US Government Computer Penetration Programs And The Implications For .
[3B2-9]man2012030004.3d9/8/01212:54Page 4US Government ComputerPenetration Programs andthe Implications for CyberwarEdward HuntCollege of William & MaryThe US Department of Defense was the driving force behind the development of sophisticated computer penetration methodologies. Byanalyzing the security of the nation’s time-sharing computer systems,security analysts developed an expert understanding of computerpenetration. Eventually, the US and its intelligence agencies utilizedcomputer penetration techniques to wage offensive cyberattacks.In January 2011, the journalists WilliamBroad, John Markoff, and David Sangerreported in the New York Times that a computer worm called Stuxnet, ‘‘the most sophisticated cyberweapon ever deployed,’’ hadcaused significant delays to Iran’s nuclear enrichment program.1 ‘‘The sheer size of thecode was staggering,’’ reported Sharon Weinberger in Nature, noting that Stuxnet featured‘‘some 15,000 lines of code, representing anestimated 10,000 person hours in software development.’’2 A team of security analysts atthe software company Symantec, which published a thorough technical analysis of thecyberweapon, believed that ‘‘Stuxnet is ofsuch great complexity—requiring significantresources to develop—that few attackers willbe capable of producing a similar threat.’’3Given the cyberweapon’s capability to implement ‘‘direct-attack attempts on critical infrastructure,’’ the Symatec analysts concludedthat ‘‘Stuxnet is the type of threat we hopeto never see again.’’3US President Barack Obama came to a different conclusion after the initial public disclosure of the Stuxnet weapon. According to thejournalist David Sanger, President Obama ‘‘decided that the cyberattacks should proceed.’’4In fact, Obama had ‘‘secretly ordered increasingly sophisticated attacks on the computersystems that run Iran’s main nuclear enrichment facilities,’’ expanding a covert programcode-named Olympic Games that had begunduring the Bush administration.4Of course, American involvement shouldcome as no surprise, particularly sinceRichard Clarke and Robert Knake had4IEEE Annals of the History of Computingacknowledged in 2010 in their book CyberWar that the US ‘‘has perhaps led [theworld] in cyber espionage and the creationof cyber war tools’’ and today ‘‘very likelypossesses the most sophisticated offensivecyber war capabilities.’’5 As an example,Clarke and Knake pointed to the ‘‘maliciouscode’’ that the Central Intelligence Agency(CIA) had created in the early 1980s to sabotage the trans-Siberian pipeline in the SovietUnion, leading to ‘‘the most massive nonnuclear explosion ever recorded, over threekilotons.’’6Interestingly, the attack against theSoviets, unknown to the world until only afew years ago,7 coincided with anothermajor report in the New York Times in late1983 by William Broad, who sought to implicate the Soviets as a major threat to US computer security. According to Broad, Reaganadministration officials had suspected thatin 1981 ‘‘the Russians managed, by gettingonto an international computer network, tobreak into two large private computers inthe West.’’8 The allegations, which leadingexperts quickly dismissed as sensational9and that now appear tame compared to theattack against the Soviet pipeline, suggestthat the US has indeed led the world in thecreation of cyberwar tools. In his article,Broad nicely summarized the groundbreaking US efforts to assess computer securityvulnerabilities:[T]echnical threats . . . were first described indetail in the early 1970s by Dr. [Willis] Wareof the RAND Corporation . . . The [Ware]Published by the IEEE Computer Society1058-6180/12/ 31.00 2012 IEEEc
[3B2-9]man2012030004.3d9/8/01212:54Page 5report showed how spies could actively penetrate computers, steal or copy electric files andsubvert the devices that normally guard topsecret information.The study touched off more than a decadeof quiet activity by elite groups of computerscientists working for the Government whotried to break into sensitive computers. Theysucceeded in every attempt.8Undoubtedly, Broad meant to describe theefforts made by ‘‘government’’ scientists tounderstand the threats to US systems, alwayswith the hope of improving their security. Atthe time, few analysts openly suggested thatthe ‘‘careful insertion of a few well-writtentrap doors and Trojan horses into the software (or wired into the hardware) of computers sold to potentially hostile countrieswould be a reliable and virtually undetectableintelligence asset,’’ as Navy Lieutenants PeterGrant and Robert Riche had done in July1983.10 For the most part, specialists fromacademia, government, industry, and