Hosting Provided By

Cyber Menace: Integrated Defensive Policy Needed

From: Ravi Prasad <2(at)r67.net>
Date: Sat May 24 2003 - 13:03:56 EDT

('binary' encoding is not supported, stored as-is)

Cyber Menace: Integrated Defensive Policy Needed By Ravi Visvesvaraya Prasad

Published in the “Times of India”, edit page, on Tuesday, 20 May 2003

http://timesofindia.indiatimes.com/cms.dll/xml/uncomp/articleshow? msid=46885502

International Publishing Rights in all media with Times of India, 2003

By Ravi Visvesvaraya Prasad

In his article “A Virtual Non-Starter – Cyber Terrorism May Not Be for Real” (Times of India, Tuesday, 08 April 2003, edit page), Mr Vikas Singh, Associate Editor of the Times of India, described the consequences of cyber terrorism, especially on control systems and networks of computercontrolled devices.

Mr Singh referred to an incident in Australia where a million litres of sewage were released into the water supply. What set off alarm bells among cybersecurity professionals worldwide was that 44 previous attempts by Vitek Boden had remained undetected; Boden being thwarted only by noncomputerized backup safety measures.

Do you need help?

India’s SCADA-controlled (Supervisory Control & Data Acquisition Systems) electricity grids, power distribution systems, dam controls, water supplies, barrage controls, and sewage networks are highly vulnerable to attacks by cyberterrorists since almost none of them have up-to-date intrusion detection mechanisms installed. Worse, at least 30 percent of such Indian SCADA networks are accessible by modems which could be connected to the Public Switched Telephone Network. Moreover, public sector employees in India’s infrastructure sectors are lax about noncomputerized backup security procedures which are nowadays routinely implemented in SCADA systems abroad.

India’s banking sector, stock exchanges, and telecom and internet networks are also highly vulnerable since they have implemented piecemeal security solutions rather than an integrated defensive policy.

A second threat that India faces is loss of highly sensitive data from government offices. For over six years Pakistani cracker groups such as G- Pakistan, Pakistan Hackerz Club, Anti-India Crew, World’s Fantabulous Defacers and Silver Lords have been regularly breaking into the computer systems of Bhabha Atomic Research Centre, Indira Gandhi Centre for Atomic Research, Nuclear Science Centre, Ministry of Defence, Prime Minister’s Office, Cabinet Secretariat, Home Ministry, Ministry of External Affairs, and those of the three services, and accessing information. The damage that they caused was limited only by their adolescent mindsets rather than by any Indian cybersecurity measures. They could have caused far greater damage to India’s reputation if, instead of plastering puerile anti-Indian obscenities on the websites of various Indian ministries, they had altered the officially published texts of the speeches of Vajpayee, Advani or Fernandes on these government websites to make it appear that they were, say, calling for the genocide of Muslims in India or for a nuclear strike on Pakistan. Such semantic attacks have been carried out on the websites of several news agencies abroad where crackers altered news reports about various corporations in order to manipulate share prices.

Now that India’s National Informatics Centre is hosting the websites of the new Afghan government, it would also be open to attacks by Middle Eastern organizations such as Ikhwan al Muslimoon, Jamaat Islami, Hizb-ut- Tahrir, Khilafah, Izz al-Din Al-Kassam, and Nida'ul Islam which have welldeveloped offensive information warfare capabilities.

Far more serious than Pakistan is the long-term threat posed by China. While Pakistani cracker groups are mainly adolescents who receive encouragement and infrastructural support from Inter Services Intelligence, China’s People’s Liberation Army has successfully integrated the latest C4ISRT (Command, Control, Communications and Computers Intelligence, Surveillance, Reconnaissance and Targeting) and information warfare techniques into its People’s War doctrine. PLA’s offensive and defensive infowar capabilities are now next only to NATO’s.

While China’s offensive infowar capabilities are mainly targeted against Taiwan, USA, Japan and South Korea, they could be turned against India at any time, especially as China and India will inevitably jostle for geopolitical supremacy in Asia in the coming decades.

