Did a USB drive disrupt a nuclear program? A Defense in Depth (DiD) teaching case

Abstract

Defense in Depth (DiD) has become an industry buzzword. But practicing DiD is easier said than done. While cybersecurity researchers have predominantly focused on securing corporate networks, there remains a serious gap in endpoint-threat awareness. Yet endpoint threats were the progenitor of 68% of breaches and hacks in 2019 (Computers Nationwide, 2022), a vulnerability that increased during the COVID-19 lockdown with relaxed BYOD (Bring Your Own Device) policies, more IoTs, and cheaper and larger USB flash drives. This teaching case uses the 2009 Stuxnet attack on Iran’s nuclear facilities to exemplify how a single USB drive was used as an endpoint threat to disrupt a nuclear infrastructure, drawing attention to the need for and how to practice DiD to counter towering complexities ushered in burgeoning endpoints cyberattacks, from hacks to ransomware. The case shows the need for DiD to simultaneously pay heed toward physical, technical, and processual (administrative) measures to prevent, defend, and mitigate cyberattacks, from hacks to ransomware. The case and its teaching notes highlight the opportunities and challenges of practicing DiD for endpoints, from flash drives to IoTs.

Keywords

Defense in Depth cybersecurity Stuxnet case study

Get full access to this article

View all access options for this article.

References

Absolute (2022). How organizations can protect devices from cyber attacks. URL: https://www.absolute.com/blog/how-can-organizations-protect-devices-from-cyber-attacks/ (Last accessed 19 December 2022).

Computers Nationwide (2022). Getting Endpoint Security Right in 2022. May 10, URL: https://computersnationwide.com/getting-endpoint-security-right-2022/ (Last accessed 19 December 2022).

Crowdstrike (2022). Lateral movement. February 18, URL: https://www.crowdstrike.com/cybersecurity-101/lateral-movement/(Last accessed 19 December 2022).

Datta

(2023). The promise and challenges of the fourth industrial revolution (4IR). Journal of Information Technology Teaching Cases, 13(1), 2–15. DOI: 10.1177/20438869211056938

Datta

Acton

(2022). From disruption to ransomware: lessons from hackers. Journal of Information Technology Teaching Cases, 1–11 DOI: 10.1177/20438869221110246

Diffee

Datta

(2018). Cybersecurity: the three-headed janus. Journal of Information Technology Teaching Cases, 8(2), 161–171. DOI: 10.1057/s41266-018-0037-7

Gartner (2022). Worldwide portable device sales trend. URL: https://www.gartner.com/en/documents/498606

Grisold

Wurm

vom Brocke

, et al. (2022). Managing Process Dynamics in a Digital World: Integrating Business Process Management and Routine Dynamics in IS Curricula. Communications of the Association for Information Systems, 51, 637–656. Retrieved from. https://aisel.aisnet.org/cais/vol51/iss1/5

Kumar

Marston

Sen

(2020). Cyber-physical systems (CPS) security: state of the art and research opportunities for information systems academics. Communications of the Association for Information Systems, 47(1), 678–696. DOI: 10.17705/1CAIS.04731

10.

Markoff

(2010). A silent attack, but not a subtle one, the New York times, 26 september. URL https://www.nytimes.com/2010/09/27/technology/27virus.html (Last accessed: May 5, 2023.

11.

Nuclear Threat Institute (2022), Natanz Enrichment Complex, URL: https://www.nti.org/education-center/facilities/natanz-enrichment-complex/, Last accessed: December 19, 2022.

12.

Wired (2014). An unprecedented look at Stuxnet, the world's first digital weapon by kim zetter. URL: https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/ (Last accessed 19 December 2022).