Foreword |
|
xiii | |
Acknowledgments |
|
xxxv | |
Introduction |
|
xxxv | |
|
Chapter 1 State of the Advanced Cyber Threat |
|
|
1 | (22) |
|
Have You Heard About the APT? |
|
|
2 | (1) |
|
|
2 | (1) |
|
What Makes a Threat Advanced and Persistent? |
|
|
3 | (4) |
|
Examples of Advanced and Persistent Threats |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
12 | (1) |
|
Byzantine Hades/Foothold/Candor/Raptor |
|
|
13 | (1) |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
16 | (2) |
|
New Generation of Botnets and Operators |
|
|
18 | (1) |
|
|
19 | (1) |
|
|
20 | (3) |
|
Chapter 2 What Is Deception? |
|
|
23 | (28) |
|
How Does Deception Fit in Countering Cyber Threats? |
|
|
24 | (1) |
|
Six Principles of Deception |
|
|
25 | (1) |
|
|
25 | (1) |
|
|
26 | (1) |
|
Centralized Planning and Control |
|
|
26 | (1) |
|
|
26 | (1) |
|
|
27 | (1) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
28 | (2) |
|
Demonstrations---Dorchester Heights |
|
|
30 | (1) |
|
Ruses---Operation Mincemeat (the Unlikely Story of Glyndwr Michael) |
|
|
30 | (1) |
|
Displays-A Big Hack Attack |
|
|
31 | (4) |
|
|
35 | (2) |
|
The First US Army Group Deception |
|
|
37 | (2) |
|
|
39 | (1) |
|
|
40 | (1) |
|
"Magruder's Principle"---Exploitation of a COG's Perception or Bias |
|
|
40 | (1) |
|
"Limitations to Human Information Processing" |
|
|
41 | (1) |
|
"Multiple Forms of Surprise" |
|
|
42 | (1) |
|
|
42 | (1) |
|
"Choice of Types of Deception" |
|
|
42 | (1) |
|
"Husbanding of Deception Assets" |
|
|
43 | (1) |
|
|
43 | (1) |
|
|
43 | (1) |
|
"Beware of Possible Unwanted Reactions" |
|
|
43 | (1) |
|
"Care in the Design of Planned Placement of Deceptive Material" |
|
|
44 | (1) |
|
Understanding the Information Picture |
|
|
44 | (1) |
|
|
45 | (1) |
|
|
46 | (1) |
|
|
46 | (2) |
|
|
48 | (1) |
|
|
48 | (1) |
|
|
49 | (1) |
|
|
49 | (2) |
|
Chapter 3 Cyber Counterintelligence |
|
|
51 | (34) |
|
|
52 | (11) |
|
Applying Counterintelligence to the Cyber Realm |
|
|
63 | (1) |
|
Sizing Up Advanced and Persistent Threats |
|
|
64 | (1) |
|
Attack Origination Points |
|
|
65 | (2) |
|
Numbers Involved in the Attack |
|
|
67 | (1) |
|
|
68 | (1) |
|
|
69 | (1) |
|
|
70 | (2) |
|
|
72 | (1) |
|
|
73 | (1) |
|
|
74 | (1) |
|
|
75 | (9) |
|
|
84 | (1) |
|
Chapter 4 Profiling Fundamentals |
|
|
85 | (36) |
|
A Brief History of Traditional Criminal Profiling |
|
|
87 | (3) |
|
The Emergence of Cyber Profiling |
|
|
90 | (2) |
|
Acquiring an Understanding of the Special Population |
|
|
92 | (5) |
|
The Objectives of Profiling |
|
|
97 | (1) |
|
|
98 | (2) |
|
|
100 | (3) |
|
Two Logical Approaches to Profiling: Inductive vs. Deductive |
|
|
103 | (1) |
|
Information Vectors for Profiling |
|
|
104 | (1) |
|
|
104 | (2) |
|
|
106 | (2) |
|
|
108 | (1) |
|
|
109 | (2) |
|
|
111 | (2) |
|
Socially Meaningful Communications and Connections |
|
|
113 | (4) |
|
|
117 | (1) |
|
|
117 | (4) |
|
Chapter 5 Actionable Legal Knowledge for the Security Professional |
|
|
121 | (16) |
|
How to Work with a Lawyer |
|
|
123 | (2) |
|
What You Should Know About Legal Research |
|
|
125 | (1) |
|
|
126 | (3) |
|
|
129 | (2) |
|
The Role of Statutes in Our Legal System |
|
|
131 | (1) |
|
|
131 | (1) |
|
Do Your Background Homework |
|
|
132 | (1) |
|
|
133 | (1) |
|
Communicating with Lawyers |
|
|
134 | (1) |
|
|
134 | (2) |
|
|
136 | (1) |
|
Chapter 6 Threat (Attacker) Tradecraft |
|
|
137 | (34) |
|
|
138 | (2) |
|
|
140 | (3) |
|
|
143 | (4) |
|
Opportunistic Turning Targeted |
|
|
147 | (1) |
|
|
148 | (4) |
|
|
152 | (2) |
|
Criminal Tools and Techniques |
|
|
154 | (1) |
|
|
154 | (5) |
|
|
159 | (2) |
|
|
161 | (3) |
|
|
164 | (6) |
|
|
170 | (1) |