themedia remained silent about the use of computer subversion as a weapon.In recent years, a few noticeable exceptions to the continuing silence haveappeared in the popular media. In the late1990s, the journalist David Fulghum highlighted the US government’s growing interestin cyberwar in his numerous reports for Aviation Week & Space Technology. In one article,Fulghum described how the US had used‘‘[o]ffensive computer warfare . . . as a precision weapon during the Kosovo conflict’’ in1999.11 A radar specialist at the Pentagonhad informed Fulghum that the US had probably ‘‘put false targets into [Serbia’s] air defense network through its communicationslinks.’’11 John Arquilla, an associate professorat the Naval Postgraduate School and an analyst at RAND, similarly informed the PBS series Frontline for its 2003 episode ‘‘CyberWar!’’ that ‘‘some means may have beenused to distort the images that the Serbianintegrated air defense systems were generating.’’12 Arquilla also hinted that ‘‘we didsome things to the systems of the Iraqis’’ during the first Gulf War.12 In fact, Fulghum hadreported in November 1999 that senior military officials had confirmed that the penetration of a country’s air defense system ‘‘wasfirst attempted against Iraq during the1990–91 Persian Gulf war.’’13A series of articles in the New York Timesfrom mid-2009 highlighted the Obamaadministration’s interest in cyberwar, atopic that reached ‘‘religious intensity,’’according to military historian DanielKuehl.14 Some of ‘‘the latest in attack software . . . was developed by cryptologists atthe N.S.A. [National Security Agency],’’ journalists Corey Kilgannon and Noam Cohenreported, making it no secret that the agencyfeatured ‘‘most of the government’s talent forbreaking and making computer codes.’’15Christopher Drew and John Markoff alsoreported that US military and intelligenceagencies had turned to contractors such asRaytheon, Northrop Grumman, and GeneralDynamics to develop offensive capabilities.12Nevertheless, few analysts have ever comprehensively described the US’s cyberwar capabilities, perhaps ‘‘because so much of thesubject matter is secret,’’ as Clarke andKnake reasonably speculated in their bookCyber War.16The emphasis on secrecy has changed little over the years, especially among thoseinvolved in the highest levels of securityanalysis. In the early 1970s, leading analystsRoger Schell and Paul Karger complainedthat ‘‘most reports of [computer] penetrations have severe (and often unjustified)distribution restrictions leaving very fewdocuments in the public domain.’’17 Decadeslater, another highly respected securityexpert, Clark Weissman, still found ‘‘generalaccess to this past experience . . . oftenrestricted.’’18 Not until the mid-1990s did security specialist Mathew Bishop successfullyorganize and distribute a collection of theearly, landmark computer security studies.19Bishop’s collection, supported by numerousacademic papers already in the public domain, offers an illuminating look into theearly history of the creation of cyberwartools. According to Bishop, ‘‘virtually all ofthe important papers were produced undergovernment contract.’’19 Indeed, the recordssuggest that the defense establishment,which includes the Department of Defense(DoD) and its closely linked allies in industryand academia, engineered many of the techniques used to break into computers systemsthrough a constant stream of securitytesting.20In this article, I have attempted to providemeaningful academic research into this earlyhistory, hoping to establish a more open dialogue, just as Clark and Knake called for intheir book Cyber War.21 More specifically, Iintend to show that the defense establishment pioneered and created many of thetools used in modern day cyberwarfare.22July–September 20125
[3B2-9]man2012030004.3d9/8/01212:54Page 6US Government Computer Penetration Programs and the Implications for CyberwarNotes on Secondary LiteratureScholars have basically ignored the formativerole played by the defense establishment inthe development of subversive computertechniques, leaving only a few exceptions inthe literature. By the mid-1970s, computercrime had even become a serious topic of interest, leading to several popular books onthe subject. Having documented close to400 computer-related crimes, Donn Parkerof the Stanford Research Institute (SRI) highlighted some of the more sensational incidents in his 1976 book Crime by Computer.Although Parker acknowledged the existenceof ‘‘professional computer penetrators whotest the security of computer systems,’’ hebarely explored their findings, focusingmore on the acts committed by civilians.23In the 1978 book Computer