accepted standards can jump-start the process. These standards should address areas such as the following:
The Orange Book and related guidelines have had some success in affecting consumer demand and, in response, vendor offerings. Unfortunately, these guidelines are designed to match a security model that is often more appropriate for military needs than private sector needs. Thus, these specifications have not found the widespread acceptance and use needed to improve the minimum level of security that can be expected in systems. Some efforts are underway to develop security models and guidelines more appropriate for the private sector, such the Generally Accepted System Security Principles (GSSP) and X/Open Basic Security Services (XBSS). However, there are no guidelines currently in widespread use, and it remains to be seen how well they will meet the needs of software developers and users in the coming years.
The government can take the following steps to encourage the use of minimum security standards:
5.2.5. Laws and Law Enforcement
Cybercops are law enforcement personnel whose beat is cyberspace. A cybercop must be able to work with law enforcement from other jurisdictions; the criminal will never be found only in cyberspace but in another physical jurisdiction. Cooperation is not limited to the borders of this or any other country; but just as cyberspace spans the entire globe, so must the ability for the cybercop to work with other law enforcement personnel.
It is not effective to make new laws to cover traditional crimes in cyberspace. There are several reasons for this, as the CERT® Coordination Center is often reminded through our day-to-day activity. First, creating a new law within the boundaries of the United States is not effective in a jurisdiction that is international in scope. To be effective, any new legislative activity in cyberspace must involve international cooperation. Secondly, the technology is changing faster than laws specific to the technology can change; legislation cannot keep up. Crime certainly will exist using new technology. However, despite the unique characteristics of cyberspace, most of the crimes committed in this environment are traditional in nature, with the use of technology giving a new look to these illegal acts. The most effective way to address traditional crimes is to re-interpret them in the area of cyberspace, not to make new laws.
There are several specific national policies that could help address the international nature of crime in cyberspace:
By remembering the inherent differences between the physical and digital worlds, as well as the special risks faced by users of the Internet, the United States government can implement policies that protect individuals and organizations using the Internet for legitimate purposes, improve the security and survivability of the Internet as a whole, and protect the U.S. infrastructures that depend on the Internet from suffering disastrous setbacks or even collapse as a result of a hostile Internet attack.
Prepared for presentation on the web July 1997
Copyright 1997 Carnegie Mellon University