Changing Domains - Cyber and Information Domains 2024 lecture.pdf

Outline
Definitions – Cyber and Domains
Case studies of Cyber and Info Attacks Other Than War
Lessons learned from recent Cyber / Info domain conflict
--
Cyberspace: A global domain within the information environment consisting of the interdependent networks of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.
Information warfare: Offensive and defensive actions in physical and virtual space that enable and protect the friendly force’s ability to access, process, and communicate information that also deny, exploit, corrupt or destroy an adversary force’s ability to use information.
Case studies
1. Vietnam Airport Hack
2. SingHealth data breach
3. Indonesia Ransomware Attack
4. Philippines DOST hack
Case study of Russia/Ukraine war
1. Russian government-backed attackers have engaged in an aggressive, multi-pronged effort to gain a decisive wartime advantage in cyberspace, often with mixed results.
2. Moscow has leveraged the full spectrum of IO – from overt state-backed media to covert platforms and accounts – to shape public perception of the war.
3. The invasion has triggered a notable shift in the Eastern European cybercriminal ecosystem that will likely have long term implications for both coordination between criminal groups and the scale of cybercrime worldwide.
Lessons learned
Defense against a military invasion now requires for most countries the ability to disburse and distribute digital operations and data assets across borders and into other countries.
Recent advances in cyber threat intelligence and end-point protection have helped Ukraine withstand a high percentage of destructive Russian cyberattacks.
As a coalition of countries has come together to defend Ukraine, Russian intelligence agencies have stepped up network penetration and espionage activities targeting allied governments outside Ukraine.
In coordination with these other cyber activities, Russian agencies are conducting global cyber-influence operations to support their war efforts.
This calls for a coordinated and comprehensive strategy to strengthen defenses against the full range of cyber destructive, espionage, and influence operations.

1. CHANGING DOMAINS:
THE CYBER/INFO
REALM
Benjamin Ang
Head,Centre of Excellence for National Security
and Future Issues in Technology / Digital Impact
RSIS, NTU

2. OUTLINE
•
Definitions –Cyber and Domains
•
Case studies of Cyber and Info Attacks Other Than War
•
Lessons learned from recent Cyber / Info domain conflict

3. WHAT ARE THE DOMAINS?
LAND : Earth’s
surface ending at the
high-water mark and
overlapping with the
maritime domain in
the landward
segment of the
littorals.
SEA: The oceans,
seas, bays, estuaries,
islands, coastal
areas, and the
airspace above these,
including the littorals.
AIR: The atmosphere,
beginning at the
Earth’s surface,
extending to the
altitude where its
effects upon
operations become
negligible.
SPACE : The area
above the altitude
where atmospheric
effects on airborne
objects become
negligible.
DOD Dictionary of Military and Associated Terms, January 2021, Accessed May 17, 2021
from https://www.jcs.mil/Portals/36/Documents/Doctrine/pubs/dictionary.pdf?ver=2019-05-29-162249-290

4. DEFINITIONS
Cyberspace (US DOD)
•A global domain within
the information
environment consisting
of the interdependent
networks of
information technology
infrastructuresand
resident data, including
the Internet,
telecommunications
networks, computer
systems, and
embedded processors
and controllers.
Cyber or network
warfare (wangluozhan
网
络战)(PLA)
•Takes place in “network
space (wangluo
kongjian;
网
络空间)”
e.g.,command and
control network,
intelligence,
information network,
air defense, logistic
networks
Information Warfare
(US DOD)
•Offensive and defensive
actions in physical and
virtual space that
enable and protect the
friendly force’s ability
to access, process, and
communicate
information that also
deny, exploit, corrupt
or destroy an
adversary force’s
ability to use
information.
InformationizedWarfare
(xinxihuazhanzheng;
信
息化
战争) (PLA)
•System-of-systems
conflict involving the
use of informationized
weapons and
associated tactics e.g.
information gathering,
communications,
command and control,
weapons, logistics
•Includes electronic
combat, computer
network combat,
psychological warfare,
https://www.slideshare.net/benjaminang

5. EMERGING TECHNOLOGY
(US DOD 2023 STRATEGY)
Artificial Intelligence (AI) and
Machine Learning (ML)automating threat detection
improving response times
predicting potential cyber threats
analyzing large datasets
Quantum Computing
computational power
making communications more
secure
break adversaries’ encryption
Internet of Things (IoT)
enhance situational awareness and
operational efficiency
collect and transmit data in real-
time, for decision-making
https://www.slideshare.net/benjaminang

6. CONTRASTS
Information DomainCyber DomainConventional Domains
Information operations
Psychological operations
Non-physical e.g. DDOS,
jamming, malware
Nature: Physical combat
on land, sea, air
Influence, disrupt,
undermine
Disrupt infrastructure,
disrupt info, steal info
Objective: Capture
territory, destroy enemy
Propaganda, narratives,
disinformation, influence
Malware, bot networks,
phishing
Tools: Troops, tanks,
ships, aircraft
Hidden by proxies
Can be micro-targeted
Attackers stay hidden
Identity can be spoofed
Visibility: Subject to
camouflage
Law is not clear about
civilian targets
Law is not clear about
civilian targets
Targets: Should be
military, under IHL
https://www.slideshare.net/benjaminang

