Index
Note: Page numbers followed by “f” and “t” refer to figures and tables, respectively.
A
Access class barring (ACB) mechanism,
121Account credentials chain attack,
49–52credit card attack surface,
51Adoption, of wireless technology,
21–22Advanced persistent threat (APT) activity,
28Alliance for Telecommunications Industry Solutions (ATIS),
5American Radio Relay League,
21–22ANSI Network on Smart and Sustainable Cities (ANSSC),
103Attack strategy
commercial applications,
70–72victim’s chronology,
69–70command and control (C&C),
28denial-of-service (DoS),
28Internet of Things (IoT),
29–30layered vulnerabilities,
30malware transmission,
27–28SMS infection vector,
28–29Authentication attacks,
7,
9Automated access class barring (AACB),
120Automated business-to-business activities,
74Automatic identification and data capture (AIDC) technology,
15Availability attacks,
7,
9B
Black Hat Conference,
26–27Bluetooth Low Energy (BLE) guideline,
14–15Bogus email and snail messages,
57–58“Boy in the bubble” syndrome,
69–70Business productivity devices,
69–70C
Call to action
credentials and access control,
135–136network architecture,
135security-conscious culture,
136Central and Eastern European countries (CEEs),
23–24Central locking systems,
70Children’s Online Privacy Protection Act of 1998 (COPPA),
80Citizen to government (C2G) services,
100–101Clinician-focused active medical devices,
83Code-division, multiple-access (CDMA) networks,
118–119Cognitive Wireless Regional Area Network (WRAN),
11Command and control (C&C),
28attacks, on automated processes,
9Commercial and industrial contexts, WAPs in,
63commercial space taxonomy,
65–74industrial applications,
67Commercial space taxonomy,
65–74Common access cards (CACs),
99Common operating picture (COP),
115Confidentiality attacks,
7,
8Consumer price index comparison of telephone services,
24fCopper, signals transmitted over,
7Copper-wire connection,
4Credit card attack surface,
51Cyber-espionage figures,
64–65D
Denial-of-service (DoS) attacks,
11–13,
17,
28Department of Interior (DoI),
96–97Department of Transportation (DoT),
97–98Device logs, analysis of,
74Digital forensics tools/techniques,
63–64Digital infections,
77–78Digital pickpocketing and data slurping,
58–59Distributed denial of service (DDoS) attack,
65–67E
E-filing PIN system, attacks against,
98Electromagnetic interference (EMI),
4Electromagnetic signals,
3Electronic Communications Privacy Act of 1986 (ECPA),
80Electronic medical records (EMRs),
8–9and medical devices,
81–85and industrial control systems (ICS),
86–88Electronic official personnel folder (eOPF),
96–97Electronics Product Code Global Incorporated (EPCglobal),
15–16Emergency management, public safety and,
111–112End-to-end security in communications,
7European Telecommunications Standards Institute (ETSI),
5,
7–8F
Federal Communications Commission (FCC),
21–22Federal Educational Rights and Privacy Act of 1974 (FERPA),
80Federal Emergency Management Agency (FEMA),
111Federal Information Systems Management Act of 2002 (FISMA),
93,
123Financial Services Modernization Act of 1999,
80Firewalls, implementing,
78–79First Responder Network Authority (FirstNet),
113,
121512-bit encryption keys,
55Fixed and mobile wireless access points,
1differentiation between,
3–4hybrid networks and communications channels
challenges for securing,
5–6hacking opportunities in,
4–5recommendations for wireless/hybrid systems,
10–12use case scenarios,
12–13wired networks and systems, implications for connections with,
6–10authentication attacks,
9C&C attacks on automated processes,
9confidentiality attacks,
8network penetration attacks,
7–84G long-term evolution (LTE),
113,
120Frequency hopping spread spectrum (FHSS) technology,
13–14G
Global system for mobile (GSM),
118–119Google accounts, accessing,
51Government Emergency Telecommunications Service (GETS),
118–121Governmental context, for hacking wireless access points,
93Gramm-Leach-Bliley Act (GLBA),
80Gullibles travel attack,
54–56victim’s chronology,
54–55H
Hacking goals
strategies and steps,
30–31Health Information Portability and Accountability Act of 1996 (HIPAA),
79,
80,
88Health information technology (HIT) environment,
79Health Information Technology and Economics Clinical Health (HITECH) Act,
80Hollywood Presbyterian Hospital attack,
79,
84–85Hybrid networks and communications channels
challenges for securing,
5–6hacking opportunities in,
4–5I
Incremental security actions,
133–134Independent Security Advisors,
83Indicators of attack (IoA),
97Indicators of compromise (IoC),
97Individuals, hacks against,
47account credentials chain attack,
49–52credit card attack surface,
51gullibles travel attack,
54–56victim’s chronology,
54–55internet of hacked things attack,
56–59bogus email and snail messages,
57–58digital pickpocketing and data slurping,
58–59public Wi-Fi hotspot attack,
52–54honeypot look-alike,
52–53Industrial applications,
67Industrial control systems (ICS) technologies,
16Industrial facilities,
63Industrial sabotage,
67–74Information and communications technologies (ICTs),
5Inspector Gadget cyborg,
56Institute of Electrical and Electronics Engineers (IEEE),
5,
5,
9Insulin pump attack,
83–84Integrity attacks,
7,
8–9Interconnected medical devices (IMDs)
Interconnectivity model,
