A MODERN GREAT WALL: PRC SMART CITIES AND THE A2/AD IMPLICATIONS FOR AFSOC

The People’s Republic of China’s (PRC) proliferation of smart cities—integrated, government-controlled urban surveillance networks—has increased the persistent stare of surveillance technologies globally. While the place of smart cities in strategic competition has been studied, the capability of PRC smart cities to achieve military ends like Anti-Access/Area-Denial (A2/AD) has yet to be explored by Air Force Special Operations Command (AFSOC). The structure and capabilities of PRC smart cities reveal potential A2/AD threats and exploitation opportunities for AFSOC. Using the Integrated Air Defense System (IADS) as a model, this study suggests that PRC smart cities can function as IADS-like weapon systems, with a dispersed network of surveillance technologies integrated via a centralized control layer. PRC smart cities could produce at least two A2/AD threats to AFSOC: denial of aircraft entry to airspace and suppression of logistics and sustainment requirements (e.g., electricity and fuel). Conversely, AFSOC can exploit PRC smart cities using cyber-attacks—such as distributed denial of service and software manipulation—to preserve access and placement. This thesis concludes that AFSOC should pursue two lines of effort by investing in both: “living off the grid” independent of smart city infrastructure and new cyber technologies and tactics for Suppression of Enemy Information Systems—actions to disturb smart city command and control—to combat and exploit PRC smart cities.Major, United States Air ForceApproved for public release. Distribution is unlimited

IoT Health Devices: Exploring Security Risks in the Connected Landscape

The concept of the Internet of Things (IoT) spans decades, and the same can be said for its inclusion in healthcare. The IoT is an attractive target in medicine; it offers considerable potential in expanding care. However, the application of the IoT in healthcare is fraught with an array of challenges, and also, through it, numerous vulnerabilities that translate to wider attack surfaces and deeper degrees of damage possible to both consumers and their confidence within health systems, as a result of patient-specific data being available to access. Further, when IoT health devices (IoTHDs) are developed, a diverse range of attacks are possible. To understand the risks in this new landscape, it is important to understand the architecture of IoTHDs, operations, and the social dynamics that may govern their interactions. This paper aims to document and create a map regarding IoTHDs, lay the groundwork for better understanding security risks in emerging IoTHD modalities through a multi-layer approach, and suggest means for improved governance and interaction. We also discuss technological innovations expected to set the stage for novel exploits leading into the middle and latter parts of the 21st century

Identifying attack surfaces in the evolving space industry using reference architectures

The space environment is currently undergoing a substantial change and many new entrants to the market are deploying devices, satellites and systems in space; this evolution has been termed as NewSpace. The change is complicated by technological developments such as deploying machine learning based autonomous space systems and the Internet of Space Things (IoST). In the IoST, space systems will rely on satellite-to-x communication and interactions with wider aspects of the ground segment to a greater degree than existing systems. Such developments will inevitably lead to a change in the cyber security threat landscape of space systems. Inevitably, there will be a greater number of attack vectors for adversaries to exploit, and previously infeasible threats can be realised, and thus require mitigation. In this paper, we present a reference architecture (RA) that can be used to abstractly model in situ applications of this new space landscape. The RA specifies high-level system components and their interactions. By instantiating the RA for two scenarios we demonstrate how to analyse the attack surface using attack trees

PADS: Practical Attestation for Highly Dynamic Swarm Topologies

Remote attestation protocols are widely used to detect device configuration (e.g., software and/or data) compromise in Internet of Things (IoT) scenarios. Unfortunately, the performances of such protocols are unsatisfactory when dealing with thousands of smart devices. Recently, researchers are focusing on addressing this limitation. The approach is to run attestation in a collective way, with the goal of reducing computation and communication. Despite these advances, current solutions for attestation are still unsatisfactory because of their complex management and strict assumptions concerning the topology (e.g., being time invariant or maintaining a fixed topology). In this paper, we propose PADS, a secure, efficient, and practical protocol for attesting potentially large networks of smart devices with unstructured or dynamic topologies. PADS builds upon the recent concept of non-interactive attestation, by reducing the collective attestation problem into a minimum consensus one. We compare PADS with a state-of-the art collective attestation protocol and validate it by using realistic simulations that show practicality and efficiency. The results confirm the suitability of PADS for low-end devices, and highly unstructured networks.Comment: Submitted to ESORICS 201