CYBER FRAUD - M. PIRAVI PERUMAL

CYBER TERRORISM

• What is cyber-terrorism?

• How is it important to computing professionals?

• How is it important to the rest of society?

• What is being done about cyber-terrorism?

• How can I protect myself from cyber-terrorism?

• Ethical issues involved with cyber-terrorism.

• More information about cyber-terrorism.

What is Cyber-terrorism?

The FBI defines terrorism as the unlawful use of force or violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives. Cyber-terrorism could thus be defined as the use of computing resources to intimidate or coerce others. An example of cyber-terrorism could be hacking into a hospital computer system and changing someone's medicine prescription to a lethal dosage as an act of revenge. It sounds far fetched, but these things can and do happen.

Why do we care?

The idea of this site is to both illustrate the importance of understanding the dangers of cyber-terrorism, and provide information that can aid in that understanding. Computing professionals all over the world need to be aware of possible areas of weakness to such terrorism, in order to better protect their computer systems and possibly help put an end to terrorist activity. An important part of any profession is promoting the good name of that profession, but cyber-terrorist continue to give the computing profession a bad reputation. Thus, it is important for computing professionals to understand cyber-terrorism for the benefit of themselves, their profession, and society as a whole.

What is being done?

In response to heightened awareness of the potential for cyber-terrorism President Clinton, in 1996, created the Commission of Critical Infrastructure Protection. The board found that the combination of electricity, communications and computers are necessary to the survival of the U.S., all of which can be threatened by cyber-warfare. The resources to launch a cyber attack are commonplace in the world; a computer and a connection to the Internet are all that is really needed to wreak havoc. Adding to the problem is that the public and private sectors are relatively ignorant of just how much their lives depend on computers as well as the vulnerability of those computers. Another problem with cyber crime is that the crime must be solved, (i.e. who were the perpetrators and where were they when they attacked you) before it can be decided who has the actual authority to investigate the crime. The board recommends that critical systems should be isolated from outside connection or protected by adequate firewalls, use best practices for password control and protection, and use protected action logs.

Most other government organizations have also formed some type of group to deal with cyber-terrorists. The CIA created its own group, the Information Warfare Center, staffed with 1,000 people and a 24-hour response team. The FBI investigates hackers and similar cases. The Secret Service pursues banking, fraud and wiretapping cases. The Air Force created its own group, Electronic Security Engineering Teams, ESETs. Teams of two to three members go to random Air Force sites and try to gain control of their computers. The teams have had a success rate of 30% in gaining complete control of the systems.

How can I protect myself?

Currently there are no foolproof ways to protect a system. The completely secure system can never be accessed by anyone. Most of the militaries classified information is kept on machines with no outside connection, as a form of prevention of cyber terrorism. Apart from such isolation, the most common method of protection is encryption. The wide spread use of encryption is inhibited by the governments ban on its exportation, so intercontinental communication is left relatively insecure. The Clinton administration and the FBI oppose the export of encryption in favor of a system where by the government can gain the key to an encrypted system after gaining a court order to do so. The director of the FBI's stance is that the Internet was not intended to go unpoliced and that the police need to protect people's privacy and public-safety rights there. Encryption's draw back is that it does not protect the entire system, an attack designed to cripple the whole system, such as a virus, is unaffected by encryption.

Others promote the use of firewalls to screen all communications to a system, including e-mail messages, which may carry logic bombs. Firewall is a relatively generic term for methods of filtering access to a network. They may come in the form of a computer, router other communications device or in the form of a network configuration. Firewalls serve to define the services and access that are permitted to each user. One method is to screen user requests to check if they come from a previously defined domain or Internet Protocol (IP) address. Another method is to prohibit Telnet access into the system.

Here are few key things to remember to protect yourself from cyber-terrorism:

1. All accounts should have passwords and the passwords should be unusual, difficult to guess.
2. Change the network configuration when defects become know.
3. Check with venders for upgrades and patches.
4. Audit systems and check logs to help in detecting and tracing an intruder.
5. If you are ever unsure about the safety of a site, or receive suspicious email from an unkown address, don't access it. It could be trouble.

Some relavent ethical issues:

The ethical issues involved in cyber-terrorism are manifold. Any sort of crime or ethical violation can occur using a computer. Extortion of banks takes money from the banks, as well as their customers. The bank's, on the other hand, which many times refuse to admit to their inadequate defenses violate the public trust that the bank will be secure. The illegal altering medical records is unethical, as it can quickly and easily cause harm to another. Spreading disinformation is unethical in its lack of regard for the truth, as well as for the safety of and consequences on others who believe the misinformation. Altering, destroying, or stealing others data is a violation of their privacy. The ordinary hacker is guilty of lack of regard for the privacy of the peoples systems that he or she would enter. Hacking-for-hire is additionally illicit because they openly sell their services to break into others systems.