Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation

Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation

Volumn , Issue , 2006, Pages 1-474

  Lewis, Ted G ^a  

^a NAVAL POSTGRADUATE SCHOOL   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CIRCUIT THEORY; COMPUTATION THEORY; FACSIMILE; NATIONAL SECURITY; OPEN SOURCE SOFTWARE; OPEN SYSTEMS; PUBLIC WORKS; SITE SELECTION; STUDENTS;

CRITICAL COMPONENT; CRITICAL INFRASTRUCTURE PROTECTION; GOVERNMENT AGENCIES; INFRASTRUCTURE SECTOR; INFRASTRUCTURE SECURITY; OPTIMIZATION THEORY; SIMULATION SOFTWARE; VULNERABILITY ANALYSIS;

CRITICAL INFRASTRUCTURES;

EID: 85017399708     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1002/0471789542     Document Type: Book

References (245)

1. Critical nodes will be synonymous with hubs, in this book.
2. Critical Foundations: Protecting America's Infrastructures," The Report of the President's Commission on Critical Infrastructure Protection, October 1997.
3. G. Johnson and K. Scholes, Exploring Corporate Strategy: Text and Cases. Englewood Cliffs, NJ:Prentice-Hall, 2001.
4. At the time of this writing, homeland defense was undergoing revision. In an Army document dated April 1999, the term was described as follows: "There is currently no definition of homeland defense. The proposed definition shows the Army's mission to protect our territory, population, and critical infrastructure by; deterring/defending against foreign and domestic threats, supporting civil authorities for crisis and consequence management, and helping to ensure the continuance [of] critical national assets."http://www.fas.org/spp/starwars/program/homeland/executive-overview.htm.
5. The enclosed disk includes several simulation programs that demonstrate the concepts described here.
6. The Whitehouse: Homeland Security Presidential Directive/HSPD-7, December 17, 2003.
7. The "most popular" or "busiest" Internet servers are easily found by a variety of methods, not the least of which are "crawlers" or "spiders"software programs that travel through the Internet on their own and report back on what they find.
8. http://www.ncs.gov/about.html.
9. http://www.archives.gov/federal_register/codification/executive_order/12148.html.
10. http://www.religioustolerance.org/rajneesh.htm.
11. "The group settled on the 65,000 acre 'Big Muddy Ranch' near Antelope, Oregon, which his sannyasins had bought for six million dollars. The ranch was renamed Rajneeshpuram ("Essence of Rajneesh").This 'small, desolate valley twelve miles from Antelope, Oregon was transformed into a thriving town of 3,000 residents, with a 4,500 foot paved airstrip, a 44 acre reservoir, an 88,000 square foot meeting hall '" http://www.clui.org/clui_4_1/lotl/lotlv10/rajneesh.html.
12. http://home.att.net/meditation/bioterrorist.html.
13. http://www.fas.org/irp/offdocs/pdd39.htm.
14. "Critical Foundations: Protecting America's Infrastructures," The Report of the President's Commission on Critical Infrastructure Protection, October 1997.
15. http://www.fas.org/irp/offdocs/eo13010.htm.
16. http://www.fas.org/irp/offdocs/pdd/pdd-63.htm.
17. http://www.archives.gov/federal_register/executive_orders/1999.html#13130.
18. The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, February 2003, Department of Homeland Security. http://www.whitehouse.gov/pcipb/physical.html.
19. The Whitehouse, "Homeland Security Presidential Directive/Hspd-7," December 17, 2003.
20. The Whitehouse, "Homeland Security Presidential Directive/Hspd-7," December 17, 2003
21. The Whitehouse, "Homeland Security Presidential Directive/Hspd-7," December 17, 2003
22. San Lewis Rey is a virtual city in cyber-space where all bad things happen. It is a pedagogical device for exercising the reader's ability to apply what he or she has learned from the text.
23. The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, Feb. 2003,p. 9.
24. http://www.archives.gov/federal_register/codification/executive_order/12656.html.
25. http://www.gao.gov Disaster Assistance: Federal, State, and Local Responses to Natural Disasters Need Improvement, T-RCED-91-57, May 15, 1991.
26. http://www.fas.org/irp/offdocs/pdd39.htm.
