INTRODUCTION.
Currently, the key to any strategic cybersecurity and privacy plan lies in its measurability, because what isn't measured isn't known, what isn't known can't be managed, and what isn't managed can't be improved. According to Cisco Security Research, there was a twelve-point increase in global encrypted web traffic (HTTPS) from November 2016 to October 2017. According to Gartner's "Market Guide for Mobile Threat Defense – 2017," mobile threats will account for one-third of all security events by 2019, compared to just 7.5% in 2016. Cybersecurity operates across all types of ecosystems with all types of entities (people, objects, hardware, software, firmware, managed processes, organizational processes, business models, avatars, etc.) and enables accessibility. Cybersecurity helps the environment, people, things (IoT), living beings, virtual reality avatars, hardware, software, personal assistants, and more. It facilitates productivity and progress, enabling sustainability in our society. It defends and protects against chaos, perfect storms of intrusions and attacks, threats, vulnerabilities, lateral movement, cyberweapons, polymorphic/metamorphic malware, and more. It provides guarantees and enables balanced global governance. It is the driving force behind compliance needs and obligations (SOX, PCI-DSS, GDPR, etc.). It ensures quality, exploring (detecting, analyzing, root cause analysis, lateral movement analysis, etc.), predicting, repairing, and recovering from cybersecurity and privacy incidents, intrusion attempts, and all types of cyberattacks. It filters unauthorized inputs and outputs, regulates and controls potential destabilizations, and provides early warning of adverse, malicious, or dangerous situations. Cybersecurity is embodied in processes, hardware devices, software tools and firmware, standards, best practices, methodologies, policies, and more. It enables organizations to be responsible, sustainable, and co-responsible. Cybersecurity defends against and protects against insecurity and all types of risks (the intersection of impacts, vulnerabilities, and threats). It is the DNA of every type of transformation, infrastructure, ecosystem, organization, technology, entity, specification, development, design, implementation, business model, governance, and so on. It is the primary facilitator of trust, progress, sustainability, and more. Cybersecurity is at the heart of new concepts such as cyber resilience in businesses, organizations, Industry 4.0, artificial intelligence developments, all types of vehicles, infrastructures, and so forth. A widespread misconception is that the protection of an entity, organization, system, structure, business, infrastructure, ecosystem, etc., is the sole means of achieving this goal. It involves considering or implementing certain extra cybersecurity features when the correct approach is that cybersecurity protection should be built in from the outset/design stage and is a comprehensive, all-encompassing solution, not a collection of add-ons/patches or functionalities. It covers everything: people, hardware, software, firmware, processes, procedures, compliance, infrastructure, machines, governance, cyber resilience, the environment, and so on.
BOTNET LIFECYCLE. FUNCTIONAL ANATOMY OF ADVANCED THREATS AND CYBER-WEAPONS.
The botnet lifecycle comprises the following phases: (1) Injection and Deployment. The following instances can be identified: distribution of malicious emails, software vulnerabilities, instant messaging, P2P file-sharing networks, and other botnets. In this phase, the following resilience techniques are identified: use of trusted processes, obfuscation based on trivial names, rootkit techniques, reduced security rules, reduced system capabilities, installation of antivirus software, built-in anti-debugging and anti-virtualization, deployment techniques, polymorphism and metamorphism, continuous bot updates, etc. (2) C&C or C2 (Command & Control). The following four sub-phases can be identified: (i) Model and Topology. Here, the following instances are identified: centralized (single-star, multi-server star, and hierarchical) and distributed (random). (ii) Application and Protocol. The following instances are identified here: P2P, IM, HTTP/HTTPS, IRC, etc. (iii) Communication initiation. The following instances are identified here: push and pull methods. (iv) Communication direction. The following instances are identified here: bidirectional and inbound. In this phase, various resilience techniques are identified: DNS/DNSSec techniques, encryption/steganography/subliminal channels, multiple URLs, dead drop, and C&C variants. The spectrum of C&C organization options allows for the identification of five types: (a) Fully centralized. Its structure is a tree, with the commander at the root having direct control and command over intermediate commanders who, in turn, with the same direct control and command, connect to the units. (b) Centralized command and decentralized execution. Its structure is a tree, with the commander at the root having direct control and command over intermediate commanders, who are coupled with the units but lack cohesion. (c) Collaborative C2. 
