Cybersecurity

[Marauder06]

I have a major project coming up in which we have to develop and present a national-level cybersecurity plan. Oh yeah and we have to write a major paper on it as well. As part of my research for this project, I would appreciate it if anyone had any papers, briefings, or thoughts on cyber that they might be willing to share. Here's the best (meaning "worst") part- it all has to be UNCLASS.

 

[SpitfireV]

I'll have a trawl of my assorted collected journal articles when I get back on a uni computer next. Is it strictly about defensive stuff?

 

[Dame]

I have a couple from a couple of semesters ago. And yeah, UNCLASS means it's gonna look sophomoric. That was my biggest issue with the papers I've had to write. I never felt the info was all that up to date.

ETA: I almost forgot. The most important thing to a Mara report has got to be the clipart. I found this for your Safe Cyber plan.

 

[SpitfireV]

I have a couple from a couple of semesters ago. And yeah, UNCLASS means it's gonna look sophomoric. That was my biggest issue with the papers I've had to write. I never felt the info was all that up to date.

ETA: I almost forgot. The most important thing to a Mara report has got to be the clipart. I found this for your Safe Cyber plan.
View attachment 6805

Aahaha. That should so go in as an appendix.

 

[DA SWO]

I have a couple from a couple of semesters ago. And yeah, UNCLASS means it's gonna look sophomoric. That was my biggest issue with the papers I've had to write. I never felt the info was all that up to date.

ETA: I almost forgot. The most important thing to a Mara report has got to be the clipart. I found this for your Safe Cyber plan.
View attachment 6805

That pic should be the report cover sheet.

 

[LimaOscarSierraTango]

Sir,

Try reaching out to some profs at Carnegie Mellon University. They are front runners in the cyber security game. You can also check out SANS and see if you can get a hold of some papers written for their GIAC certification. Other than that, I really don't have much else to offer.

Nextgov.com also has some good articles. They had this one today that may give you some standards or something to look at.

 

[Karoshi]

Let me see if I have anything from some of the monthly literature and Space Journals from SMDC/ARSTRAT. I know that whenever they did the yearly Space Symposium at the Broadmoor, there was a contingency of personnel who spoke about some cybersecurity as well. SMDC/ARSTRAT was the Army focal point under STRATCOM, before the creation of ARCYBER and USCYBERCOM.

 

[RackMaster]

I'm a little out of touch with current policies but I'd be interested to read the final article.

 

[AWP]

Depending on the scope and depth of the report an UNCLASS cybersecurity paper wouldn't be a problem. If you try to overthink it and delve into the realm of classified material, you're setting yourself up for failure.

 

[SpitfireV]

This seems to be almost all I've got on such wizardry.

 

[RackMaster]

Here's some basics that I can remember and that are UNCLASS.

The problem with how far we've gone with technology, some people think that cybersecurity can be solved with an "App" but it all comes down to the basics of security. The best defence is a physical defence, the more isolated a network; the smaller chance of intrusion. That includes connecting the network to the outside world, even with the use of hardware and software security appliances and limiting input devices/connectors for users. Keep it disconnected from the WWW and make sure all workstations don't have input/output ports or have them disabled. Keep all data the users need for every day work in a centralized, monitored, shared location. As well eliminate all outside electronic devices from being brought into the work space.

 

[LimaOscarSierraTango]

Some of your worst nightmares:

Pwnie Express
(we tried one of these on our network and could NOT detect it)

Pwnie Express for Raspberry Pi
(make a customized Pwnie Express node to hide anywhere)

USB Key Logger

Social Engineering
(probably the biggest vulnerability)

 

[x SF med]

Here's some basics that I can remember and that are UNCLASS.

The problem with how far we've gone with technology, some people think that cybersecurity can be solved with an "App" but it all comes down to the basics of security. The best defence is a physical defence, the more isolated a network; the smaller chance of intrusion. That includes connecting the network to the outside world, even with the use of hardware and software security appliances and limiting input devices/connectors for users. Keep it disconnected from the WWW and make sure all workstations don't have input/output ports or have them disabled. Keep all data the users need for every day work in a centralized, monitored, shared location. As well eliminate all outside electronic devices from being brought into the work space.

What are you saying? Compartmentalization of information / systems is the best security, physical or intellectual, that there is? Oh, the horror that it's not much more complex than that....

 

[RackMaster]

What are you saying? Compartmentalization of information / systems is the best security, physical or intellectual, that there is? Oh, the horror that it's not much more complex than that....

I don't know what I'm saying. ;) It just kinda spews out of my melon.

 

[x SF med]

We need to be able to both like and agree with a post... especially when it is the perfect summation of a mod's world as Maple Syrup and Bacon Boy's above post...

 

[AWP]

Here's some basics that I can remember and that are UNCLASS.

Some of your worst nightmares:

See what I mean? There's no point in being cool for topics like this when the basics are so effective. Hmmm, kind of like how SOF builds from basic, generic Infantry tactics or how the 160th builds from basic aviation principles.

When thinking about "security" you don't have to think in terms of classified details.

 

[RackMaster]

But then it's harder to justify your presence because you're one of 2 people "certified" on some obscure application that your buddy created.

 

[x SF med]

See what I mean? There's no point in being cool for topics like this when the basics are so effective. Hmmm, kind of like how SOF builds from basic, generic Infantry tactics or how the 160th builds from basic aviation principles.

When thinking about "security" you don't have to think in terms of classified details.

Just like shooting.... remember the basics. If the bg can't get to the data, he can't steal it.

 

[LimaOscarSierraTango]

Just like shooting.... remember the basics. If the bg can't get to the data, he can't steal it.

Sometimes they don't have to...

End users are notorious for making "human errors", being lazy, taking short cuts, being bought off/extorted, etc. All it takes is someone saying something in a public place where they are over heard, and they can be followed, researched on, and social engineered or forced to give up information. It's not just a work place thing. Think of the local bank robbery where they went to the bank manager's house and brought her to the bank to open the vault.

If someone wants the data bad enough, they will find a way to get it. Putting an isolated network inside a mountain where the end user works from a VDI and only has a mouse, keyboard, and monitor in front of them is a damn good start. But it won't always stop hiring someone with malicious intentions or people from monitoring vehicles and people coming in or leaving the area.

Just my $0.02 and probably worth less.

 

[x SF med]

Sometimes they don't have to...

End users are notorious for making "human errors", being lazy, taking short cuts, being bought off/extorted, etc. All it takes is someone saying something in a public place where they are over heard, and they can be followed, researched on, and social engineered or forced to give up information. It's not just a work place thing. Think of the local bank robbery where they went to the bank manager's house and brought her to the bank to open the vault.

If someone wants the data bad enough, they will find a way to get it. Putting an isolated network inside a mountain where the end user works from a VDI and only has a mouse, keyboard, and monitor in front of them is a damn good start. But it won't always stop hiring someone with malicious intentions or people from monitoring vehicles and people coming in or leaving the area.

Just my $0.02 and probably worth less.

Nothing is ever 100% secure, I wholly agree with that, but the basics are a great starting point. My last job had to make everybody sign 'nondisclosure of sensitive information' forms every six months.... because ther ewere issues with data flow from the organization to people who did not need to have it.... sad, very sad.