7. GOALS OF CYBER
ATTACKS: C, I, A
Confidentiality
Integrity
CIA Triad
Availability
Confidentiality
-Data breach (SingHealth)
-Trade secrets
Integrity
-Software (Solarwinds)
-Nuclear power plant
(Stuxnet)
Availability
-Ransomware or
wiperware(NotPetya)
-DDOS

8. Source: Md Faizal, G
Haciyakupoglu, J Yang, D
Leong, YL Teo, B Ang,
Countermeasures Against
Foreign Interference,
RSIS Policy Report
Definition
•
Foreign interference
occurs when a
foreign entity (state
or non-state actor),
•
with hostile intent,
•
takes actions to
deliberately,
covertlyand
deceptively
•
disruptthe politics
and policies of the
target state
RSIS FRAMEWORK OF INFORMATION,
INFLUENCE, AND INTERFERENCE

9. FIRELAND
EXAMPLE OF A CYBER DOMAIN ATTACK
WATERLAND
(not aware)
AIRLAND
INFECTED
INFECTED
We’ve been
cyber-attacked!
Where did it come
from?
The malware
must have
come from
WATERLAND!
https://www.slideshare.net/benjaminang

10. FIRELAND
PROBLEM: ATTRIBUTION IS RISKY
WATERLAND
(not aware)
AIRLAND
INFECTED
INFECTED
WATERLAND, if you
attacked us, we willtake
countermeasures
against you!
We’re
innocent!
Ha haha
(evil
laughter)

11. CASE STUDIES OF
CYBER AND INFO
INCIDENTS OTHER
THAN WAR

12. FOREIGN
INTERFERENCE:
POLITICAL LEADERS

13. FOREIGN INTERFERENCE:
RELIGIOUS LEADERS

14. CONSPIRACY CAMPAIGNS ONLINE

15. DISCUSSION: WHAT DO
YOU THINK ABOUT
THESE CYBER DOMAIN
INCIDENTS AND
RESPONSES
Difficulty of attribution?
Lack of capacity to impose consequences?
Diplomatic
Informational
Military
Economic
Financial
Intelligence
Legal
Power imbalance or trade dependence?

16. CASE 1. VIETNAM AIRPORT
•
Airport screens defaced with
political messages
•
Cyberattack by 1937CN?
1
•
1937CN denied responsibility
•
Vietnam Government tells
cyber community to show
restraint after attack
2

17. CASE 2.
SINGHEALTH
BREACH
SINGHEALTH Hack: Personal data
of 1.5 million patients, including
Prime Minister Lee
3
“Deliberate, targeted and well-
planned cyber attack … not the
work of casual hackers or criminal
gangs"
4
“We are not able to reveal more
because of operational security
reasons”
5

18. CASE 3: INDONESIA
RANSOMWARE
ATTACK
•
National data centrehit by ransomware
•
230 government agencies affected
•
Governmentrefusedtopayransom
•
Hackers later gave the key and
apologized

19. CASE 4:
PHILIPPINES
DOST HACK
•
Breach of Department of Science and
Technology (DOST) systems
•
Locked DOST out of their systems
•
2-terabyte worth of data, including
research plans, designs and schematics
•
2
nd
attack defaced websites
•
DICT deployed NCRT, National Computer
Response Team
•
Blamed on hacktivist groups #opEDSA and
Hulksec

20. DISCUSSION: WHAT DO YOU THINK ABOUT
THESE INCIDENTS AND RESPONSES
•
1. Vietnam Airport
•
2.SingHealth
•
3.Indonesia Ransomware Attack
•
4. Philippines DOST hack

22. WHAT LESSONS CAN
WE LEARN FROM
RECENT CYBER/INFO
DOMAIN CONFLICT?

23. CASE STUDY: RUSSIA V UKRAINE
•
Source: Fog of war: how the Ukraine conflict transformed the cyber threat landscape, published
by Google TAG (Threat Analysis Group)
•
Overview
•
1. Russian government-backed attackers have engaged in an aggressive, multi-pronged effort
to gain a decisive wartime advantage in cyberspace, often with mixed results.
•
2. Moscow has leveraged the full spectrum of IO –from overt state-backed media to covert
platforms and accounts –to shape public perception of the war.
•
3. The invasion has triggered a notable shift in the Eastern European cybercriminal ecosystem
that will likely have long term implications for both coordination between criminal groups and
the scale of cybercrime worldwide.