27. Richard A. Falkenrath "Problems of Preparedness" Paper 2000-28, Belfer Center, Harvard University,December 2000.
28. R. W. Giuliani, Leadership, Hyperion Books, New York, 2002, pp. 14-15.
29. The Internet Under Crisis Conditions: Learning from September 11, National Research Council,National Academies Press, Washington, D.C., 2001, p. 1.
30. The Internet Under Crisis Conditions: Learning from September 11, National Research Council,National Academies Press, Washington, D.C., 2001, p. 8; p. 25.
31. One can argue that the only reliable methodology is foolproof intelligence, which is an oxymoron.
32. D.S. Hartley, "Topics in Operations Research: Predicting Combat Effects," Military Applications Society, INFORMS, informs@informs.org, 2001.
33. National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, February 2003.
34. http://www.ciao.gov/related/index.html#Critical Infrastructure Information Sharing and Analysis Centers.
35. http://thomas.loc.gov/cgi-bin/bdquery/z?d107:H.R.5005
36. http://thomas.loc.gov/cgi-bin/bdquery/z?d107:H.R.5005
37. A.-L. Barabasi, Linked: How Everything Is Connected To Everything Else and What It Means for Business, Science, and Everyday Life, PLUME Cambridge Center, Cambridge, MA, 02142, 2003.
38. M. Resnick, Turtles, Termites, and Traffic Jams: Explorations in Massively Parallel Microworlds. MIT Press, Cambridge, MA, 1994.
39. Termite is available from the website or the disk accompanying this book.
40. The Second Law of Thermodynamics says entropy always increases whenever a physical process takes place. Hence, order tends to disorder-not the opposite.
41. The term "scale free" does not refer to the size nor the breadth of the network. Instead, scale-free networks obey a power law that has no variance, and the links are distributed according to a probability density function that is proportional to (1/k)p, where p is typically between 2 and 3.
42. Barabasi and others define a scale-free network as one with a power law p between 2 and 3. However, for our purposes, any value of p greater than 1.0 will do.
43. PowerGraph.class and PowerGraph.html can be found on the disk and the website under Scale-Free Demo.
44. The Poisson distribution is a discrete probability distribution for X, where X takes on the values X 1/4 0,1,2,3,Its shape is determined by one parameter l, which is the expected value of X. If the average number of random occurrences per interval 1/4 l, the probability P of X occurrences in the interval is P(X) 1/4 el[lX/X!].
45. Metcalf's Law states that the value of a network increases proportional to the square of the number of users.
46. The Road Atlas Deluxe, RAND McNally: United States, Canada, and Mexico, 2003. Only one and two digit interstate routes were counted-three-digit routes are beltway or spur roads in the system.
47. D.Watts, "Networks, Dynamics, and the Small-World Phenomenon," American Journal of Sociology,vol. 105, no. 2, pp. 493-527, Sept. 1999.
48. R. Pastor-Satorras and A. Vespignani, "Epidemic spreading in scale-free networks," Physical Review Letters, vol. 86, p. 3200, 2001.
49. Z. Dezso and A.-L. Barabasi, "Halting viruses in scale-free networks," Physical Review E, vol. 65,p. 055103-(R), May 2002.
50. CascadeNet.jar and CascadeNet.html can be found on the website or accompanying disk.
51. http://www.paretolaw.co.uk/principle.html
52. San Lewis Rey is a virtual city in cyber-space where all bad things happen.
53. Program TreeLink, a.k.a RGB.html",4>RGB.html, is available on the website or the accompanying disk
54. Named after George Boole, 1815-1864, Ireland. Boolean variables A and B can take on only one of two values: true or false.
55. We interpret probability as a "partial truth," that is, a number between zero (FALSE) and 1.0 (TRUE),which measures the level of certainty that an event will occur. A probability of 50% means we are equally uncertain as to whether an event will occur. A probability of 25% means we are relatively sure that an event will not occur.
56. OK, so it is not so amusing when your bank account is overdrawn, but this real-world example serves to illustrate subtleties in even simple systems.
57. It is not necessary to perform manual calculations as done here. Program FTplus.html (FT.jar) computes event tree events automatically.