(a) Fully meshed structure including the commander and mid-level commanders with direct control and command, and mid-level commanders with weak connections to units. (d) Decentralized C2 (self-synchronization). Its structure is tree-like, with the commander at the root, connecting to mid-level commanders via direct control and command, and the mid-level commanders to units via weak coupling. (e) No organization. The commander, mid-level commanders, and units lack weak coupling or direct control/command. (3) Botnet application. The following instances can be identified: DDoS/DoS attacks, espionage, spamming and malware distribution, application hosting, and malicious activities. In this phase, resilience techniques are identified, such as: anonymity techniques, disguised messages, exposure limitation, and retaliation techniques. The main functional areas of any attack/intrusion entity (advanced threats and cyber weapons) are:
1) Penetration. This includes: (a) Access. This can be: (i) Technical, either remote via the Internet or at close range using a chip swap, a USB device or token, the supply chain, a tapped cable, clandestine Wi-Fi (even with WPA3), theft, robbery, browsing, etc. (ii) Social, using persuasion, extortion, blackmail, bribery, deception, fraud, and scams. Some targets of social access are users, operators, manufacturers, and service providers. (b) Vulnerabilities/attack surfaces. These are weaknesses, shortcomings, defects, inaccuracies, needs (I absolutely need to run an app even if it's malicious), errors, trust issues, deficiencies, flaws, etc., in: (i) Software. Applications, apps, or system software with accidental or deliberately introduced weaknesses. (ii) Hardware. Deficiencies in microprocessors, graphics cards, power supplies, peripherals, storage devices, network cards, hardware Trojans implanted at any stage of the design, testing, implementation, etc. lifecycle, waiting to act autonomously or receiving a wireless signal from an attacker, etc. (iii) Communication channels. For example, tapping into fiber optic lines, electromagnetic interception of wireless communications and EM emissions from computer equipment. (iv) Configuration. Ports left open carelessly or incorrectly, weak passwords allowed, failure to use the retry limit, faulty procedures, flawed protocols, poor organization, inadequate governance, etc. Frequently, technical and social elements are combined, as in the case of phishing.
2) The payload. This specifies the malicious actions it will perform in one or more phases, with temporary disappearances to cause confusion and repeated reappearances that are increasingly nefarious, unexpected, and chaotic.
Threats of interference to wireless links: physical cyberweapons. Types of advanced threats and software cyberweapons.
Jamming wireless links, for example, using a multi-antenna jammer (a basic example being RF inhibitors), represents a serious cybersecurity threat based on interference with manufactured EM signals. Some examples include jamming PMR (Private Mobile Radio) systems used by police and other emergency services, jamming and spoofing GPS/GLONASS receivers, jamming remote lock controls in parking garages to facilitate theft, and jamming wireless alarm systems in homes to enable undetected access by a burglar. Massive MIMO technology (referring to the use of a large number of antennas, hundreds or thousands, operating in phase) can be used as a physical cyber weapon or jamming device and cause damage to civilian and military wireless communication systems using DDoS/DoS attacks. Advanced threats and cyber weapons can be grouped into different categories: (1) Generic, low-potential threats. These are malicious software or malware that can influence a system from the outside, but are technically incapable of penetrating the system and causing direct damage. (2) High-potential specifics. This is malware that can act as an intelligent agent capable of penetrating protected systems, even autonomous and physically isolated ones, and influencing output processes to inflict direct damage, spy on content, create chaos, etc.
ADVANCED THREATS AND CYBER WEAPONS GENERATIONS.
Several generations of advanced threats and cyber weapons can be identified:
1) First generation. Cyber weapons for electronic warfare using radiation or signal jamming can blind, damage, degrade, or incapacitate through traditional electronic warfare methods based on interference and jamming. Cutting copper or fiber optic lines for telephony, data, internet, etc., also belongs to this generation. The effects are the degradation or disruption of communications, similar to cyber weapons that use C&C/C2 (Command and Control) technology. They attack the processing element by physical means (jamming, EMS, etc.). Neutron bombs, physical cuts to guided media, emulation of radiation from sunspots, RF inhibitors, jamming generators, etc., are used.
2) Second generation. These require operational access against which an exploit code can be used. Software/firmware and hardware are used to enable vulnerabilities (of all types, for example, multi-zero-day) to be exploited in systems in general or in specific targets. These are characterized by the requirement that someone possess an exploitable feature in the design, configuration, or implementation of the system's software, firmware, or hardware. A similar approach in biology is editing the genome or DNA molecule by writing and deleting sections to create new skills and abilities in living beings. Psychic, parapsychological, and biohacking cyber-weapons are also being refined, allowing the use of drugs to edit DNA (as if it were a file where changes, cuts, pastes, etc. are made) and enhance unconventional capabilities in humans and living beings in general.