13–14International Electrotechnical Commission (IEC),
15–16International Standards Organization (ISO),
5International Telecommunications Union (ITU),
5,
7,
7Internet Engineering Task Force (IETF),
5,
8Internet of Everything (IoE),
1–2Internet of hacked things attack,
56–59bogus email and snail messages,
57–58digital pickpocketing and data slurping,
58–59Interoperability challenges,
112–115Intrusion detection systems (IDS),
74Intrusion prevention system (IPS),
71IRS E-filing PIN system, attacks against,
98J
K
KeyPoint Government Solutions,
94L
Layered vulnerabilities,
30Legacy technology infrastructure,
55Local area network (LAN) technologies,
5,
9–10M
Machine-to-machine (M2M) communications,
116Magnetic stripe technology,
58Malware families with C&C servers,
10tMarket penetration, wireless,
22–23Medical environments, WAPs in,
77convenience factors versus system responsiveness,
79EHRs, medical devices, and ICS,
86–88Hollywood Hospital hack attack,
84–85through interconnected medical devices,
143Metropolitan area network (MAN),
9–10Middle Class Tax Relief and Job Creation Act of 2012,
113Mobile apps vetting process,
117Mobile broadband wireless,
11Money, in security program,
130Motivation, of hacker,
2tN
National Association of State Chief Information Officers (NASCIO),
100–101National Incident Management System (NIMS),
112National Institute of Standards and Technology (NIST),
5,
7–8,
14,
73National Public Safety Broadband Network (NPSBN),
121,
122freal-world attack scenarios,
123–125National Security and Emergency Preparedness (NS/EP),
112f,
121National Security Telecommunications Advisory Committee (NSTAC),
121Near field communication (NFC) devices,
55Network penetration attacks,
7–8,
7Next generation network (NGN) infrastructure,
121Noncivilian government context,
109challenges
policy and procedure,
115National Public Safety Broadband Network (NPSBN),
121,
122freal-world attack scenarios,
123–125public safety and emergency management,
111–112representative challenges
policy and procedure,
115North American Industry Classification Standard (NAICS) code,
64–65O
Office of Emergency Communications (OEC),
118,
118Office of Personnel Management (OPM),
94,
94–95Open Systems Interconnection (OSI) model,
6,
7Open Web Application Strategy Project (OWASP),
30,
30fOpenBerlin Innovation Center,
70Over-the-air provisioning (OTAP) protocols,
6P
Panopticon-style environments,
57Passive medical device,
82Patient-focused active medical devices,
82Patient-focused passive medical devices,
82Patrol cars, communications in,
22PEAR (preparation, execution, awareness, repetition),
130Peer-to-peer networking,
8Personal area network (PAN),
9–10Personal identity verification (PIV) cards,
99Personally identifiable information (PII),
48,
55Picture archive and communications systems (PACS) pivot attack,
87–88Plain old telephone system (POTS) infrastructure,
23–24,
24–26,
26Point-to-multipoint capability,
14Point-to-point connectivity,
7,
65Polymorphing malware, proliferation of,
27–28Privacy Clearinghouse,
80Process-focused active medical devices,
83Programmable logic controllers (PLCs),
69,
71,
71Public Safety Access Point (PSAP),
120–121Public safety and emergency management,
111–112Public Wi-Fi hotspot attack,
52–54honeypot look-alike,
52–53Public wireless router attack surface, exploiting,
53Public/private partnerships,
93R
Radio aspect of wireless,
2Radio Frequency Identification (RFID),
1–2,
15–16Radio resource management (RRM),
6Random access channel (RACH),
120Regional area network (RAN),
9–10Remote authentication dial-in user service (RADIUS) cracking,
7Rogue access points,
8,
9S
Secure Mobile Computing initiative,
56Secure Simple Pairing (SSP),
14Security engineer’s view on autonomous vehicles,
139Service set identifier (SSID),
8,
9Signals transmitted over copper,
7Simplified wireless devices,
4Smart Grid Coordination Group (SG-CG),
7–8SMS infection vector,
28–29Spearphishing attack,
142Supervisory Control and Data Acquisition (SCADA),
16–17,
67T
Technology penetration rates, longitudinal comparison of,
25tTelecommunications rules of engagement,
6–8Telecommunications standards,
5–6Telephone service, wireless,
22Telephone services, consumer price index comparison of,
24fThinking like a hacker
sustainment, assault, obfuscation,
133–134Third Generation Partnership Project (3GPP),
5,
8U
UN Hacker Profiling Project (HPP),
1US Investigations Services (USIS),
94,
94US Office of Personnel Management (OPM),
81,
94,
94,
96V
Vehicle cyber security,
97–98W
Wide area network (WAN),
9–10Wired networks and systems, implications for connections with,
6–10authentication attacks,
9C&C attacks on automated processes,
9confidentiality attacks,
8network penetration attacks,
7–8Wireless attack elements
C&C (ICS Environment),
28Internet of Things (IoT),
29–30layered vulnerabilities,
30malware transmission,
27–28SMS infection vector,
28–29Wireless communications rules of engagement,
8–9Wireless consumer-grade surveillance devices,
57Wireless equivalent privacy (WEP),
9,
9Wireless LAN controller (WLC),
6Wireless LAN/Wi-Fi (802.11X),
11–13Wireless Local Area Network (WLAN),
10Wireless market penetration,
22–23Wireless medical devices,
82–83Wireless Metropolitan Area Network (WMAN)/WiMAX (802.16),
11,
13,
13Wireless Priority Service (WPS),
118–121Z