58. A truth table could be used instead. An event tree was chosen because it is visual-the reader can see all possible events produced by assuming each fault is alternately true and then false.
59. A combination event is an event made up of a single, double, or triple event all at the same time.
60. Perhaps now the reader realizes that a combination event is simply a single, double, triple, and so on combination of one, two, three, and so on threats.
61. An OR-tree is a tree with one OR gate connecting k threats to the root of the fault tree.
62. An AND-tree is a tree with one AND gate connecting k threats to the root of the fault tree.
63. Program FTplus.html, a.k.a FT.jar, described in Chapter 6, does much of the arithmetic needed to handle fault and event trees, which makes it possible to analyze fault/event trees containing thousands of events.
64. Sisma, Pavel, "Leonhard Euler and the Koenigsberg Bridges," Scientific American, pp. 66-70, July1953. http://mathforum.org/epigone/math-history-list/skodwendjerm
65. We will come back to this later: Isolated nodes and nodes of degree one are shown to have little impact on the resulting investment strategy.
66. These definitions will change for fault trees, because of AND/OR logic in the fault tree model.
67. In the case of a node with degree of one (a terminal node, for example), the amount of damage caused by its removal is less than the removal of its link, so the single-degreed node will lose points to its link.
68. Network Analysis also performs flow analysis, but this topic will not be covered here. See the Network Analysis User Guide for descriptions of other Network Analysis features.
69. NA.jar is the desktop version, NetworkAnalysis.html the Web version. NA.jar can save and open local disk files, but NetworkAnalysis.html cannot.
70. The users manual for NetworkAnalysis has many more details than provided here.
71. These examples can be found in the NetworkAnalysis software provided along with this book.
72. WASA is an example in the FTplus examples menu.
73. Small-world networks will contain critical clusters-neighborhoods of nodes that are critical.
74. This simplification is an approximation of reality, because we know it is more costly to eliminate the last 1% of vulnerability than the first 1%.
75. As mentioned, this may not be a valid assumption, but it is a simplification.
76. The program FTplus incorporates the optimal risk reduction technique described here.
77. Emergence is a random process, so the answer may vary from application to application. In this case,the author obtained an allocation of $1, $49, $2, and $48.
78. Of course we could also solve this problem using emergence, but whenever possible it is desirable to obtain a closed-form solution. Computers are fast and cheap, but humans are still more clever.
79. FTplus-also known as FT.jar-runs on the Web as FTplus and on the desktop as FT.jar.
80. Details of how to use FTplus and FT.jar are provided in the operations manual.
81. CARVER and Port Security Risk Assessment Tool (PSRAT) two examples that use some kind of ranking to determine which vulnerability or risk is greatest.
82. "Sharp corners" a result of functions with p1(12 p2)(12p3) terms, which when minimized tends to drive p1 to zero and p2, p3 to one. This causes the volume defined by p1(1 2p2)(12p3) to have "many zeros"-all indistinguishable from one another.
83. "25 Years of the Safe Drinking Water Act: History and Trends," EPA 816-R-99-007, December 1999, http://www.epa.gov/safewater/consumer/trendrpt.pdf
84. Understanding the Safe Drinking Water Act, December 1999, EPA 810-F-99-008. The EPA's Office of Ground Water and Drinking Water, website: http://www.epa.gov/safewater/
85. http://www.fda.gov/oc/bioterrorism/PL107-188.html#title4
86. http://www.WaterISAC.org, 1620 I Street, NW, Suite 500, Washington, D.C. 20006.
87. The October 17, 1989 Loma Prieta Earthquake, http://www.sfmuseum.net/alm/quakes3.html#1989
88. Memorandum to Tom Elzey, PUC General Manager from Art Jensen, Acting General Manager, November 21, 1989. Museum of the City of San Francisco.
89. http://Sfwater.org
90. Another network could be constructed that models the interdependencies of water, power, and agriculture,but we resist the temptation here.
91. "Hetch Hetchy Water and the Bay Area Economy," Bay Area Economic Forum, October 2002, http://www.bayeconfor.org/baefinfrastruct.htm
92. Strictly speaking, the exponent should lie between 2 and 3, but we do not need to be mathematically rigorous. Our purpose is to identify the most connected nodes.