3) Third generation. Here, the advanced threats and cyber-weapons of the previous generations are consolidated, refined, and collaborate with each other. They allow the destruction of communications and coordination of cyber-infrastructures; likewise, they make it possible to create confusion, disinformation, disorganization, chaos, spying, stealing, etc.
Countermeasure technologies against advanced threats and cyber weapons. Targets of cyberattacks.
The spectrum of countermeasures and safeguards grows daily. Even with the support of artificial intelligence, the following can be identified:
1) Blacklisting. Integrated into antivirus software, NIPS/HIPS/AIPS, etc. These are not effective against targeted attacks.
2) Whitelisting. Integrated into computing devices, but also into the internal network. They are effective in certain cases and in some parts of the network (SCADA), but this effectiveness is very costly.
3) Anomaly detection. These still need to be fully tested, but are worth exploring (particularly the back office).
4) Running in a virtualized environment. Probably effective against some types of malware. This includes the use of quarantine zones, DMZs, sandboxing, VLAN partitioning, isolation via sealed VMs, etc.
5) Artificial intelligence techniques such as machine learning and enhancements like deep learning. Machine learning techniques include classification, clustering (used in SUBA or Security User Behavior Analysis solutions), regression, etc. Some machine learning techniques include static, dynamic, and behavioral signatures, high-level patterns, and unsupervised anomalies (applicable to encrypted data without decryption).
Some advanced threats/malware and APT-type cyber weapons are: (i) Duqu. Its purpose is to capture information about PC-type computing devices. It contains a keyboard and mouse keylogger. It is spyware. It uses the same platform as Stuxnet, the same vector, but a different payload. The propagation mechanism involves dropping an MS Word document containing a zero-day exploit that waits until the computer is inactive for ten minutes plus another condition. On the network, it copies itself to a shared folder (using a password stolen by the keylogger) and creates a scheduled job on the target computing device. (ii) Flame. Its purpose is cyber-espionage and information theft. (iii) Gauss. It collects information without authorization and steals credentials from banking systems and social media accounts, email, instant messaging, etc. (iv) Stuxnet. Attacked uranium enrichment systems in Iraq, based on Siemens PLCs. (v) Carbanak/Anunak. Targeted ATMs and was based on the Tyupkin banking malware.
There are a variety of cyberattacks targeting different objectives, such as:
1) Artificial intelligence systems, robots, virtual reality, augmented reality, diminished reality, personal assistants, AmI (ambient intelligence), post-reality, avionics, drones, connected vehicles, etc.
2) Control systems (e.g., Stuxnet). This creates risks in transportation systems (vertical, horizontal), critical Industry 4.0 infrastructure, and public utilities (water, electricity, industry, pipelines, healthcare, agriculture, etc.).
3) Algorithms. This creates risks in financial systems (SWIFT, Society for Worldwide Interbank Financial Telecommunication, a private global telecommunications network for the financial sector to conduct its business operations; the Bluenoroff attack group targeted it in 2015-2016), fund transfers, fair markets, payment systems, social security, blockchain, cryptocurrencies, etc.
4) Databases and repositories. The result is a lack of trust, social chaos, and anarchy.
5) Communications. The result is a loss of command and control; it's about diminishing trust in news reports and government authorities with fake news.
MALWARE AND MALICIOUS CODE INPUT VECTORS.
