What forms of intrusion to internet security are occurring?
Computer Security
It is tempting to see intrusions in terms of a pyramid that goes from transient vulnerability probing and defacing web-sites at the base to large scale efforts to undermine the critical missions of an organization or the critical functions of a nation at the top - and to suggest that there is an inverse relationship between frequency and significance, with many trivial incidents and comparatively few of the more serious incidents. There are several difficulties with this however. The first is that probes that appear relatively insignificant could be a harbinger of more serious intrusions. The second is that there is sometimes a gap between intent and consequences ??? the effects and impact of an incident can either fall far short of what was intended, or far exceed what the perpetrator initially envisaged. This lack of congruence between limited intent and far-reaching consequences stems from the capacity of worms and viruses for infinite replication and multiplication combined with the seamless inter-connectivity of systems. Incidents such as the Love Bug cross the public-private divide and have an indiscriminate impact on corporations, governments, and private individuals irrespective of the initial target. In cases such as this, the consequences have less to do with targeting than with the ubiquity of a particular program such as Microsoft Outlook that is used as the vector of transmission. In effect, the incident takes on its own momentum.
When the consequences are widespread, of course, the incident becomes very public and is the subject of much media and official commentary. In many other cases, however, there is far greater reticence about the scale, type and targets of attack. The analytic effort must successfully build a trust relationship for the collection of data across a broad variety of organizations. This trust relationship allows for observation of incidents from early probing and experimentation through widespread deployment of automated forms of intrusion. For example, in recent months has received reports of intrusions involving a wide variety of automated tools, ranging from simple viruses and system corruption toolkits through complex viruses designed to attack relatively hardened sites with low probability of detection and distributed tools designed to crash network infrastructure. Roughly 10%-25% of the CERT/CC reports involve viruses. Roughly 20%-40% are intrusions where the victim site cannot discern the type of the intrusion from available data. The remaining intrusions are a large number of other forms of intrusion, including compromise of system administration accounts, web defacements, reconnaissance attempts and misuse of computing resources.
|