93. "Hetch Hetchy Water and the Bay Area Economy," Bay Area Economic Forum, October 2002, http://www.bayeconfor.org/baefinfrastruct.htm
94. Robert E. Holman, "Cryptosporidium: A Drinking Water Supply Problem," Water Resources Research Institute of the University of North Carolina. Special Report No. 12, November 1993.
95. Phaedra S. Corso, Michael H. Kramer, Kathleen A. Blair, David G. Addiss, Jeffrey P. Davis, and Anne C. Haddix, "Cost of Illness in the 1993 Waterborne Cryptosporidium Outbreak, Milwaukee, Wisconsin,"Emerging Infectious Diseases, vol. 9, no. 4, April 2003.
96. Program FTplus, a.k.a. FT.jar, is available on the disk accompanying this book and on the course website.
97. J. R. Chiles, "Inviting Disaster: Lessons From the Edge of Technology," HarperBusiness, 2001, 2002.http://www.invitingdisaster.com
98. http://www.sss-mag.com/glossary/page4.html
99. Personal communication with Joe Weiss, April 2005.
100. http://niap.nist.gov/
101. http://www.it-isac.org/
102. ARC Advisory Group, http://www.ARCweb.com
103. Newton-Evans Research, Baltimore, MD, http://www.newton-evans.com
104. Only the apportioned risk reduction strategy is reported here. The others are left as an exercise for the reader.
105. A firewall is a computer that filters or blocks input and output data ports, thus restricting user access to a network or subnetwork.
106. In general we do not know the extent of damage that might be inflicted by a successful cyber-attack on some SCADA system.
107. Personal communication with Joe Weiss, April 2005.
108. http://www.utc.org/?v2_group 1/4 0&p 1/4 3629.
109. http://www.neuronet.pitt.edu/bogdan/tesla/bio.htm
110. http://www.ferc.gov/
111. T. Overbye, "Reengineering the Electric Grid," American Scientist, 88, 3, p. 220, May-June 2000.
112. W. F. Lloyd, Two Lectures on the Checks to Population, Oxford Univ. Press, Oxford, England, 1833,reprinted (in part) in Population, Evolution, and Birth Control, G. Hardin, Ed., Freeman, San Francisco,1964, p. 37.
113. G. Hardin, "The Tragedy of the Commons," SCIENCE, Vol. 162, 13, December 1968, http://www.sciencemag.org
114. U.S.-Canada Power System Outage Task Force, "Interim Report: Causes of the August 14th Blackout in the United States and Canada," November 2003.
115. http://www.esisac.com
116. To see an animation of real-time flow of electricity in the Eastern Power Grid, visit http://powerworld.com/Java/Eastern
117. Not always: It depends on the number and connectivity of the transmission links!
118. Sometimes SCALE-ON must take from one generator to give to another, which may not be possible when MAX-ON is set.
119. S.H. Strogatz, "Exploring Complex Networks," NATURE, vol. 410, March 2001, http://www.nature.com
120. Chapter 6 defines availability as (1 2p), where p is the fault probability associated with a vulnerability.
121. The program RNet is available from the disk or the website.
122. A.-L. Barabasi, "Linked: How Everything Is Connected To Everything Else and What It Means for Business, Science, and Everyday Life," PLUME, p. 119, 2003.
123. D.J. Watts and S. H. Strogatz, "Collective dynamics of 'small-world' networks," NATURE, 393, June 1998.
124. CS 3660 projects, Summer 2002.
125. This analysis follows from the event matrix discussion in Chapter 5.
126. The "missing" outcomes account for another 10% vulnerability.
127. Actually, the results in Figure 9.13 were obtained from a magnified version of Figure 9.4.
128. "Interim Report: Causes of the August 14th Blackout in the United States and Canada." November 2003, U.S.-Canada Power System Outage Task Force.