Capers, journalistThomas Whiteside reinforced much ofParker’s alarmist narrative, although Whiteside suggested that computer criminals whobroke into government or corporate systems‘‘have not employed highly sophisticatedapproaches.’’24 Instead, Whiteside foundthat ‘‘the more advanced techniques . . . perhaps observable in various exercises . . . havebeen carried out within the defense establishment.’’24 Officially sanctioned teams of security analysts attempted to ‘‘penetrate some ofthe most complex and supposedly securecomputer systems,’’ he reported.25 In onecase, Whiteside referred to a study completedby the Naval Research Laboratory (NRL) thatdetailed ‘‘the successful, covert subversion ofa Univac 1108 Exec VIII operating system’’utilized by the military.26 The NRL penetration team had easily exploited a design problem publicly documented by Univac toembed trap doors in the system, grantingthe team covert access to encrypted, classified information. In spite of the obviousquestions that might have arisen about theoffensive potential of such practices, analystssuch as Donn Parker instead turned the spotlight on the alleged criminals, who he introduced to the media as ‘‘hackers.’’Throughout the 1980s, scholars continuedto ignore official penetration programs, especially as the popular media sensationalizedthe hacker phenomenon. Parker had relayedthe hacker concept to the popular media inan interview with Time magazine in August1983, warning about ‘‘a whole epidemic ofmalicious system hacking’’ taking place.27Of course, Parker had also noted in his 1983book Fighting Computer Crime that ‘‘there isno proof of a system hacker epidemic.’’286IEEE Annals of the History of ComputingInstead, the miscreants, as he describedthem, ‘‘flare up from time to time,’’ givingthem the characteristics of ‘‘a disease.’’29Offering an altogether different perspective on hackers, the journalist Steven Levyromanticized their origins in his 1984 bookHackers. According to Levy, the idealist programmers consisted of ‘‘adventurers, visionaries, risk-takers, [and] artists’’ who shared‘‘a common philosophy . . . of sharing, openness, decentralization, and getting yourhands on machines at any cost—to improvethe machines, and to improve the world.’’30Undoubtedly, Levy held the minorityview, even among scholars. In late 1985,law scholar Diana Smith contributed an article to the Criminal Justice Journal, asking,‘‘Who is calling your computer next?Hacker!’’ Seizing upon a common view inthe media, Smith described the typical hackeras ‘‘a high school dropout of better than average intelligence’’ who attempted to ‘‘accessthe computer networks of large corporations’’ as a sort of intellectual challenge.31‘‘Certainly, the hackers are the ones with expert capabilities,’’ Smith claimed.32 Just a couple of years later, one journalist writing forthe New York Times went even further,describing hackers as ‘‘electronic terrorists’’who used Trojan horses to corrupt computerdata.33 In spite of such sensational propaganda about the mysterious and amorphoushackers,34 the increased attention on computer vulnerabilities led to far more seriousconsideration of potential security threats.For anyone seriously interested in assessingsecurity vulnerabilities, officially sanctionedstudies provided a reasonable starting point.The security analysts Deborah Russell andG.T. Gangemi, Sr. offered a rare glimpseinto some of the early, publicly funded studies in their 1991 book Computer SecurityBasics. Notably, the authors described keyevents from the 1960s and 1970s that hadled to the creation of tiger teams, or ‘‘government- and industry-sponsored teams ofcrackers who attempted to break down thedefenses of computer systems in an effort touncover, and eventually patch, securityholes.’’35 The authors even attributed thehacker practice of probing systems for vulnerabilities to the formally developed ‘‘tigerteam methodology.’’36In late 1993, Wayne Madsen, a security specialist with ties to the NSA, offered a far morecautionary perspective about government andindustry involvement. In an article publishedby the International Journal of Intelligence and
