Stuxnet Virus And Enterprise Security Essay.

Tthe authority would like to know more about what happened around the incident focusing on Software/Application, Physical Security, and Operational Control. The authority would also like to know what HA/DR options would prevent/mitigate Stuxnet, or any future hostile actions that might jeopardise the programme.

The programme chief is also worried about the possibility of an Air Strikes by hostile parties. As a result, the Russian and the Chinese proposed their versions of their Anti-Air system, the S-300 and the HQ18 respectively. (assume S-300 and HQ18 have the same effectiveness)

The authority is impressed by your performance in your first assignment. Not only that you have passed probation, but is now the Lead Enterprise Architecture responsible for the security of Iranian nuclear research programme.

1. Explain,in your own words, based on what we have learned thus far in the course, what Stuxnet  (Focus on Application/Software, Operation/Incident Management and Physical Security). Explain why regular anti- virus solution failed, and how the virus jumped the “Air-Gap”.

2. Whileyour boss is happy with your effort on the overall Qualitative Risk analysis you presented in Assignment 1, you are now asked to focused on Physical Security (one aspect only) using Quantitative Risk Analysis technique. Use the following table:

Total Cost of the Nuclear Programme (Asset Value)	1000	Million, $
In case of a successful Air Strike, expected loss:	500	Million, $
Successful air strike happens once in	20	Years
By installing S300 Missiles, the Exposure factor is reduced by a factor of	10
By installing S300 Missiles, the occurrence of successful air strike would reduce by	50%
The S300 yearly cost is (ACS, Annual Cost of Safeguard)	15	Million, $
The Chinese HQ18 yearly cost is (ACS, Annual Cost of Safeguard)	7.5	Million, $

Find out:

1. What is the Exposure Factor (EF, in%)
2. What is the Single Loss Expectancy (SLE, in$)
3. What is the Annualised Rate of Occurrence(ARO)
4. What is the Annualised Loss Expectancy(ALE)
5. What is the Exposure Factor with S300 in place?(EF_S300)
6. What is the Single Loss Expectancy with S300 in place?(SLE_S300)
7. What is the Annualised Rate of Occurrence with S300 in place?(ARO_S300)
8. What is the Annualised Loss Expectancy with S300 in place?(ALE_S300)
9. What is the Value of the Russian Safeguard(S300)?
10. What is the Value of the Chinese Safeguard(HQ18)?
11. Should the programme implement the S300 or HQ18?Why?

3. Uponlistening to the presentation by Machines for Business, International (MBI) and Mensies Corporation, as well as your analysis, the authority decided that they will implement TOGAF, since the C4ISTAR is primarily a NATO standard, and that TOGAF is more open. (Later on, a more security focused SABSA will also be implemented, for now, they need an overall Enterprise Architecture first)

Which one of the following best describes the TOGAF standard?

• A framework and method for architecturedevelopment
• An architecturepattern
• A businessmodel
• A method for developing TechnologyArchitectures
• A method for IT Governance What does ADM stand for inTOGAF.

What are the basic structure of the ADM cycle?

TOGAF which is primarily focused on commercial implementation. With a bank, for example, the requirements could look something like:

1. Compliance with federal and statelegislation,
2. Public confidence in your enterprise by providing confidentiality, availability and integrity of customerdata,
3. Privacy of customerdata,
4. Interoperation with other financial institutions, both nationally andinternationally,
5. Compliance with international standards,
6. Security of all bankassets,
7. Current trends in customer engagement via the internet What are the likely requirements in OURscenario?

4. In the movie “Contact”, S.R. Hadden said, “First rule in government spending: why build one when you can havetwo at twice the price? Only, this one can be kept  Controlled by Americans, built by the Japanese subcontractors.”

Would this “have two, for twice the price” option be a valid HA/DR option in a case? Under what circumstances is this valid? Under what circumstances is it not valid? If implemented, is this a Cold Site, Warm Site, Hot Site, Mobile Site or is this irrelevant? Comment and justify.

