Cyberterrorism and cybercrime present new challenges for law enforcement and policy makers. Due to its transnational nature, a real and sound response to such a threat requires international cooperation involving participation of all concerned parties in the international community. However, vulnerability emerges from increased reliance on technology, lack of legal measures, and lack of cooperation at the national and international level represents real obstacle toward effective response to these threats. In sum, lack of global consensus in terms of responding to cyberterrorism and cybercrime is the general problem. Terrorists and cyber criminals will exploit vulnerabilities, including technical, legal, political, and cultural. Such a broad range of vulnerabilities can be dealt with by comprehensive cooperation which requires efforts both at the national and international level. "Vulnerability-Comprehensive Cooperation-Freedom Scale" or "Ozeren Scale" identified variables that constructed the scale based on the expert opinions. Also, the study presented typology of cyberterrorism, which involves three general classifications of cyberterrorism; Disruptive and destructive information attacks, Facilitation of technology to support the ideology, and Communication, Fund raising, Recruitment, Propaganda (C-F-R-P). Such a typology is expected to help those who are in a position of decision-making and investigating activities as well as academicians in the area of terrorism. The matrix for international cooperation and vulnerability assessment is expected to be used as a model for global response to cyberterrorism and cybercrime.

Terrorist organizations and individuals make use of the Internet for supportive activities such as communication, recruiting, financing, training, and planning operations. However, little is known about the level of computer-based (“cyber”) threat such terrorist organizations and individuals pose. One step in facilitating the examination and assessment of the level of cyber threat posed by terrorist organizations and individuals is development of an assessment tool or methodology. This tool would guide intelligence collection efforts and would support and facilitate comparative assessment of the cyber threat posed by terrorist organizations and individuals through the provision of a consistent method of assessment across time, amongst organizations and individuals, and between analysts. This study leveraged the professional experience of experts to engineer a new functional construct – a structured analytical technique designed to assess the cyber threat posed by terrorist entities and individuals. The resultant instrument was a novel structured analytical construct that uses defined indicators of a terrorist organization/individual’s intent to carry out cyber attacks, and their capability to actually do so as measures of an organization/individual’s overall level of cyber threat.

There are two main approaches for intrusion detection: signature-based and anomaly-based. Signature-based detection employs pattern matching to match attack signatures with observed data making it ideal for detecting known attacks. However, it cannot detect unknown attacks for which there is no signature available. Anomaly-based detection builds a profile of normal system behavior to detect known and unknown attacks as behavioral deviations. However, it has a drawback of a high false alarm rate. In this thesis, we describe our anomaly-based IDS designed for detecting intrusions in cryptographic and application-level protocols. Our system has several unique characteristics, such as the ability to monitor cryptographic protocols and application-level protocols embedded in encrypted sessions, a very lightweight monitoring process, and the ability to react to protocol misuse by modifying protocol response directly.

The performance aspect and security capabilities of the Embedded Firewall (EFW) system are studied in this thesis. EFW is a host-based, centrally controlled firewall system consisting of network interface cards and the "Policy Server" software. A network consisting of EFW clients and a Policy Server is set up in the Advanced Network Laboratory at the Naval Postgraduate School. The Smartbits packet generator is used to simulate realistic data transfer environment. The evaluation is performed centered on two main categories: performance analysis and security capability tests. TTCP program and a script written in TCL are used to perform throughput and packet loss tests respectively. The penetration and vulnerability tests are conducted in order to analyze the security capabilities of EFW. Symantec Personal Firewall is used as a representative application firewall for comparing test results. Our study shows that EFW has better performance especially in connections with high amounts of encrypted packets and more effective in preventing insider attacks. However, current implementation of EFW has some weaknesses such as not allowing sophisticated rules that application firewalls usually do. We recommend that EFW be used as one of the protection mechanisms in a system based on the defense-in-depth concept that consists of application firewalls, intrusion detection systems and gateway protocols.