[3B2-9]man2012030004.3d9/8/01212:54Page 7Counter-Intelligence, Madsen warned about‘‘state-sponsored and corporation-initiateddigital eavesdropping schemes’’ initiated bynations all over the world, including theUS.37 The threat of the ‘‘often youthfulhacker’’ paled in comparison to the ‘‘dedicated and well-financed intelligenceagencies,’’ Madsen believed.38Today, Pentagon officials would likelyagree, believing that ‘‘the most-sophisticatedcomputer attacks require the resources of agovernment,’’ according to a recent reportby Siobhan Gorman and Julian E. Barnes inthe Wall Street Journal.39 In their report, thejournalists noted that officials believed that‘‘the weapons used in a major technologicalassault, such as taking down a power grid,would likely have to be developed withstate support.’’39Clearly, a hostile government with vastamounts of resources at its disposal poses amore serious threat to system security thanany of the so-called computer hackers. Nevertheless, few scholars have explored the US defense establishment’s offensive capabilities.The leading scholar on the history of computer security, Donald MacKenzie, discussedmany of the early, officially sanctioned security studies in a chapter of his 2001 bookMechanizing Proof, but he largely ignored theformative role that the publicly funded tigerteams had played in creating successful penetration techniques.40 ‘‘RAND had done somepenetration studies (experiments in circumventing computer security controls) of earlytime-sharing systems on behalf of the government,’’ he only briefly acknowledged.41 Jeffrey Yost of the Charles Babbage Instituteoffered a similarly abbreviated account inhis 2007 article, ‘‘A History of Computer Security Standards.’’ According to Yost, ‘‘theRAND Corporation, and its spin-off, . . . theSystem Development Corporation (SDC) . . .[had] engaged in some of the first so-called‘penetration studies’ to try to infiltrate timesharing systems in order to test their vulnerability.’’42 Like MacKenzie, Yost focused hisnarrative on the development of computer security and standards. A number of leadingpenetration experts, including Roger Schell,acknowledge that even ‘‘today the subversionthreat is rarely discussed’’ by security analysts,never mind historians.43In recent months, the issue of subversionhas taken on special urgency, especiallysince the Wall Street Journal reported in mid2011 that computer subversion ‘‘comingfrom another country’’ could lead ‘‘theA hostile governmentwith vast amounts ofresources at its disposalposes a more seriousthreat to system securitythan any so-calledcomputer hackers.U.S. to respond using traditional militaryforce.’’39 With military officials threateningto ‘‘put a missile down one of your smokestacks’’ in response to a cyberattack, it has become increasingly important to understandthe cyber capabilities of the US as well.39Penetration DefinedThe available documentary record indicatesthat in June 1965, the SDC, a major government contractor with roots in the US AirForce and RAND,44 hosted one of the earliest,most influential conferences on computer security. Held in Santa Monica, California, theevent united some of the country’s leadingcomputer experts, who represented institutions such as IBM, RAND, and the LawrenceRadiation Laboratory. At the time, Robertvon Buelow, the Head of Laboratory Development and Operations Staff at SDC, explicitly warned his colleagues about the securityof time-sharing computer systems, whichgranted external users access to their resources through communications lines. RAND’sWillis Ware repeated von Buelow’s warning,describing the unauthorized access of dataas ‘‘the big problem with time-shared systems.’’45 In fact, SDC had recently convertedits IBM Q-32 computer into a time-sharingsystem.With the security implications in mind,SDC officials instructed one of their‘‘experts’’ to ‘‘[s]it down and figure out allthe ways you think you might be able to violate memory protection.’’46 Before long,SDC’s expert had discovered more than adozen ways to undermine the Q-32’s safeguards. As a possible long-term solution,von Buelow envisioned an official agencythat would one day collect and distribute information about ‘‘all the ways a system canJuly–September 20127
[3B2-9]man2012030004.3d9/8/01212:54Page 8US Government Computer Penetration Programs and the Implications for Cyberwarbe violated.’’46 Even more important, theconference marked one of the first occasionswhen the country’s leading computer expertstogether requested ‘‘studies to be conductedin such areas as breaking security protectionin the time-shared system.’’47Shortly after the Santa Monica conference,security specialists introduced the ‘‘languageof penetration’’ to describe an attack againsta computer system. Ware, who headedRAND’s Computer Sciences Department,organized a special paper session on computer security for the Spring 1967 Joint Computer Conference, hoping to engage thebroader user communities. Alongside his colleagues Harold Petersen and Rein Turn, bothof RAND, and Bernard Peters of the NSA,Ware warned that ‘‘deliberate attempts topenetrate’’ both military and nonmilitarysystems ‘‘must be anticipated.’’48 Petersenand Turn agreed, citing ‘‘deliberate penetration’’ as a major risk to ‘‘remotely