Rootkits are malicious software, or malware, that acquires and maintains privileged access (read: root or administrator access) to operate the system (hence the name rootkit) while concealing its presence by subverting the normal operating system behavior. A rootkit typically has three objectives: (1) Execution. A rootkit wants to be able to run without restrictions on the victim's computing device. Most computing systems (including Linux, Unix, Solaris, Android, iOS, Windows, etc.) have authorization mechanisms such as Access Control Lists (ACLs) and Capability Lists to prevent an application from gaining access to protected resources. Rootkits exploit vulnerabilities in these mechanisms or use social engineering attacks to install themselves so they have no restrictions on what they can or cannot do. (2) Hiding. Specifically, a rootkit doesn't want an installed security product, such as antivirus software, to detect that it is running and remove it. The best way to prevent this is to make it invisible to all other applications running on the machine. (3) Action. A rootkit has specific actions it wants to take (technically called its payload). In addition to execution and remaining hidden, it compromises the victim's computer to steal passwords or bandwidth, or to install other malicious software. There is a growing array of malware entry vectors, including: diskettes, CDs, DVDs, USB devices, social networks, email, instant messaging, P2P (songs, screensavers, videos, etc.), web downloads, software (malware) downloaded to the computer without the user's intervention or knowledge, simply by visiting a web page (without explicitly clicking on a link), exploitation of vulnerabilities in the web browser or its extensions, due to vulnerabilities in associated software (Adobe Reader, Adobe Flash, QuickTime, RealPlayer, Skype, iTunes, Java, WinRAR, WinZIP, VLC, MediaPlayer, IM clients, email readers such as Outlook/Thunderbird, browsers such as Internet Explorer, Safari, Firefox, Chrome, MS Office such as Word, Excel, PowerPoint, etc.), client software, the operating system, drivers, DLLs, libraries, hypervisors in VMs, etc. Some malware delivery methods used include software vulnerabilities (developing zero-day exploits in specific software), watering hole attacks (deploying exploits on compromised websites to distribute payloads), spear-phishing emails (attaching malicious documents to spear-phishing emails to infect victims), using pharming based on DNS/DNSsec weaknesses, etc.
TYPES OF IMPACTS AT THE INFORMATION LEVEL.
A cyberattack on a target system has the potential to impact sensitive information in several ways. A compromised resource must be able to defend against information warfare strategies in an effort to protect itself against the threat, disruption, distortion, denial of service, or destruction of sensitive information assets. There are various informational impacts of attacks, among the most relevant being:
1) Information distortion. This occurs when the attack has caused a file modification (for example, WannaCry cryptolocker malware encrypts a file, folder, or hard drive to demand a ransom). When an attack involves distortion, it means a change in the data within a file or the modification of the victim's information.
2) Service disruption. This is usually caused by a DoS/DDoS attack. When an attack involves disruption, it means a change in access, slowdown, or complete elimination of access to the victim or the information.
3) Information destruction. This usually occurs when an attack has caused the deletion of files or the elimination of access. Destruction is the most significant malicious impact, as it involves deleting the file or removing the victim's information (human, machine, program, AI agent, etc.).
4) Information disclosure. This typically involves providing an attacker with access to information they wouldn't normally have, through sniffers, video surveillance, spyware, keyloggers, or encrypted traffic analysis, inferring information such as message volume and frequency. Unauthorized information disclosure can lead to other types of cybersecurity compromises.
5) Information discovery. This involves finding information that was not previously known. For example, when a scanning tool (such as Nmap port scanning or Nessus vulnerability scanning) probes for information, the discovered information can be used to launch an attack on a specific target. Autonomous mobile agents and bots are used to search networks for people, profiles, actions, data, files, etc.
CATEGORIES OF DEFENSE STRATEGIES.
Defense can be implemented before, during, and after cyberattacks. Some of the most relevant defense strategies are:
1) Mitigation. Before vulnerabilities are exploited or during a cyberattack, there are several stages a defender can take to mitigate the damage a cyberattack has caused or has the potential to cause. An example might involve the installation of a worm that spreads across the network. An instance can be removed from a group of computers on the network, and traffic can be redirected while the administrator manages operations to remove the worm. Mitigation involves reducing the severity of the cyberattack. Some possible techniques are: (i) Removing it from the network. This involves an administrator's ability to remove infected computers, preventing further damage, by placing them in isolated compartments, quarantine zones, DMZs, sandboxing, VLANs, or a specific virtual machine (VM) within a virtualized environment. A specific worm may reside on a network and begin propagating. (ii) Whitelisting. A list of permissible connections known to the defender. An attack can target specific software that may reside on a predetermined port. (iii) Reference announcement. These are notes provided by the defender to mitigate an attack or a vulnerability database/vendor reference number to mitigate or eliminate a vulnerability, intrusion attempt, or attack.
2) Remedies. In the presence of, or before, an exploit of a vulnerability, there are remediation steps available to a defender to prevent an attack. The remediation strategy involves taking the appropriate steps to correct the situation before or during an exploit. Some possible techniques are: (i) Patching and update systems. Applying patches released by the vendor due to vulnerabilities in software or firmware in use. When a vulnerability or attack is present for various reasons, the defender uses the patches/fixes provided by the vendor. (ii) Code correctness. Departments within an organization release code patches for specific applications to close the potential for an attacker to exploit them. (iii) Escape via control-alt-del, cut off the network connection, turn off the device, remove the SIM, get inside a Faraday cage, activate RF inhibitors for WiFi, etc.