129. "Final Report on the August 14, 2003 Blackout in the United States and Canada: Causes and Recommendations," April 2004. U.S.-Canada Power System Outage Task Force, p. 12 (dated January 12, 2004).https://reports.energy.gov
130. http://www.aep.com
131. http://www.firstenergycorp.com
132. http://www.spectrum.ieee.org/WEBONLY/special/aug03/tline.html
133. A. Friedlander, "Power and Light: Electricity in the U.S. Energy Infrastructure 1870-1940," Corporation for National Research Initiatives, 1996, p. 51. request@cnri.reston.va.us
134. Personal communication with Joe Weiss.
135. http://www.eei.org/industry_issues/energy_infrastructure/natural_gas/index.htm
136. http://www.eei.org/industry_issues/energy_infrastructure/natural_gas/index.htm
137. According to Dr. Warren H. Hausman Stanford University, "The term supply chain refers to the entire network of companies that work together to design, produce, deliver, and service products."http://www.supplychainonline.com/cgi-local/preview/SCM101/1.html
138. http://www.eia.doe.gov/oiaf/aeo/index.html
139. http://www.pipeline101.com/History/index.html
140. C. J. Trench (ctrench@concentric.net), "How Pipelines Make the Oil Market Work-Their Networks,Operation and Regulation," A memorandum prepared for the Association of Oil Pipe Lines and the American Petroleum Institute's Pipeline Committee, December 2001, pp. 8-9. http://www.aopl.org
141. C.J. Trench (ctrench@concentric.net), "How Pipelines Make the Oil Market Work-Their Networks,Operation and Regulation," A memorandum prepared for the Association of Oil Pipe Lines and the American Petroleum Institute's Pipeline Committee, December 2001, http://www.aopl.org
142. C. J. Trench (ctrench@concentric.net), "How Pipelines Make the Oil Market Work-Their Networks,Operation and Regulation," A memorandum prepared for the Association of Oil Pipe Lines and the American Petroleum Institute's Pipeline Committee, December 2001, http://www.aopl.org, pp. 15-16.
143. National Petroleum Council, Meeting the Challenge of the Nation's Growing Natural Gas Demand, December 1999.
144. http://www.shellpipeline.com/cd_maps/SPL403_D_gc_crude_f.pdf
145. A red team consisting of two U.S. Navy officers, Charles Hurst and John Cardillo, two civilian analysts,Bill Brickner and Kristen Pearson, did this analysis.
146. Professors Brown and Carlyle, Operations Analysis, Naval Postgraduate School, Fall 2003.
147. At the time, the average pump price of gasoline was $1.50/gallon.
148. http://www.usdoj.gov/, April 1, 2003.
149. http://www.pipelinesafetyfoundation.org/
150. http://www.ops.dot.gov
151. A complete network analysis is left for the reader.
152. http://www.pipelinesafetyfoundation.org
153. http://www.whitehouse.gov/news/releases/2001/06/energyinit.html.
154. http://www.acmi.net.au/AIC/BELL_BIO.html
155. http://www-t.zhwin.ch/it/su/Block3/TelephoneHistory/history2.htm
156. http://www.att.com/history/history3.html
157. It may seem strange then that the Federal Government does NOT regulate the Internet, which is digital communication technology in the most precise definition of the phrase!
158. http://www.ncs.gov/n5_hp/Customer_Service/Brochures/35Anniversary/begina.htm
159. http://www.ncs.gov/n5_hp/Customer_Service/Brochures/35Anniversary/begina.htm
160. http://www.ncs.gov/cwin/
161. Datacomm Research Company, "Satellites in Cyberspace," http://www.researchandmarkets.com/ index.asp
162. Wireless World, pp. 305-308, October 1945.
163. http://www.hq.nasa.gov/office/pao/History/satcomhistory.html
164. http://roland.lerc.nasa.gov/dglover/sat/telstar.html
165. http://www.stratosglobal.com/caseStudies/usLawEnforcement.html
166. http://www.ieee.org/organizations/history_center/milestones_photos/telstar_ukri.html
167. http://www.ncafe.com/chris/pat2/
168. http://www.gsmcoverage.co.uk/maps/europe/gsm_cdma_map.jpg
169. http://www.mouthshut.com/readreview/34613-1.html
170. http://www.mouthshut.com/readreview/34613-1.html
171. http://www.bcr.com/bcrmag/2003/01/p11.asp
172. http://www.carrierhotels.com
173. Richard Clarke, March 13, 2002.
174. The president's National Security Telecommunications Advisory Committee, "Vulnerabilities Task Force Report Concentration of Assets: Telecom Hotels," February 12, 2003.