The Impact of Stuxnet Virus

The term enterprise is associated with a company or an organization that operates to achieve a certain goal or an objective while security is concerned with protection of data and information against external attacks or unauthorized access  Soomro, Shah & Ahmed (2016). Enterprise security is the process of securing information and data of a certain business or an organization against any form of attacks such as virus and trojan horses. The field of enterprise security has become one of the major vast problems that have been encountered by the companies and organizations that deal with big data Terzi, Terzi & Sagiroglu (2015). Also, the new trends in networking such as Internet of Things(IOT) have contributed vastly to the complexity of securing the data and information of an organization. In addition, the introduction to the modern complicated systems has contributed immensely to the susceptibility of these systems to external attacks. There are many categories of enterprise security such as physical security that deals with protection of data and information alongside machines and other business assets from destruction Wells, Camelio, Williams & White (2014). The main aim of this paper is to discuss in detail about Stuxnet that is a computer worm. Also, the paper explains the reasons why controlling of Stuxnet failed and how it propelled over the air-gap. Besides, the paper concentrates much on the following three topics; software, operation management and physical security in respect to Stuxnet.

Stuxnet is a computer virus that was discovered in late 2010. It was believed that this virus was aimed at attacking Iran as a country Singer (2015). This virus can attack computers that cannot be accessed from the internet. These computers are referred to as air-gapped computers. They are isolated from the internet hence cannot be connected to other computers. This virus targeted computers that were used by the government of Iran to develop a nuclear weapon. The core objective of the Stuxnet virus was to prolong the action of nuclear weapons. In addition, it was revealed that the virus could cause a great destruction to the targeted computers. Even though the virus targeted Iran, it was reported that the impacts of the virus were felt in other countries across the world  Singer (2015). This virus was aimed at manipulating the industrial systems such as water management systems. The structure of Stuxnet is very complicated in nature. The virus was detected by Belarus antivirus firm.

Enterprise Security and Stuxnet Virus

The systems that are used to manage industries commonly referred to as Industrial control systems (ICS) are governed by a series of instructions in programmable logic controllers (PLCs). These instructions are created basing on the windows operating systems Falliere, Murchu & Chien (2011). First and foremost, the intruders need to gather some information about the targeted system with an aim of determining the series of instructions that are used to design and develop the targeted system. There are two ways in which the attackers can obtain these information that includes using of spywares or approaching one of the programmers of the system to reveal the set of instructions that are used Falliere et al.(2011). Then, the hackers need to design and develop a Stuxnet virus using the set of instructions that have been obtained. Necessary components need to be established such as peripherals and PLCs for testing the functionality of the virus. The entire process may be completed after a period of about 24 weeks.

Then, some files are included into the virus with an aim of preventing the users of the system from detecting the changes that have been made in their original code. The attacker needs to access the digital certificates that must be modified to achieve this process of hiding

changes in the code Falliere et al.(2011). Afterwards, the virus needs to be inserted into the targeted computers which can be done by an insider through the USB. Once applied, the virus can then spread to other computers that are connected in a Local Area Network (LAN). The virus is controlled and managed by a server. The series of instructions that were initially programmed are changed, and subsequently the modifications are then hidden from the sight of system users. However, the virus can affect other systems that are not targeted early on by attackers because of characteristics of the virus to duplicate itself (Falliere et al.(2011).  

Physical security is concerned with the process of protecting human beings alongside many other assets such as buildings against physical attacks. There are many examples of physical attacks such as earthquakes and fire Karnouskos (2011). Most of the modern systems such as train and power management systems are controlled using a computer system that is vulnerable to attacks. The main reason for incorporating computer software into the modern systems is to enhance automation and the ease of carrying out some activities using these systems. In addition, computer related systems facilitate communication between various departments within an organization to take place with a lot of ease, hence increasing the co-ordination in these departments Karnouskos (2011). Following these developments, any modern industrial system can be affected by the computer viruses and worms. There are many computer viruses such as multipartite and boot, although this paper focus much on the impact of Stuxnet virus that emerged in the year 2010    on the modern systems.

