Singapore and Cyber Security

Greetings from Predict22: The Intelligence Summit, at Fullerton Hotel in Singapore. The conference organisers were excited to have someone from Canberra as a delegate, but I admitted I was actually here to speak at a uni & EduTech Asia next week. But computer security is a hot topic, so it doesn't hurt to brush up. The current presentation is touching on an attack on India's power grid, and implications for other coutries.

Report on Breech of Australian National University Systems

The Australian National University has released a 20 page "Incident Report on the Breech of the Australian National University's Administrative Systems". The supporting materials may also be of interest.

Contents of the report

• Vice-Chancellor’s Foreword
• Executive summary
• Detailed timeline of the data breach
• Figure 1: Simplified overview of actor   
• Figure 2: Attack timeline
• Post notification events 
• Malware and tradecraft analysis
• Lessons from the attack and follow-up actions
• Personally identifiable information
• Phishing awareness
• Table One: Issues and Remediation
• Appendix
• Appendix A: “invitation” phishing email    
• Appendix B: “meeting” phishing email    
• Appendix C: “planning” phishing email   

From the Executive Summary:

"In early November 2018, a sophisticated actor gained unauthorised access to the ANU network. This attack resulted in the breach of part of the network known as the Enterprise Systems Domain (ESD), which houses our human resources, financial management, student administration and enterprise e-forms systems.

By gaining access to ESD, the actor was able to copy and steal an unknown quantity of data contained in the above systems. There is some evidence to suggest the same actor attempted to regain access to ESD during February 2019, but this second attack was ultimately unsuccessful. ...

Technical gaps aside, ANU ultimately views this breach and cybersecurity more broadly as an organisational issue, one which requires a change to the University’s security culture to adequately mitigate. It is through this lens we will undertake the next phase of our cybersecurity work – a strategic information security program. This program encompasses the modernisation of IT and security infrastructure and, more importantly, an emphasis on culture and security awareness among students, staff and researchers; and the protection of the data they entrust to ANU.

The investigation following the breach, which contributed to the contents of this report, was conducted in close cooperation with Australian Government security agencies and Northrop Grumman. ANU is grateful for their continued support."

Cyber Storm Conference in Canberra

UNSW Canberra has invited papers for  “Cyber Storm”, 18-20 February 2019. The conference will focus on training for cyber warfare.

"Australia’s former Minister of Cyber Security, Hon. Dan Tehan, warned in November 2016, of the need for the country to prepare for a cyber storm, even if it was an unlikely contingency. One view of the Cyber Storm sees it as the contingencies arising from protracted and complex, multi-vector, multi-wave, multi-theatre attacks against cyber assets. Such assets can include critical civil infrastructure, military C4ISTAR, computerised systems in weapons platforms, and even other civilian targets of military or national security significance.

This conference will concentrate on the role universities and professional education institutions, such as military colleges, can play to address the unique challenges of workforce formation for the Cyber Storm.

For middle powers like Australia, immense challenges exist in framing education and training solutions for these contingencies, as the research foundations on which these policy responses depend, are very weakly developed, or even non-existent. This is especially case in the sub-field of simulations. The conventional wisdom, or at least the dominant practice, has been that the knowledge, skills and abilities needed would be acquired “on the job” in highly classified environments. There has been little space for open-source research and therefore minimal open-source education and teaching. This scholarly conference will discuss research papers on these subjects by leading specialists from universities, professional colleges, think tanks, government, and industry. The academic portion of the conference will not have any special national focus, but papers that can address the U.S. experience or that of middle powers like Australia will be highly regarded. The academic portion will be followed by a one-day invitation-only policy workshop to give strategic planners in government, the armed forces and business the opportunity to reflect on practical recommendations arising from the scholarly research."

Blockchain Learning System

In 2013, cyber-security company Mandiant warned of large scale government-sponsored cyber espionage campaigns. Educational institutions have students who are corporate and government employees, as well as military personnel, making them a target for cyber espionage. Cloud based systems are particularly attractive to cyber spies, especially if the server is located in the country doing the spying, so it can be done easily, perhaps even legally.

Sharples, and Domingue (2016) suggest blockchain technology, used for digital currency, could also be used for education. For example, you could prove you completed an assessment task on time, without having to submit the work to a central system. The assessor would check the blockchain certificate to see the work was on time, and add your mark to the blockchain.


Along with m-Learning, this might provide an alternative to large cloud based services for education. The student would be issued with  a digital certificate, and then pointed to where to get the learning resources. The student could use their digital certificate to securely communicate with other students and submit their work for assessment, using on-line resources not provided by the educational institution.

Richards, McGreal and Stewart  (2010) refer to cloud computing supplanting the “cottage industry” of institutions providing their own computing. However, companies such as Amazon.com not only provide cloud computing, they also offer e-publishing and other "vertical" services. It may be that once small institutions have educated students on the benefits of cloud based education, the large cloud providers will take over this market, offering courses themselves. As an alternative, smaller not-for-profit institutions might use digital certificates and other technology to create large virtual academies, which share resources on-line, but can also provide human scale local services.

References

Mandiant. (2013). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved from http://nsarchive.gwu.edu/NSAEBB/NSAEBB424/docs/Cyber-083.pdf

Richards, G., McGreal, R., & Stewart, B. (2010). Cloud computing and adult literacy: How cloud computing can sustain the promise of adult learning. AlphaPlus: Toronto. Retrieved from http://auspace.athabascau.ca:8080/bitstream/2149/3037/1/Alpha%20Plus%20Cloud%20Report.pdf

 

Sharples, M., & Domingue, J. (2016, September). The Blockchain and Kudos: A Distributed System for Educational Record, Reputation and Reward. In European Conference on Technology Enhanced Learning (pp. 490-496). Springer International Publishing. Retrieved from http://link.springer.com/chapter/10.1007/978-3-319-45153-4_48