In mid-1999, China established a task force on information warfare composed of senior politicians, military officers and academics, headed by Xie Guang, Vice-Minister of the Commission of Science, Technology and Industry for National Defense. Other key members were Fu Quanyou, Chief of China’s General Staff, Yuan Banggen, Head of General Staff Directorate, Major General Wang Pufeng, Senior Colonel Wang Baocun, Shen Weiguang, Wang Xiaodong, Qi Jianguo, Liang Zhenxing, Yang Minqing, Dai Qingmin, Leng Bingling, Wang Yulin, and Zhao Wenxiang.

This task force had prepared detailed plans to cripple the civilian information infrastructures of Taiwan, USA, India, Japan and South Korea. Qi Jianguo and Dai Qingmin have formulated a comprehensive scheme: First, China would not attack military or political targets in these countries but would target their financial, banking, electrical supply, water, sewage, and telecommunications networks. Second, Chinese companies would establish business links with private companies in these countries. After carrying on legitimate business for some time, they would insert malicious computer codes and viruses over commercial e-mail services. Third, the viruses and malicious codes would be sent through computers in universities in third countries so that they could not be traced back to China but would be thought to be the handiwork of adolescent pranksters. Fourth, the attacks would be launched when the political leadership of the target countries was preoccupied, such as with election campaigns. Leng Bingling, Wang Yulin, and Zhao Wenxiang are in charge of mobilizing students and businessmen to support their military’s cyberattacks against civilian targets in these countries.

Do you need more help?

PLA has conducted several field exercises. An “Informaticized People’s Warfare Network Simulation Exercise” was conducted in Echeng District of Hubei Province. Five hundred soldiers simulated cyberattacks on the telecommunications, electricity, finance, and television sectors of Taiwan, India, Japan and South Korea. Ten functions were rehearsed in another exercise in Xian in Jinan Military Region: planting information mines; conducting information reconnaissance; changing network data; releasing information bombs; dumping information garbage; disseminating propaganda; applying information deception; releasing clone information; organizing information defense; and establishing network spy stations. In Datong, forty PLA specialists are preparing methods of seizing control of networks of commercial internet service providers in Taiwan, India, Japan and South Korea. They held demonstrations for Beijing Region Military Command, Central Military Commission, and General Staff Directorate.

Chief of General Staff Fu Quanyou presided over an exercise in Lanzhou and Shenyang Military Regions which simulated electronic confrontation with countries south and west of Gobi Desert. This focused on electronic reconnaissance, counter-reconnaissance, electronic interference and counter-interference. It tested the battle readiness of PLA’s command automation systems, command operations, situation maps, audio and graphics processes and controls, and data encryption systems. Smaller exercises were carried out in Chengdu Military Region and Guangzhou Military Region.

While it is gratifying that the Indian government has decided to establish a national center on information systems security, it should tap the expertise of universities and private software and internet companies, rather than merely rely on the outdated knowledge of unmotivated government employees. In addition to the government and defence sectors, this Centre should cater to India’s banking networks, stock exchanges, telecom and internet networks, power and water supplies, and transportation sectors.

By Ravi Visvesvaraya Prasad

The author heads a group which analyzes fourth-generation warfare and C4ISRT (Command, Control, Communications and Computers Intelligence, Surveillance, Reconnaissance and Targeting) in South Asia. He is also Advisor, Information Warfare & Revolution in Military Affairs, Centre for Monitoring Chinese Military Activities.

Cyber Menace: Integrated Defensive Policy Needed By Ravi Visvesvaraya Prasad

Published in the “Times of India”, edit page, on Tuesday, 20 May 2003

http://timesofindia.indiatimes.com/cms.dll/xml/uncomp/articleshow? msid=46885502

Can we help you?

Ravi Visvesvaraya Prasad
GSM: {91} 98 117 56789
Pager: {91} [11] 96 22 17 36 60
rvp@r67.net, rvp@50g.com
Fax: {91} [11] 25 26 68 68

Cyber Menace: Integrated Defensive Policy Needed By Ravi Visvesvaraya Prasad

Published in the “Times of India”, edit page, on Tuesday, 20 May 2003

http://timesofindia.indiatimes.com/cms.dll/xml/uncomp/articleshow? msid=46885502

International Publishing Rights in all media with Times of India, 2003 Received on Mon May 26 10:37:52 2003

This message: [ Message body ]
Next message: Ryan: "Analysis of Remote Active Operating System Fingerprinting Tools"
Previous message: Adam Berent: "Key Iterations and Cryptographic Salts"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:42 EDT