Tracking and Tracing Cyber-Attacks: Technical Challenges ...
Tracking and Tracing
Cyber-Attacks:
Technical Challenges
and Global Policy
Issues
Howard F. Lipson, Ph.D.
?
CERT Coordination Center
November 2002
SPECIAL REPORT
CMU/SEI-2002-SR-009
Pittsburgh, PA 15213-3890
Tracking and Tracing
Cyber-Attacks:
Technical Challenges
and Global Policy
Issues
CMU/SEI-2002-SR-009
Howard F. Lipson, Ph.D.
?
CERT Coordination Center
November 2002
Networked Systems Survivability Program
Unlimited distribution subject to the copyright.
This work is sponsored by the U.S. Department of State. The Software Engineering Institute is a
federally funded research and development center sponsored by the U.S. Department of Defense.
Copyright 2002 by Carnegie Mellon University.
Requests for permission to reproduce this document or to prepare derivative works of this document should be
addressed to the SEI Licensing Agent.
NO WARRANTY
THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS
FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO,
WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED
FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF
ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
Internal use. Permission to reproduce this document and to prepare derivative works from this document for internal use is
granted, provided the copyright and "No Warranty" statements are included with all reproductions and derivative works.
External use. Requests for permission to reproduce this document or prepare derivative works of this document for external
and commercial use should be addressed to the SEI Licensing Agent.
This work was created in the performance of Federal Government Contract Number F19628-00-C-0003 with
Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research
and development center. The Government of the United States has a royalty-free government-purpose license to
use, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do
so, for government purposes pursuant to the copyright license under the clause at 252.227-7013.
Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder.
For information about purchasing paper copies of SEI reports, please visit the publications portion of our Web
site ().
?
CERT and CERT Coordination Center are registered in the U.S. Patent and Trademark Office.
Table of Contents
Acknowledgements ...............................................................................................vii
Abstract...................................................................................................................ix
Part I: Technical Challenges in Tracking and Tracing Cyber-Attacks ..................1
1
Introduction .....................................................................................................3
2
A Brief History of the Internet .........................................................................5
3
A Brief Tutorial on Internet Technology .........................................................7
4
Problems with Internet Security .....................................................................9
5
Shortfalls in the Current Internet Environment ...........................................13
5.1 The Internet was never designed for tracking and tracing user
behavior ..................................................................................................13
5.2 The Internet was not designed to resist highly untrustworthy users .........13
5.3 A packet¡¯s source address is untrustworthy, which severely hinders
tracking....................................................................................................14
5.4 The current threat environment far exceeds the Internet¡¯s design
parameters ..............................................................................................15
5.5 The expertise of the average system administrator continues to
decline.....................................................................................................16
5.6 Attacks often cross multiple administrative, jurisdictional, and national
boundaries ..............................................................................................16
5.7 High-speed traffic hinders tracking ..........................................................17
5.8 Tunnels impede tracking..........................................................................18
5.9 Hackers destroy logs and other audit data...............................................18
5.10 Anonymizers protect privacy by impeding tracking ..................................18
5.11 The ability to link specific users to specific IP addresses is being lost......18
5.12 Purely defensive approaches will fail, so deterrence through tracking
and tracing is crucial................................................................................20
6
Example: A ¡°Smurf¡± IP Denial-of-Service Attack.........................................23
CMU/SEI-2002-SR-009
i
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related searches
- stars tracking and reporting system nyc
- hra substance abuse tracking and reporting
- problems and challenges in education
- substance abuse tracking and reporting
- cyber scams and frauds
- substance tracking and reporting system
- number tracing and writing printable
- benefits and challenges of outsourcing
- transient cerebral ischemic attacks and related syndromes
- stars tracking and reporting system
- ett tracking and tracing
- asset tracking and inventory management