Software and Enterprise Security

The Stuxnet virus aims at interrupting the industrial systems by changing the set of instructions that are used to develop the system by programmers and developers thus interfering with the entire functioning of the software Nourian & Madnick (2015). Therefore, this virus can influence an software like the Microsoft windows or the software installed in the computer to carry out an activity or a task in a different way rather than the way it was initially programmed. The modification of these series of instructions in Programmable Logic Controllers (PLCs) results in unusual functioning of the industrial systems. These modifications are very small to be identified by the system users, although they are sometimes realized after a long period Edwards (2014). In addition, these modifications are hidden from the sight of the users. The report from the recent researches on the field of security and technology has revealed that Iran is one of the countries that have been affected greatly with Stuxnet worm alongside India and Indonesia. Also, the report revealed that the Stuxnet virus was developed by the group of experts that were highly skilled in the field of security.

To the physical security, Stuxnet infringes the physical security of the system or the computer, taking the files and security credentials, this has really affected the physical security of the systems as the hence the systems can be easily hacked and manipulated.

An incident management is associated with the process of protecting the computer system against both the external and internal attacks. Incident management not only deals with the protection of computer systems but also the protection of people alongside their properties and buildings from attacks Allen, Karanasios & Norman (2014). Some of the ways that are used to protect a computer system against external attacks includes the use of firewall that prevents unauthorized programs from accessing the computer, installation of an antivirus that protects the computer against virus attacks and the deployment of access control mechanisms like the use of passwords to access the system. Similarly, people can be protected against any form of disasters that may be likely to occur very soon. There are many types of disasters ranging from natural to pandemic disasters. Tsunami and diseases are some of the examples of natural and pandemic disasters respectively alongside other examples Apvrille, Roudier & Tanzi (2015). Disasters are very destructive in nature when they occur. This is because they are unpredictable hence, they can take place at the time that one is least expecting. However, it has been revealed that Stuxnet virus can be used to prevent some disasters that are encountered by human beings especially the military attacks as explained below.

Operational Control and Enterprise Security

Basically, an air gap is associated with computers that have been separated from the internet and therefore, cannot be accessed or interact with other computers. These computers are protected from any form of attacks and unauthorized access Lendvay (2016). The intruders and hackers can only gain access to a computer that has been connected to the internet. However, these computers can be accessed only by using external storage tools like the USB and flash disks. For instance, Iran was developing a nuclear weapon using the air-gapped computers that could have been very harmful to the lives of many people in the world. Unfortunately, the Stuxnet virus infected their computers, hence increased the time taken by the nuclear weapon to exploit Lendvay (2016). The virus aimed at increasing the time for explosion to make Iran government into believing that it cannot develop a nuclear weapon. These Stuxnet viruses were developed by US and Israel. These two countries got the information about the codes that were used to develop the nuclear weapon. It is believed that there was a person within Iran who inserted the USB that contained the viruses into the air-gapped computers.      

There are many reasons that contributed to the undetected nature of the Stuxnet Virus. This

virus was not discovered for a period of more than one year by the antivirus solutions Karnouskos (2014). The virus was examined using all the available antivirus solutions before it was applied to the computers in Iran. In addition, the virus was still new, so it was not incorporated into the antivirus solutions through updating the solutions Karnouskos (2014). The rootkit was incorporated into the virus development process; hence it was not easy to be detected by the antivirus solutions. The virus was very complicated in nature as it had the following features:

• The virus used zero-day exploits which is a weakness in a certain software that has not yet been discovered by the experts and developers.
• The virus has the capability of infecting the PLCs that are targeted only.
• The ability to identify other computers that are connected with a LAN.
• The activities of this virus take place in computer memory, therefore, preventing any objects that can be traced to show that the virus is existing within the system.
• The virus has the ability of updating automatically.
• The virus has the capability of keeping the track of all infections that it has caused to the targeted computers.
• The compromised digital certificates are used to hide the changes that have been made in the code.
• It has the ability of changing its scale automatically enabling the computer to spread the virus to the maximum of about three computers only.
• The virus conceals itself under the legit applications of the computer system.
• The virus utilizes all the antivirus solutions; hence cannot be detected by these solutions as a result .  

Currently, there is no any antivirus that can protect a system against Stuxnet attacks. Also, the antivirus cannot detect the presence of Stuxnet virus because of its nature of hiding the

changes in the code Hills (2016). However, this virus can only be prevented using the following methods:

• Using of redundancy in LANs to detect errors in the functionality of the system. Redundancy is the ability of making several instances of the same object so that it can be used in case the system has developed some problems with its functioning.
• The application of user control mechanisms to the systems. This can be implemented through authentication methods such as username and password, although biometrics is the most preferred way. The users that can log in to the system are validated before gaining access to the system, hence preventing unauthorized people like intruders and hackers from entering into the system without the consent of system users.
• The systems can be separated from the internet. This can protect the system from hacking attacks. The computers that are connected to the internet are susceptible to attacks that can lead to an attacker gaining some access to an important and confidential information regarding the company and an organization.  
• Disabling computer ports from functioning. Examples of computer ports include USB and HDMI ports. This can prevent the transferring of the virus into the computer systems via the computer ports .
•  

It’s believed that the complexity of the industrial systems will increase in some

years to come. A system will be made of independent complicated components that are connected and synchronized to achieve a certain goal or purpose Chang, Kuo & Ramachandran (2016). These systems will not only increase their processing power, but also their functionality will increase because of synchronization. Also, the major trends in the field of Information Technology (IT) such as the cloud computing technology will be more advanced and adopted by all the companies and the organizations. Besides, the management of these systems will be very easy, although they will be very sensitive. The systems will be scalable. This property will make it possible to extent and expand the system with a lot of ease and comfort by incorporating the new soft wares into it without resulting in conflicts. The interaction between different systems within an organization will increase Karnouskos (2014).

Physical Security and Enterprise Security

However, the security of these systems will be quite tricky. In addition, the susceptibility of these systems to attacks will increase. For instance, deadly computer viruses like the flame and the Stuxnet will be very difficult to be identified and controlled due to complexity of these systems; hence these systems will be prone to malfunctioning Chang et al.(2016). Therefore, the future generation should be more vigilant and prepared to deal effectively with the security of these systems. For instance, very advanced antivirus solutions should be developed by security experts to deal with the risks in the systems.

1. Exposure factor is 1 when the all the values will be lost, in percentage it will be (1/100)*100%= 1%
2. SLE = asset value* EF= 1000*1=1000

• ARO is estimated frequency risk occurring in 1year 1/20

1. ALE= SLE*ARO= 1000*(1/20)= 50
2. When 300 is placed, the EF is then reduced by factor of  10 which was initially 500
3. The SLE when 300 is placed will be 10*1000= 10000

• ARO when 300 is placed, then this is reduced by 50% =1/20*50%= 1/20*50/100=2000/50= 40
• ALE when 300 is placed is 40*10000 = 400000

1. Russian safeguard at 300 is $15 millions
2. Chinese HQ18 safeguard at 300 is $7.5 million
3. Yes, it should be implemented since its cost effective

ADM  stands for Architecture Development Method

TOGAF standard is A method for developing Technology Architectures.

Basic structure of ADM

The basic structure of the ADM cycle is as follows, Preliminary - Architecture vision - then Requirement management

The most likely requirement in our scenario is Interoperation with other financial institutions, both nationally and internationally, this is where the TOGAF standard is impacted.