24. 1. MULTI-
PRONG CYBER
TACTICS
•
Russian government-
backed attackers have
engaged in an aggressive,
multi-pronged effort to
gain a decisive wartime
advantage in cyberspace,
often with mixed results.
9/17/2024 24

25. MULTI-TACTIC
AND TARGET
•
Spear phishing (targeted emails) up 250% in Ukraine,
up 300% in NATO countries in 2022
•
Destructive attacks on gov / mil / critical
•
Hack and leak (of sensitive info)
•
Android apps pretending to be DDOS weapons
9/17/2024 Sample Footer Text25

26. MULTI TACTIC
AND TARGET
Media: To plant false information
Energy provider, shipping and trains: To disrupt
Drone manufacturer: To disable weapons
26

27. MULTI COUNTRY
Targets included think tanks,
nuclear research labs, NGOs
27

28. MULTI-PHASE TIMELINE
2019 –JAN
2022
2019 –JAN
2022
•Cyber
espionage +
Pre-
positioning
FEB –APR 2022FEB –APR 2022
•Destructive
ops (wipers)
+ Military
invasion
MAY –JUL 2022MAY –JUL 2022
•Sustained
targeting
(wipers)
AUG –SEP 2022AUG –SEP 2022
•Maintaining
footholds
OCT –DEC 2022OCT –DEC 2022
•Renewed
destructive
attacks
(ransomware,
wipers)
28
Attackers need months
to setup access before
launch attacks, then
they lose access

29. MICROSOFT
STOPS
STRONTIUM
The Strontium group was
targeting Ukrainian institutions,
media organizations, and
government institutions and think
tanks in the United States and the
European Union
Microsoft got court orders 16
times to redirect internet traffic
from Strontium domains into a
‘sinkhole’
Sample Footer Text29

30. DISCUSS: WHAT LESSONS CAN WE LEARN
ABOUT CYBER DOMAIN CONFLICT?

32. 2. FULL SPECTRUM
INFORMATION
OPERATIONS
•
Moscow has leveraged the
full spectrum of IO –from
overt state-backed media
to covert platforms and
accounts –to shape public
perception of the war
1.
Undermine the Ukrainian
government
2.
Fracture international
support for Ukraine; and
3.
Maintain domestic
support in Russia for the
war.
9/17/2024 32

33. TYPES OF INFO OPS
Russian IO focused
on domestic
audiences
•Spikes before
military activity
•Narrative of
“De-Nazification”
IO actors using
overt and covert
methods
•Fake accounts,
news sites,
YouTube
•Telegram groups
•Duplicate sites
Resurgence of
hacktivists
•Linked to Russian
intelligence

34. DEEPFAKES

35. CYBER CRIMINALS
INVOLVED
Ransomware gangs leaked Personal
Identification Information (PII) of soldiers
and government officials
9/17/2024 35

36. MSN, META, TIKTOK BLOCK SPUTNIK

37. DISCUSS: WHAT LESSONS CAN WE LEARN
ABOUT INFORMATION DOMAIN CONFLICT?

39. WRAP UP
DEFENDING THE CYBER/INFO DOMAIN
•
Sources: Defending Ukraine: Early Lessons from
the Cyber War (Microsoft)*
1.
Defenseagainst a military invasion now
requires for most countries the ability to
disburse and distribute digital operations
and data assets across borders and into
other countries.
2.
Recent advances in cyber threat intelligence
and end-point protection have helped
Ukraine withstand a high percentage of
destructive Russian cyberattacks.
3.
As a coalition of countries has come together
to defend Ukraine, Russian intelligence
agencies have stepped up network penetration
and espionage activities targeting allied
governments outside Ukraine.
4.
In coordination with these other cyber
activities, Russian agencies are conducting
global cyber-influence operations to support
their war efforts.
5.
This calls for a coordinated and
comprehensive strategy to strengthen
defensesagainst the full range of cyber
destructive, espionage, and influence
operations.

40. DEFENCE LESSONS, IN DEPTH
Distribute digital
ops and assets
globally
•Attackers bombed
data centres
Good defences can
stop cyberattacks
•Cyber threat
intelligence
•Connected end-point
protection
Allies also need
defence
•NATO countries
•Denmark, Norway,
Finland, Sweden,
Turkey

41. DEFENCE LESSONS, IN DEPTH
New tools are
needed to stop IO
•AI, new analytics
tools, data sets, and
experts to track and
forecast
Coordinated
response needed
•Governments
•Tech companies
•Civil society
•Academia
ACICE (ADMM
Cyber Info Centre
of Excellence) and
Digital Defence
Symposium (DDS)

42. DEFENDING FROM INFO OPS
•
Public coverage and exposure
•
Clear counter-messages
•
Legislation
•
Build media and digital literacy
•
Work with citizens, influencers
•
Detect and expose fake accounts
Active measures
•
Work strategically, not reactively
•
Build a strong narrative that is more
attractive than the adversary

43. WHAT ARE YOUR
TAKEAWAYS?