<p> </p><p>Debatten om den kontroversiella signalspaningslagen är högst aktuell och det diskuteras öppet och intensivt om huruvida den är ett skydd mot hot utifrån eller om den hotar medborgarna i det svenska samhället. När uppsatsen avslutas har lagen trätt i kraft den 1 januari 2009, men kommer inte att träda i full kraft förrän i oktober 2009.</p><p>Terrorism är ett fenomen som har fått en ny betydelse för människor i det globala samhället. Det har alltid funnits i samtid som det demokratiskt politiska samhället, men betydelsen av detta fenomen, detta begrepp har varierat. Den har skiftat under åren från att vara en terrorism där grupper som IRA och ETA figurerade för att frigöra territorium från de stora länderna till att handla om att påverka politiska beslut genom att skrämma civila. Cyberterrorism är ett nyare fenomen inom begreppet och har en annan verkan då den riktar sig mot det nya informationstekniska samhället som har blivit allt mer sårbart ju längre utvecklingen går.</p><p>Syftet med uppsatsen har varit att undersöka vilket sorts inflytande som cyberterrorism har haft i utformandet av lagen, om lagen är ett hot mot Sverige eller ett skydd för Sverige samt huruvida signalspaning rättfärdigas av ändamålet, det vill säga att ge Sverige ett fungerande säkerhetsskydd.</p><p>Slutsatsen av denna uppsats är att cyberterrorism har ett visst samband med hur lagen har utformats, men det är inte en avgörande eller ensam faktor. Huruvida lagen är ett hot mot Sverige eller ett skydd för och om ändamålet helgar medlen har det kommit fram till att den till viss del kan vara ett hot, men att ändamålet att politikerna vill  kunna ge Sverige ett fungerande säkerhetsskydd väger upp till en viss del vad lagen vill stå för. Det är fortfarande en hel del motsättningar mot lagen och det kommer det alltid att vara.</p><p> </p> / <p> </p><p>This thesis has its origins in the controversial debate about the signals intelligence law that has been a highly intensive debate since the law was passed on June 18 2008. The debate mainly is about whether or not the law is a protection against threat towards the Swedish nation-state or if the law is at threat against the citizen of the Swedish society. The law will have been put in to force on January 1 2009, but won't be in full force until October 2009.</p><p>Terrorism is not a phenomena that is new, but it has gotten a new meaning to people in the global society. Though it has always existed with the democratic political society, it's meaning has been a target for change. The meaning has shifted from being about groups like IRA and ETA that fight for their own territories to be about influencing political decisions through scarring civilians. One of the more newer phenomena within terrorism is cyber terrorism and it has another effect because it directs itself towards the information technology of the modern society. The IT society has become more vulnerable because of the development and that is what cyber terrorism is attacking the vulnerability.</p><p>The purpose of this thesis is to examine what kind of influence that cyber terrorism has had in the design of the law, if the law is a threat against Sweden or a protection for Sweden, that is what arguments surrounds this case, and do the aim, that is protecting the society, justify the means, that is signals intelligence in giving Sweden a functional security.</p><p>The conclusion in this thesis is that cyber terrorism has had an indirect connection to how the law has been designed, but the threat of cyber terrorism has not been a deal breaking or alone factor. Whether the law is a threat or not depends on who you talk to, but it might be a threat to a certain extent if the lawmakers don't hear the critics and change the law to the extent that it involves a fully protection for the privacy of the citizens. In the end it is partly true that the aim does justify the means.</p><p> </p> / Presentation av uppsats har redan ägt rum.

Thesis (M.A. in Security Studies (Combating Terrorism: Policy and Strategy))--Naval Postgraduate School, June 2010. / Thesis Advisor(s): Denning, Dorothy ; Russell, James. "June 2010." Description based on title screen as viewed on July 13, 2010. Author(s) subject terms: Cyber attack, international law, China, Russia, United States, al Qaeda, Hamas, Hezbollah, FARC, Botnet, worm, virus, malicious code, hack, jus in bello, jus ad bellum, Law of Armed Conflict (LOAC), laws of war, counterterrorism operations (CT), cyber strategy, military strategy, foreign policy, national policy, use of force, armed attack, enforcement, evaluation Includes bibliographical references (p. 55-60). Also available in print.

LL.M. (International Law) / Please refer to full text to view abstract.

Title: Terrorism and cyberterrorism as threats for the present Objectives: Describe the principle, history and typology of terrorism. Approach and describe the problematics of cyberterrorism. Analyze and compare available terrorist attacks which happened from 11th September 2001 to 19th February 2020. Methods: The theoretical part was developed on the basis of study, analysis and research from Czech and foreign literature about problematics of terrorism and cyberterrorism. The practical pard included the collection of electronic and printed information about terrorists attacks which were further analysed and compared using five factors, which were: the year of terrorist attack, method of execution, country that tooked place of the attack, number of injured and number of victims. Results: The result of this diplama thesis is the description of the principle, history and typology of terrorism, description of problematics of cyberterrorism and analysis of terrorist attacks which happened from 11th September 2001 fo 19th February 2020. Keywords: Terrorism, terrorists, attack, cyberterrorism, threat.