In this case scenario, the statement is invalid when the price for implementing two is more than the one for implementing one.

Conclusion

To conclude, the Stuxnet virus is very complicated since it was not detected by antivirus solutions as evidenced throughout the paper. This virus is believed to have been created by US and Israel. The core purpose of developing this virus was to slow down the action of nuclear weapons that were under development by the government of Iran. The experts in Iran did not realize the presence of the virus in their computers because of the ability of the virus to conceal itself under legit programs. The nuclear weapons that were being created by Iran jeopardized the security of many people across the world as perceived by Israel and US countries. Although, the nuclear experts managed to identify the virus, but their efforts to expunge it from the infected computers were futile.

However, Stuxnet virus can be prevented from infecting computers using different ways including disabling computer ports from functioning, for example, USB and HDMI ports, hence preventing the transferring of virus into the computer systems via computer ports and using the user control mechanisms that can be implemented through authentication methods such as username and password, although biometrics is the most preferred way. Both the current and future generation should invest much on the issue of security as the complexity of the systems is expected to increase rapidly, therefore, enabling the companies and organizations to secure their data and information alongside their assets like buildings and vehicles against destruction.      

References

Allen, D. K., Karanasios, S., & Norman, A. (2014). Information sharing and interoperability: the case of major incident management. European Journal of Information Systems, 23(4), 418-432.

Apvrille, L., Roudier, Y., & Tanzi, T. J. (2015, May). Autonomous drones for disasters management: Safety and security verifications. In Radio Science Conference (URSI AT-RASC), 2015 1st URSI Atlantic (pp. 1-2). IEEE.

Chang, V., Kuo, Y. H., & Ramachandran, M. (2016). Cloud computing adoption framework: A security framework for business clouds. Future Generation Computer Systems, 57, 24-41.

Edwards, C. I. P. M. (2014). An analysis of a cyberattack on a nuclear plant: The stuxnet worm. Critical Infrastructure Protection, 116, 59.

Falliere, N., Murchu, L. O., & Chien, E. (2011). W32. stuxnet dossier. White paper, Symantec Corp., Security Response, 5(6), 29.

Hills, M. (2016). Why Cyber Security is a Socio-Technical Challenge: New Concepts and Practical Measures to Enhance Detection, Prevention and Response. Nova Science Publishers.

Karnouskos, S. (2011, November). Stuxnet worm impact on industrial cyber-physical system security. In IECON 2011-37th Annual Conference on IEEE Industrial Electronics Society (pp. 4490-4494). IEEE.

Karnouskos, S. (2014). Security in the Era of Cyber-Physical Systems of Systems. ERCIM News, 2014(97), 44-45.

Lendvay, R. L. (2016). Shadows of Stuxnet: recommendations for US policy on critical infrastructure cyber defense derived from the Stuxnet attack. NAVAL POSTGRADUATE SCHOOL MONTEREY CA MONTEREY United States.

Nourian, A., & Madnick, S. (2015). A systems theoretic approach to the security threats in cyber physical systems applied to stuxnet. IEEE Transactions on Dependable and Secure Computing.

Singer, P. W. (2015). Stuxnet and its hidden lessons on the ethics of cyberweapons. Case W. Res. J. Int'l L., 47, 79.

Soomro, Z. A., Shah, M. H., & Ahmed, J. (2016). Information security management needs more holistic   approach: A literature review. International Journal of Information Management, 36(2), 215-225.

Terzi, D. S., Terzi, R., & Sagiroglu, S. (2015, December). A survey on security and privacy issues in big data. In Internet Technology and Secured Transactions (ICITST), 2015 10th International Conference for (pp. 202-207). IEEE.

Wells, L. J., Camelio, J. A., Williams, C. B., & White, J. (2014). Cyber-physical security challenges in manufacturing systems. Manufacturing Letters, 2(2), 74-77.