175. C. McDonough, "Identifying the risk involved in allowing wireless, portable devices into your company," SANS Institute, 2003, p. 6.
176. Jammers block access to a cell phone's radio tower by transmitting a high-powered signal on the same frequency, thus canceling the phone's signal. The result: a poor or erased signal.
177. M. Wylie, "Cell Phone Jammers, Illegal in U.S., Can Create Silent Zones," 2000. http://www.newhouse.com/archive/story1a092200.html
178. Encarta World English Dictionary # 1999 Microsoft Corporation. All rights reserved. Developed for Microsoft by Bloomsbury Publishing Plc.
179. http://www.ntia.doc.gov/ntiahome/dn/html/Chapter2.htm
180. According to Nielsen/NetRatings, there was a worldwide Internet population of 580 million users, as of 2002. The International Telecommunications Union estimates 665 million users.
181. An autonomous system (AS) is a collection of Internet routers and switches under a single administrative control, such as an ISP.
182. P. I. Bass and F. M. Bass, Modeling Diffusion of Technology Generations, Bass Economics Working Paper, 2001, http://www.basseconomics.com
183. K. Hafner and M. Lyon, "Where Wizards Stay Up Late: The Origins of the Internet," Simon & Schuster, New York, p. 304, 1996.
184. K. Hafner and M. Lyon, "Where Wizards Stay Up Late: The Origins of the Internet," Simon & Schuster, New York, p. 304, 1996, p. 20.
185. K. Hafner and M. Lyon, "Where Wizards Stay Up Late: The Origins of the Internet," Simon & Schuster, New York, p. 304, 1996, p. 38.
186. Paul Mockapetris2 of USC/ISI invents DNS with the help of Jon Postel and Craig Partridge in 1983.
187. An IP number corresponds to the network and specific machine that is connected to the network.
188. DNS machine locations are secret because they are the anchor of the Internet.
189. http://www.postel.org/postel.html
190. http://www.rfc-archive.org/
191. This is called CSMA/CD or Carrier Sense Multiple Access/Collision Detection.
192. Cisco Systems, one of the most successful companies to commercialize TCP/IP equipment, was founded in 1984 by Leonard Bosack and Sandra Lerner, who later sold their interests in the company for $170 million.
193. http://www.ibiblio.org/pioneers/andreesen.html
194. In 1999, AOL paid $10 billion in stock for 5-year-old Netscape.
195. It took 67 years for the public telephone to penetrate 50% of the homes in the United States.
196. It took 67 years for the public telephone to penetrate 50% of the homes in the United States1/4 Internet Engineering Task Force; IRTF 1/4 Internet Research Task Force.
197. http://www.faqs.org/rfcs/rfc3233.html
198. http://www.faqs.org/rfcs/rfc3710.html
199. D. Schiller, Digital Capitalism Networking the Global Market System, MIT Press, Cambridge, 2000.
200. http://www.icannwatch.org/
201. M. Mueller, Ruling the Root: Internet Governance and the Taming of Cyberspace, MIT Press,Cambridge, 2004.
202. http://www.circleid.com/channel/index/C0_1_1/
203. http://www.isoc.org/
204. http://www.w3.org/
205. J.I. Nieto-Hipolita, and J. M. Borcelo, "Analysis of Autonomous Systems," Technical Report: Computer Architecture Department, Polytechnic University of Catalonia, Barcelona, Spain, 2002.
206. The Example in Figure 12.6 can be found in the program NetworkAnalsys.html, a.k.a. NA.jar.
207. One can easily argue that the printing press was the most significant advancement in communications before the Internet.
208. http://www.gocsi.com
209. Script kiddies are amateurs out for fun and glory. Black-hats are serious professionals working for financial gain.
210. A worm is a self-activating program that spreads through a computer network like an epidemic.
211. C.J. Dunlevy, "Protection of Critical Infrastructures: A New Perspective," CERT Analysis Center, 2004, http://www.cert.org
212. Use the keyword "exploits" in a search engine such as http://www.google.com a very large number of cyber-threats will be retrieved.
213. A. Broder, R. Kumar, F. Maghoul, P. Raghavan, S. Rajagopalan, R. Stata, A. Tomkins, and J. Wiener,Computer Networks, 33, p. 309, 2000.
