Prerequisites for Attacking an Information System

<div class="MsoNormal"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxzCXm-qsDzwAJDf3UxSSMJsUYIlXktYXzzn9B5ieW1XIZJpm3uTIxL2k2NAbod2UQITgEqdS-955782RpPdF5kBNiWisBRVopd4xx7hZuupTR-DLTi21WWzFvvk54CWQOEvu7FMZtqp_g/s1600/attack+prerequisites.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxzCXm-qsDzwAJDf3UxSSMJsUYIlXktYXzzn9B5ieW1XIZJpm3uTIxL2k2NAbod2UQITgEqdS-955782RpPdF5kBNiWisBRVopd4xx7hZuupTR-DLTi21WWzFvvk54CWQOEvu7FMZtqp_g/s1600/attack+prerequisites.png" /></a><span style="font-family: Arial, Helvetica, sans-serif;">In order for an attack on an information system to succeed, an attacker must possess three specific things: (1) <i>method</i>, (2) <i>opportunity</i>, and (3) <i>motive</i>. One useful way of remembering these prerequisites is through the acronym MOM (<u>M</u>ethod, <u>O</u>pportunity, and <u>M</u>otive). In the context of conducting attacks on information systems, method refers to the skills, knowledge, tools, experience, and so forth that an attacker must have in order for an attack to be realistically attempted. Opportunity, by contrast, refers to the time and the necessary access that are required in order for an attacker to attempt an attack on an information system. Finally, motive simply refers to the purpose for conducting an attack or the reason for which an attacker desires to carry out an attack.<o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><span style="font-family: Arial, Helvetica, sans-serif;">From an information security perspective, it is critical that security personnel understand these three prerequisites for conducting attacks on information systems. If any of these three prerequisites can be eliminated -- that is, if we are able to effectively remove or disrupt an attacker’s method, opportunity, or motive -- then the attack will not succeed. If efforts aimed at defending against attacks on information infrastructure or protecting information assets are to have the best chance possible of succeeding, those efforts should therefore target one or more of these three prerequisites.</span><br /><div class="MsoNormal"><o:p></o:p></div>

Prerequisites for Attacking an Information System

In order for an attack on an information system to succeed, an attacker must possess three specific things: (1) method , (2) opportunity , a...

Read more »

Types of Information System Attackers

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYa0CEoSg0u-inIpFbrGsTt1kAnpcFGNljB5Wq5GGV0bX0rifdHFxFcWkPjPOSOcPRYe0cxI94nZYt0X8dMBDE_Fh_4WGDmMBC4dnZt_SlhciI7Kzz4twQKGQj0COMjqrbxHqpokzuN44O/s1600/hacker.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYa0CEoSg0u-inIpFbrGsTt1kAnpcFGNljB5Wq5GGV0bX0rifdHFxFcWkPjPOSOcPRYe0cxI94nZYt0X8dMBDE_Fh_4WGDmMBC4dnZt_SlhciI7Kzz4twQKGQj0COMjqrbxHqpokzuN44O/s1600/hacker.png" /></a></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">Who are these people who seek to compromise the confidentiality, integrity, or availability of our information assets? Surprisingly, many attackers are simply amateurs who act opportunistically. As an example, such an amateur might find someone’s lost mobile device or laptop computer and decide to sift through the files, or perhaps might be a script kiddie or wannabe hacker who finds pre-packaged hacking tools on some underground website, and attempts to apply those tools to the computers at her school or place of work. <o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">Amateurs notwithstanding, there are also hackers (or <i>white-hats</i>) and crackers (or <i>black-hats</i>), with the difference between the two depending upon the attacker’s intent. Specifically, hackers are attackers whose intent in attacking a system is non-malicious, while crackers are attackers who attack a system with the intent of causing harm. A computer security expert, for example, might be hired by a company to try to break into an information system for the purpose of evaluating the robustness of the system’s defenses. Such an attacker would be properly classified as a hacker (or as a white-hat). By contrast, an attacker who attacks a system with a malicious goal -- such as stealing data or disrupting the availability of the system -- would be properly classified as a cracker (or as a black-hat). <o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><br /><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">Some common types of crackers include both career criminals and organized crime syndicates who seek to engage in malicious breaches of information security for the purpose of financial or other gain. More recently, the information security world has also witnessed the rise of cyber terrorists, who are not necessarily affiliated with a particular state or government, but nevertheless are conducting attacks on information systems in support of some ideological or political agenda. Finally, and importantly, there are state-supported information warriors and spies. Most modern countries -- including powerful countries such as the United States and China -- employ vast armies of information warriors whose job it is to surveil government offices, military organizations, and even corporations in other countries for the purpose of collecting intelligence through digital means. Further, such officially sanctioned digital espionage is no longer just a minor consideration. In the United States, for example, the Department of Defense now considers cyberspace to be the fifth battlefield (with the first four battlefields being land, sea, air, and space). With cyberspace being acknowledged as a legitimate battlefield, substantial portions of many nations’ defense assets are now being directed toward efforts aimed at establishing superiority in cyberspace.</span><o:p></o:p></div>

Types of Information System Attackers

Who are these people who seek to compromise the confidentiality, integrity, or availability of our information assets? Surprisingly, many at...

Read more »