accessibleon-line, time-shared information systems.’’49In particular, Peters argued that ‘‘a penetrating program’’ could potentially compromise‘‘large amounts of information’’ stored intime-sharing systems.50Ware later credited these newly open discussions about security threats to the highlysecretive NSA, which had taken a special interest in time-sharing technology. Since1964, Ware had sat on the NSA’s ScientificAdvisory Board, a collection of the nation’spremier technological experts from government, industry, and academia.51 Throughhis connections, he had grown familiarwith ‘‘the development within the NationalSecurity Agency (NSA) of a remote-accesstime-sharing system, . . . running on a Univac494 machine, and serving terminals andusers not only within the [NSA] headquartersbuilding . . . but also worldwide.’’52 Withthese types of systems in mind, Ware andhis colleagues had grown increasingly concerned that the country’s ‘‘systems mightnot be able to protect themselves and theirdata against intrusive and destructiveattacks.’’52In addition to introducing the threat ofcomputer penetration at the Spring 1967conference, Ware’s special session establishedthe foundation for security research, including the most fundamental methods of breaking into computer systems. Communicationslines ‘‘are the most vulnerable part of the system,’’ Petersen and Turn noted in a paper atthe conference, citing ‘‘the well-developedart of listening in on voice conversations.’’538IEEE Annals of the History of ComputingSimilarly, Ware warned that eavesdropperscould bug a system, enabling them ‘‘to pirateinformation.’’54 A more sophisticated attack,Ware believed, involved an ‘‘ingenious userwho skillfully invades the software system,’’making changes that ‘‘give him ‘ins’ to normally unavailable information.’’55 Petersenand Turn described these special entry pointsas trap doors, or covert channels that granted‘‘unscrupulous programmers’’ access to a system.56 In a pair of comprehensive tables,Petersen and Turn outlined their recommended countermeasures as well as numerous other threats, such as browsing forrestricted files, masquerading as legitimateusers, and piggy-backing into a system.57Ware depicted the possible points of attackin a special diagram in one of his papers,which included a systems programmer incorporating covert ‘‘ins’’ into a system.58A few years after the conference, Turnreflected that the RAND papers had ‘‘established much of the vocabulary’’ for computersecurity research.59 By 1972, at least 30reports and articles had reviewed the samethreats and safeguards.59Questions about SecurityEven before the spring 1967 conference,computer programmers and electronic specialists had well understood the risks associated with time-sharing systems. In the mid1960s, IBM and Remington Rand Univachad feared that competitors would attemptto monitor the information that the twocompanies transmitted through their systems. Both companies had considered hiringa ‘‘decoy computer programmer’’ to transmitfalse, misleading data.60A month prior to the conference, theWashington Post had reported that ‘‘a SenateJudiciary Committee eavesdropping expert’’believed that time-sharing systems wouldsoon play an influential role in industrial espionage.61 A few years after the WashingtonPost’s report, one computer programmeraccessed confidential data stored in a competitor’s time-sharing system, marking oneof the earliest documented cases of computerpenetration.52 The programmer relied on asimple method, taking a little over a monthto guess the commands necessary to accessthe targeted information.63The security problem gained perhaps itsmost widespread attention when officials ata small company called Information SystemsDesign (ISD) discovered an unauthorized usermasquerading as a client in the company
[3B2-9]man2012030004.3d9/8/01212:54Page 9system, copying a program.64 ISD soonlinked the breach to Hugh Jeffery Ward, acomputer programmer working for a competitor, the University Computing Company(UCC). Reporting on the incident in March1971, one local newspaper ran the headline,‘‘Computer’s Secrets Stolen by Telephone.’’65The Paris edition of the International HeraldTribune more sensationally declared, ‘‘Computer Raped by Telephone.’’65 A defense lawyer for the UCC offered a more likelyexplanation, suggesting that programmersat both companies routinely tapped intoeach others’ systems, just as officials at IBMand Remington Rand Univac had foreseen.66As the security issue gained more prominent attention, the US government, actingprimarily through the Pentagon, initiatedthe first major study into time-sharing system security. Essentially, US officials wantedto know if