214. The Web is somewhat like most of the power grid in this respect.
215. M.E.J. Newman, S. Forrest, and J. Balthrop, "Email Networks and the Spread of Computer Viruses," Physical Review E, 66, 035101-(R), 2002.
216. MafiaBoy caused and estimated $1.7 billion in lost revenues, but its perpetrator was fined only $250 and sentenced to 8 months in jail.
217. Macros are written in Visual Basic and activated by the user whenever the document is loaded into an Office application.
218. SYN is short for synchronize and ACK is short for acknowledge-two hold-over signals from the days of teletypes and Western Union "e-mail" delivery.
219. Spoofing means that source address of packets returned from DNS are changed to something else, which changes the identity of the sender.
220. The registry is where Windows keeps the names and authorizations for every program that is allowed to run on a Windows machine.
221. A session and an application is almost identical, so hacking an open session is tantamount to hacking a running application.
222. http://www.avast.com
223. M.Vatis, "Cyber Attacks During the War on Terrorism: A Predictive Analysis," Institute for Security Technology Studies, Dartmouth College, September 22, 2001, 45 Lyme Road, Hanover, NH 03755,http://www.ists.dartmouth.edu/ISTS
224. J.A. Lewis, "Assessing the Risks of Cyber Terrorism, Cyber War and Other Cyber Threats," Center for Strategic and International Studies, Washington, D.C., December 2002. http://www.csis.org
225. http://www.gocsi.com
226. HR 4246 introduced into the 106th Congress, 2nd session, April 2000.
227. A trusted path is a mechanism by which a person using a terminal can communicate directly with the TCB.The TP can only be activated by the person or the TCB and cannot be imitated by untrusted software.
228. FIPS is the Federal Information Processing Standard.
229. Deciding whether a computer system is secure has been shown to be impossible, by mathematical logic.Consider the following paradox: Tom says, "Sally always tells the truth," and Sally says, "Tom always lies." Is Sally lying now? It is impossible to decide. In a similar fashion, system security can be shown to be undecidable.
230. Cracking is the process of illegally decoding ciphertext into plaintext.
231. Virtual Private Network. A network that uses the Internet rather than leased lines for connections. Security is guaranteed by means of a tunnel connection in which the entire TCP/IP packet (content and addresses) is encrypted and encapsulated.
232. LDAP-defined by the IETF-defines a relatively simple protocol for updating and searching directories running over TCP/IP.
233. A simple definition of cryptology is the study of secret messages.
234. http://library.thinkquest.org/27158/concept2_1.html
235. Moore's Law says processing speed doubles every 1.5 years. So, 1.5 _ 112 1/4 168.
236. J.Daemen and V. Rijmen, "AES Proposal: Rijndael, AES Algorithm Submission," September 3, 1999,http://www.nist.gov/CryptoToolkit
237. W. Diffie and M. Hellman, "New Directions In Cryptography," IEEE Transactions on Information Theory, vol. IT-22(6), pp. 644-654, November 1976.
238. C.Gimon, "The Phil Zimmerman Case," http://www.skypoint.com/members/gimonca/philzima.html
239. R.L. Rivest, A. Shamir, and L. Adelman, "On Digital Signatures and Public Key Cryptosystems," MIT Laboratory for Computer Science Technical Memorandum 82, April 1977.
240. Public key encryption uses numbers in excess of 200 digits long!
241. A prime number is a positive number that is divisible by one and itself only. Prime numbers can be found by computerized mathematical sieve techniques that take time proportional to the size of the prime number.
242. RSA.java can be found on the Web or the disk accompanying this book.
243. http://www.linktionary.com/p/pki.html
244. Defining boundaries among LDAP directories, authentication, and PKI is a moving target because these technologies seem to be merging into a comprehensive system of security.
245. R.D. Pethia, "Cyber security-Growing Risk from Growing Vulnerability," CERT, Software Engineering Institute, Carnegie Mellon University, Pittsburgh, PA. Testimony given before the House Select Committee on Homeland Security Subcommittee on Cybersecurity, Science, and Research and Development,June 25, 2003. http://hsc.house.gov/files/Testimony.pethia.pdf