This dissertation explores how coercive diplomacy works in cyberspace through three interrelated papers, each titled, Coercion in Cyberspace: A Model of Encryption Via Extortion, Variation in Coercion: Costly Signals That Also Undermine Attack Effectiveness, and Seeking Clarity In A Domain of Deception: Signaling and Indices in Cyberspace. As more strategic actors seek to employ cyber weapons as an important part of their military arsenal, refining the theory of cyber coercion is becoming more important in understanding coercive diplomacy and crisis dynamics in cyberspace. Although existing cyber conflict literature argues that cyber weapons make poor tools of coercion, the current theory does not necessarily match important empirical instances of successful coercion using cyber means, such as the ransomware and data extortion. This dissertation seeks to close this gap between theory and practice by specifying the conditions under which cyber coercion works. Relatedly, the dissertation also explores the conditions under which costly signaling works in conveying such coercive threats. The first paper presents a formal model of cyber coercion that relies on data encryption, as a means of explaining why cyber weapons often rely on a different coercive logic. Coercion in International Relations is often conceptualized as the threat to hurt used in reserve, applied in settings such as the use of nuclear weapons or strategic bombing. However, history is ripe with instances of a different logic of coercion that relies on the application of costs up front, followedby a promise to stop. Application of such a coercive logic can be seen in instances such as sanctions, hostage-taking, and sieges. Existing literature argues that cyber weapons make poor tools of coercion, however this only examines cyber weapons under the first logic. However, cyber weapons, when examined under the second logic, are often quite successful, as the prevalence of the ransomware threat demonstrates. This paper specifies the conditions under which coercion using data encryption works in light of the second logic, and what unique commitment problems can undermine coercion in this situation. By applying costs up front, some cyber weapons resolve a key strategic dilemma in which conveying specific information regarding how the attack will unfold can allow the defender to take mitigations that render the planned attack useless. The second paper complements the first paper by presenting a formal model that explores the first logic, and specifies the conditions under which cyber coercion relying on the threat to hurt used in reserve works. A key theory in the existing cyber conflict literature argues that cyber weapons make poor tools of coercion due to the “cyber commitment problem," in which a coercer faces a tradeoff between the need to credibly demonstrate specific capability to follow through with a threat, versus the propensity of the defender to use such information to adopt countermeasures. This tradeoff is not necessarily unique to cyberspace, but applicable to technologies that rely on degrees of deception for attack effectiveness, such as submarine warfare. I present a formal model motivated by cyber weapons but applicable to a broad range of technologies in International Relations, showing that the severity of this tradeoff is not constant but varies depending on exogenous factors, such as the probability that a defensive countermeasure can successfully neutralize a threatened attack. When the probability is high, this shrinks the range of costly signals that a coercer can send to maintain a separating equilibrium, however it does not necessarily mean that costly signaling is not possible. This paper formalizes and expands the logic behind the “cyber commitment problem" and shows that coercion can sometimes work even under the first logic. The third paper examines the role of indices – or observations that are believed to be hard to deceive as opposed to overt signals of intent – in coercive diplomacy and crisis communications in cyberspace. Because actors acting in and through cyberspace have yet to come to a clear shared meaning as to what certain actions in cyberspace conveys in terms of intent and/or resolve, the tendency to instead rely on independent observation and assessment of “indices” to interpret these actions are more pronounced in cyber conflict. This paper uses cybersecurity advisories routinely published by the Cybersecurity and Infrastructure Security Agency (CISA) to examine what kinds of indices were used by the U.S. government to make assessments about an attacker’s intent regarding restraint or escalation. Interestingly, the same kind of cyber attack, for example the malicious compromise of a water utilities facility, is interpreted differently as escalatory or accommodative depending on consideration of “situational indices" such as the larger geopolitical context and attribution to a particular state actor, beyond the technical facts. This paper assesses that indices are being used too broadly, even when they can be manipulated easily or are linked to perceptions and biases instead of facts. Such practices can lead to situations where the same costly signal sent by the sender in the context of coercive diplomacy or crisis communications can be interpreted differently by the receiver depending on the suite of indices they are relying on, raising the risk of misperception and crisis escalation in cyberspace.

Approved for public release; distribution is unlimited / The unfortunate events of September 11, 2001 have caused a renewed effort to protect our Nation's Critical Infrastructures. SCADA systems are relied upon in a large number of the sectors that make up the critical infrastructure and their importance was reinforced during the massive power outage that occurred in August 2003. Growing reliance upon the Internet has emphasized the vulnerability of SCADA system communications to cyber attack. Only through diligent and continuous vulnerability assessment and certification and accreditation of these systems will the United States be able to mitigate some of the vulnerabilities of these systems. A case study presented here has validated the need for continued focus in this area. This thesis consolidates some of the research that has already been done in the area of SCADA vulnerability assessment and applies it by developing an initial vulnerability assessment checklist for Department of the Navy systems. This checklist can and should also be used in the certification and accreditation of DoN SCADA systems. A promising technology was also discovered during this research that should be explored further to secure SCADA communications. This will be touched on briefly. / Major, United States Marine Corps