they could safely sell unclassified,commercial access to systems that alsohosted classified information.67 With RANDselected to ‘‘provide the leadership’’ on theproject, DoD officials tapped Ware to chaira specially organized task force.68 An impressive array of experts from the CIA, NSA, Massachusetts Institute of Technology (MIT),ARPA, and Lockheed joined the project,including SDC’s Robert von Buelow. Overthe course of the study, the task force focusedon what it called ‘‘the most difficult securitycontrol situation,’’ namely, ‘‘a time-sharingsystem serving geographically distributedusers’’ that processed ‘‘the most sensitiveinformation.’’69Drawing upon the papers that Ware andhis colleagues presented at the spring 1967conference, the task force reaffirmed manyof the same threats, such as wiretaps andtrap doors. In one case, the task force speculated that ‘‘covert monitoring devices canbe installed within the central processor,’’ atechnique ‘‘easy for a knowledgeable person’’to accomplish, making ‘‘detection very difficult.’’70 Additionally, the task force warnedabout loopholes, or inadequacies in a system’ssoftware. A cleverly exploited loophole couldlead to ‘‘a security breach, a suspension ormodification of software safeguards (perhapsundetected), or wholesome clobbering of internal programs, data, and files,’’ the taskforce speculated.71 Although US officials classified the ‘‘Ware Report’’ at the time of its initial publication in February 1970, computerspecialist Peter Browne openly described it as‘‘the definitive document’’ on computer security in a 1972 bibliographic paper.72Theories of AttackAfter the task force completed its detailed investigation into the many threats to online systems, a number of organizations within thedefense establishment began formally developing their penetration techniques and strategies.In the same month that the media sensationalized the Ward case, RAND published a secret,ARPA-sponsored penetration study.73 Duringthe study, a team of RAND researchers had informed ARPA that it could demonstrate a penetration by crashing a targeted system orsending unauthorized messages to that system’s terminals.74 Another team of RAND analysts, including Rein Turn, summarized theresults in a follow-up paper, observing thatthe ‘‘relatively small ARPA-sponsored RANDeffort demonstrated the ease of penetratinga large computer system,’’ even if it featuredsupposedly adequate safeguards.75In a second, more challenging test,RAND’s penetration team succeeded in stealing system passwords and installing a trapdoor, all without detection.76 During the exercises, RAND team members James Anderson,Richard Bisbey, and Dennis Hollingworthhad ‘‘demonstrated the practicality of systempenetration as a tool for evaluating . . . datasecurity safeguards,’’ Turn noted in yet another paper.77 Furthermore, RAND specialistR. Fredrickson had initiated a related programinto ‘‘[t]he further development of systempenetration techniques,’’ hoping to develop‘‘tools for security system certification.’’78ARPA sponsored these efforts through initiatives such as the Computer Security Assurance project, which involved ‘‘test[ing] asystem[’s] security through penetration.’’79Turn, Fredrickson, and Hollingworth allbelieved that penetration testing offered several benefits that justified its study, suchas the penetrator’s ‘‘diabolical frame ofmind . . ., which is difficult to emulate’’with other testing methods.80 They recommended the ‘‘development of methodologyand tools’’ to test system security, including‘‘penetration test techniques’’ and ‘‘aids topenetration test data management and analysis.’’81 Although Turn, Fredrickson, and Hollingworth supported the development ofpenetration methodologies for the purposesof security testing, they also foresaw computerpenetration ‘‘as an extension of electronicwarfare,’’ a potentially major weapon thatgovernments could use to gather intelligenceor crash systems ‘‘at critical moments.’’82The US Air Force (USAF), RAND’s leadingsponsor, wasted little time in taking advantageJuly–September 20129