|
Chapter 7 Operational Deception |
|
|
171 | (28) |
|
|
173 | (4) |
|
|
177 | (3) |
|
|
180 | (3) |
|
|
183 | (4) |
|
|
187 | (1) |
|
|
187 | (4) |
|
|
191 | (1) |
|
|
192 | (1) |
|
|
193 | (4) |
|
|
197 | (1) |
|
|
198 | (1) |
|
Chapter 8 Tools and Tactics |
|
|
199 | (50) |
|
|
201 | (1) |
|
|
202 | (1) |
|
|
203 | (1) |
|
|
203 | (1) |
|
Security Management Tools |
|
|
204 | (1) |
|
|
205 | (1) |
|
|
206 | (1) |
|
Intrusion Detection/Prevention Systems |
|
|
207 | (1) |
|
|
207 | (2) |
|
|
209 | (11) |
|
Honeynets as Part of Defense-in-Depth |
|
|
220 | (1) |
|
Research vs. Production Honeynets |
|
|
221 | (2) |
|
|
223 | (2) |
|
|
225 | (1) |
|
|
226 | (3) |
|
|
229 | (1) |
|
|
230 | (1) |
|
|
230 | (1) |
|
Honeynet Risks and Issues |
|
|
231 | (2) |
|
Check Yourself Before You're Wrecked |
|
|
233 | (1) |
|
What's the Status of Your Physical Security? |
|
|
234 | (1) |
|
How Does Your Wireless Network Look? |
|
|
234 | (2) |
|
What's Traveling on Your Network? |
|
|
236 | (2) |
|
What About Your Host/Server Security? |
|
|
238 | (3) |
|
|
241 | (2) |
|
How's Your Operational Security? |
|
|
243 | (2) |
|
Crimeware/Analysis Detection Systems |
|
|
245 | (1) |
|
What Happened on Your Box? |
|
|
245 | (1) |
|
What Did That Malicious Software Do? |
|
|
246 | (1) |
|
|
247 | (2) |
|
Chapter 9 Attack Characterization Techniques |
|
|
249 | (32) |
|
Postincident Characterization |
|
|
250 | (2) |
|
|
252 | (1) |
|
|
253 | (1) |
|
|
254 | (1) |
|
|
255 | (1) |
|
|
256 | (1) |
|
Engaging an Active Threat |
|
|
256 | (9) |
|
Traffic, Targets, and Taxonomy |
|
|
265 | (13) |
|
|
278 | (1) |
|
|
279 | (2) |
|
Chapter 10 Attack Attribution |
|
|
281 | (40) |
|
A Brief Note About Levels of Information Present in Objects |
|
|
283 | (2) |
|
|
285 | (1) |
|
|
285 | (2) |
|
|
287 | (11) |
|
|
298 | (6) |
|
|
304 | (3) |
|
|
307 | (1) |
|
Strategic Application of Profiling Techniques |
|
|
308 | (1) |
|
Example Study: The Changing Social Structure of the Hacking Community |
|
|
308 | (4) |
|
Micro-and Macro-Level Analyses |
|
|
312 | (1) |
|
The Rise of the Civilian Cyber Warrior |
|
|
313 | (1) |
|
|
314 | (2) |
|
Potential Civilian Cyber Warrior Threats |
|
|
316 | (1) |
|
|
317 | (1) |
|
|
318 | (3) |
|
Chapter 11 The Value of APTs |
|
|
321 | (18) |
|
|
322 | (1) |
|
|
323 | (1) |
|
|
324 | (1) |
|
|
325 | (2) |
|
|
327 | (2) |
|
The Operation Aurora Case |
|
|
329 | (4) |
|
|
333 | (1) |
|
APTs and the Internet Value Chain |
|
|
333 | (1) |
|
|
334 | (1) |
|
|
335 | (2) |
|
|
337 | (2) |
|
Chapter 12 When and When Not to Act |
|
|
339 | (26) |
|
Determining Threat Severity |
|
|
340 | (1) |
|
Application Vulnerability Scenario |
|
|
341 | (1) |
|
|
341 | (1) |
|
What to Do When It Hits the Fan |
|
|
342 | (1) |
|
|
342 | (1) |
|
|
343 | (1) |
|
Distinguishing Threat Objectives |
|
|
344 | (1) |
|
Responding to Actionable Intelligence |
|
|
345 | (1) |
|
|
346 | (1) |
|
Distinguishing Between Threats |
|
|
346 | (11) |
|
Processing Collected Intelligence |
|
|
357 | (1) |
|
Determining Available Engagement Tactics |
|
|
358 | (1) |
|
|
359 | (1) |
|
|
359 | (1) |
|
External to Your Enterprise |
|
|
360 | (1) |
|
Working with Law Enforcement |
|
|
361 | (1) |
|
To Hack or Not to Hack (Back) |
|
|
361 | (1) |
|
|
362 | (1) |
|
Understanding Lines (Not to Cross) |
|
|
363 | (1) |
|
|
363 | (2) |
|
Chapter 13 Implementation and Validation |
|
|
365 | (28) |
|
|
366 | (3) |
|
|
369 | (1) |
|
Vetting Perceptual Consistency in a Deception |
|
|
370 | (2) |
|
|
372 | (3) |
|
Putting This Book to Use with Aid from Professionals |
|
|
375 | (2) |
|
|
377 | (1) |
|
|
378 | (12) |
|
|
390 | (3) |
Glossary |
|
393 | (10) |
Index |
|
403 | |