TYPES OF SOFTWARE VULNERABILITIES. CATEGORIES OF TARGETS OF CYBERATTACKS.
Software vulnerabilities can be classified into two main categories: (1) Intentional. These can be further categorized as: (i) Malicious, such as Trojans (with or without replication, as in the case of viruses), backdoors, time bombs, or logic bombs. (ii) Non-malicious, such as covert/subliminal channels (storage, timing), etc. (2) Unintentional. Examples include validation errors (incomplete, inconsistent), domain errors (including reuse of residual objects, etc.), serialization/aliasing (including race conditions, TOCTTOU (Time of Check to Time of Use) errors/bugs/vulnerabilities), inadequate identification/authentication, and violations of boundary conditions (including resource exhaustion, etc.). The wide variety of attack targets can be perplexing for defenses, making it difficult to predict the next attack. The following have been identified as primary attack targets and other exploitable logical errors:
1) User. A cyberattack against a user is an attack intended to retrieve the user's personal information, damage their reputation or finances, or cause them harm or death. It involves the use of social engineering techniques such as astroturfing, which involves spreading false information.
2) Application/App. This is an attack on specific software. An application or app can be a client, a server, or a P2P peer. A client application is software designed to help a user perform common tasks. A server application is software designed to host multiple concurrent users.
3) Operating System (kernel, user interface, driver, hypervisor in VMs, for example, with VMware). The operating system is responsible for coordinating activities and sharing a computer's resources. An attack can target vulnerabilities within a specific operating system (Linux, Windows, Solaris, Unix, etc.). Hypervisors used in virtualized environments, such as VMware, also contain vulnerabilities that allow, for example, moving from one VM to another that is supposedly isolated and sealed.
4) Network. The target is a specific network, L3/IP subnet, or L2 VLAN, or gaining access through vulnerabilities within a network, subnet, one of the network protocols, etc.
5) Local. This is an attack directed at a user's local computer (tablet, smartphone, PC, medical prosthesis, IoT device, smartphone SIM, etc.).
FINAL CONSIDERATIONS.
According to Radware, DDoS (Distributed Denial of Service) attacks increased in 2017 at the application level by 64% (with the main attack vectors being HTTP at 37%, DNS at 33%, and HTTPS at 28%), and at the network level by 51% (with the main attack vectors being TCP-SYN flooding at 35%, UDP at 23%, IPv6 at 10%, etc.). Most cyberattacks follow a structure comprised of certain attack phases known as the Cyber Kill Chain (CKC): each attack begins with a reconnaissance phase in which the attacker attempts to locate vulnerabilities in the target system. This is followed by the weaponization phase, during which weaknesses are discovered and used to develop targeted malicious code. The next phase, called the malware delivery phase, allows for its transfer to the potential target. After the malware is successfully delivered, the exploit phase begins, during which the malware triggers the installation of intrusion code. Once the compromised system is established, C&C/C2 channels can be set up, allowing the attacker to initiate any malicious actions they wish. The Integrated Security Approach (ISA) provides key guidelines for a comprehensive cybersecurity strategy. The primary goal of the ISA is to generate early warnings or alerts, preferably before the attack is launched (before the exploit phase). The alert is intended to generate a relevant warning message that translates the collected threat data into actionable tasks. This message supports the selection of countermeasures to prevent organizations from falling victim to an attack. If an intrusion cannot be prevented, the extent of the attack must be detected, followed by a reaction and response. These countermeasures should include actions to stop or counterattack the intruder, as well as defined recovery procedures to quickly restore the attacked system to its initial state and resume normal operations. The NIST 800/ISO 27002 standards identify the following key areas for best practices: identifying (data tools, user rights, network anomalies, RATs in services, infrastructure-wide vulnerabilities through audits), preventing (data movement, user abuse, network-level communications, service creation, infrastructure-wide exploitation through interpretation), defending (data access, user credentials, network services, service usage, infrastructure-wide changes through controls), responding (data investigation, user impersonation, network restriction, service control, infrastructure patching through remediation), and recovering (restoring data from backups, user ACLs, network provisioning, establishing a service baseline, infrastructure reconstruction through deployment of a comprehensive policy). Other standards also include areas