[3B2-9]man2012030004.3d9/8/01212:54Page 10US Government Computer Penetration Programs and the Implications for Cyberwarof the company’s pioneering efforts, whichWare later described as ‘‘a vigorously growingseed’’ planted ‘‘for others to nourish.’’83 Inmid-1971, the USAF Electronic Systems Division contracted with James P. Anderson &Co. to analyze the security of its Data ServicesCenter (ACS) at the Pentagon, a major systemthat serviced six organizations involving hundreds of people.84,85 The USAF required that itssystem, which consisted of a Honeywell 635computer and GECOS III operating system,provide secure access to ‘‘users located virtually anywhere,’’ similar to the NSA system.Based on his analysis of the ‘‘opportunitiesto mount a penetration attack,’’ Andersonwarned about a number of penetration scenarios that could compromise the Honeywellsystem.86 By using a secondary computer torelay commands through an unknowing, legitimate user, a penetrator could engage in‘‘a convincing dialog with the user’’ while‘‘simultaneously inject[ing] the attack program [in]to the system,’’ Anderson warned.87This ‘‘store and forward’’ attack, just one ofmany, represented a specific phase of whatAnderson more generally outlined as an ‘‘attack sequence.’’88 The approach involved several prearranged steps, including, ‘‘1. Find anexploitable vulnerability. 2. Design an attackaround it. 3. Test the attack. 4. Seize a linein use for ACS Operations. 5. Enter the attack.6. Exploit the entry for information recovery.’’88 Before implementing the attack, penetrators would also have to collect intelligenceon the targeted system, including the ‘‘exactlocation(s) of unclassified terminals, phonenumbers and actual lines used, location ofjunction boxes and other places taps can beplaced, details of security measures thatexist, table of organization,’’ and other measures.88 Similar to the Ware report and someearly RAND exercises, US officials classifiedAnderson’s study, which added to the growing body of secret work on penetration.In early 1972, the USAF again contractedwith Anderson’s company, requesting thatit produce a plan for addressing the USAF’sunresolved security problem. By organizinga special study panel similar to the taskforce, the USAF united a smaller team ofexperts from business, government, and industry, including the NSA, Mitre, SDC, andCase Wes
velopment of sophisticated computer penetration methodologies. By analyzing the security of the nation's time-sharing computer systems, security analysts developed an expert understanding of computer penetration. Eventually, the US and its intelligence agencies utilized computer penetration techniques to wage offensive cyberattacks.
Assessment, Penetration Testing, Vulnerability Assessment, and Which Option is Ideal to Practice? Types of Penetration Testing: Types of Pen Testing, Black Box Penetration Testing. White Box Penetration Testing, Grey Box Penetration Testing, Areas of Penetration Testing. Penetration Testing Tools, Limitations of Penetration Testing, Conclusion.
The in-place penetration test using the laser particle counter is a measurement of the penetration of the total filtration system. This test incorporates the aerosol penetration from both the HEPAfilter and leaks in the filter housing or gaskets. In separate filter penetration and leak tests, the total penetration of the filtration
Open Web Application Security Project (OWASP) National Institute of Standards and Technology (NIST) Penetration Testing Execution Standard (PTES) What is PTES? PTES, penetration testing execution standard, as the name implies is an assessment methodology for penetration testing. It covers everything related to a penetration test.
network-layer penetration test and application-layer penetration tests. There was a short informational supplement released in 2008 by the PCI Council on penetration testing, but its guidance was very general and still left much room for interpreting what a penetration test rea
Parma Magica: Add 5 x Parma Magica Ability Takes 2 minutes to cast, lasts until sunset or sunrise. Penetration Bonus: Penetration Ability x (1 Arcane Connection Penetration Bonus Penetration Total: Casting Total Penetration Bonus – Spell Level
A quality penetration test provider will understand how a penetration test will help you meet your compliance requirements. A simple test of the vendor can quickly help you ferret out companies who do not understand your specific compliance needs. PCI DSS If you are required by the PCI DSS to perform penetration testing, ask the penetration test
Penetration testing also helps an organization determine how susceptible or resilient to attack it really is. The process of penetration testing involves a great deal of time and dedication to ensure a positive outcome for both the penetration tester and the organization being evaluated. Comparing penetration testing to other real-world types .
ACCOUNTING 0452/22 Paper 2 May/June 2019 1 hour 45 minutes Candidates answer on the Question Paper. No Additional Materials are required. READ THESE INSTRUCTIONS FIRST Write your Centre number, candidate number and name on all the work you hand in. Write in dark blue or black pen. You may use an HB pencil for any diagrams or graphs. Do not use staples, paper clips, glue or correction fluid. DO .