such as detecting and protecting. Good cybersecurity practices are structured across various levels or areas: at the network level, protecting networks from internal and external attacks, filtering unauthorized access and malicious content, monitoring and testing security controls, and managing network load (QoS); at the malware protection level, establishing anti-malware policies and defenses applicable to all areas of the organization, scanning for malware, and updating antivirus software across the entire organization; at the monitoring level, establishing a monitoring strategy and developing support policies, continuously monitoring all systems and networks, and analyzing logs for unusual activity that may indicate an intrusion attempt or cyberattack; at the incident management level, establishing incident response and disaster recovery capabilities, developing and testing incident management plans, providing training to the incident management team, and reporting criminal incidents to ensure legal action. At the training and awareness level, produce user policies that cover the acceptable and secure use of the organization's systems, establish an evaluable training program for all staff, and maintain user awareness of cyber risks; at the work-from-home and mobile level, develop a mobile work policy and train staff to follow it, implement a secure baseline for all devices, and protect data in transit and at rest; at the user privilege management level, establish account management processes and limit the number of privileged accounts, limit privileges and monitor user activity, and control access to activity and audit logs; at the information risk management level, establish an effective governance structure and determine risks, produce and support risk management policies, and keep users engaged in understanding the importance of the risks; at the secure configuration level, apply security patches and ensure that the secure configuration of all infrastructure systems is maintained, and create an inventory and define a baseline for all infrastructure devices. At the removable media controls level, produce a policy to control all access to removable devices, for example USB, limit the types and uses of removable devices, scan all removable devices for malware before importing them into infrastructure systems.
REFERENCES.
- Areitio, J. “Information Security: Networks, Computing and Information Systems”. Cengage Learning-Paraninfo. 2018.
- Areitio, J. “Identification and analysis of pathological elements for cybersecurity and privacy in digital transformation: Business and Industry 4.0”. Conectrónica Magazine. No. 209. October 2017.
- Areitio, J. “Impact of approaches, strategies, techniques, methods and technologies of protection in cybersecurity-privacy”. Conectrónica Magazine. No. 211. January 2018.
- Areitio, J. “Longitudinal and cross-sectional analysis of network protection in cybersecurity and privacy: a responsibility for all”. Conectrónica Magazine. No. 213. March 2018.
- URL for the online nmap tool (scans the 28 main ports for a specific IP address or name server): http://netping.io/nmap
- URL for the online nmap scanner: http://nmap.online-domain-tools.com/
- URL for the VirusTotal tool (a free service that analyzes suspicious files and URLs and facilitates the detection of viruses, worms, Trojans, etc.; the maximum file size for submission is 128 MB): https://www.virustotal.com/.
- Gupta, PK, Tyagi, V., and Singh, SK. “Predictive Computing and Information Security.” Springer. 2017.
- Icon Group International. “The 2018–2023 World Outlook for Cyber Weapons.” Icon Group International, Inc. 2017.
- Johnson, TA. “Cybersecurity: Protecting Critical Infrastructures From Cyber Attacks and Cyber Warfare.” CRC Press. 2015.
- Ellis, R. and Mohan, V. 'Rewired: The Past, Present and Future of Cybersecurity'. Joh Wiley & Sons Inc. 2019.
- Brooks, CJ, Craig, P. and Short, D. 'Cybersecurity Essentials'. Sybex. 2017.
- Virus testing URL: http://www.eicar.org
- Sanger, DE “The Perfect Weapon: War, Sabotage and Fear in the Cyber Age”. Crown. 2018.
- Prunckun, H. “Cyber Weaponry: Issues and Implications of Digital Arms”. Springer. 2018.
- Gurevich, V. “Cyber and Electromagnetic Threats in Modern Relay Protection”. CRC Press. 2017.
- Brotherston, L. and Berlin, A. 'Defensive Security Handbooks: Best Practices for Securing Infrastructures'. O'Reilly Media. 2017.
- Musa, SM 'Network Security and Cryptography'. Mercury Learning and Information. 2017.
- Chang, CH and Potkonjak, M. 'Secure Systems Design and Trustable Computing'. Springer. 2015
- Colbert, EJM and Kott, A. “Cyber-Security of Scada and Other Industrial Control Systems”. Springer. 2016.
- Zetter, K. “Countdown To Zero Day: Stuxnet and the Launch of the World's First Digital Weapon.” Broadway Books. 2015.
- Westcott, S. and Riescher Westcott, J. “Cybersecurity: An Introduction”. Mercury Learning & Information. 2019.
Author:
Prof. Dr. Javier Areitio Bertolín – E.Mail:
Professor at the Faculty of Engineering, University of Deusto.
Director of the Networks and Systems Research Group.
