What is data manipulation? A misconception is that hackers always steal data, but this assumption is incorrect. Data manipulation attacks occur when an adversary does not take data, but instead makes subtle, stealthy tweaks to data for some type of gain or effect. These subtle modifications of data could be as crippling to organizations as data breaches. Data manipulation may result in distorted perception by shifting data around, which could lead to billions of dollars in financial loss or even potential loss of life, depending on the system in question, and the type of data being altered. In some scenarios however, what the attacker does not do may have a more devastating outcome within the data space entity framework. The goal may be to manipulate data to intentionally trigger external events that can be capitalized. The higher the value of the fraud, the greater the chances are that the fraud has compromised data integrity. If the data manipulation does not occur on a specific date but is conducted over several weeks or months, it may be virtually impossible to correct this problem through a single system restore. Read the CSIAC Report to learn more about data manipulation: https://www.csiac.org/csiac-report/data-manipulation/
The CSIAC Podcast - Data Manipulation
Notice: This podcast video may contain personal or third-party views and opinions not associated with the government.
Please see our terms of use located here: https://www.csiac.org/csiac-terms-of-use/
Please see our terms of use located here: https://www.csiac.org/csiac-terms-of-use/
Download Associated Files:
You must be logged in to download files associated with this video podcast. Click here to login.
Presenters
Charlie Merulla
Twenty-Five years' experience in the Information Technology Field working Information Assurance and System/Network Administration. Experience with Cisco IOS, switches/hubs, VPN's, VLAN's, network protocols, IPv6, Windows, and various flavors of Linux operating systems. Migrated numerous DoD systems from DoD Information Assurance Certification and Accreditation (DIACAP) process to the DoD mandated Risk Management Framework (RMF) process, utilizing the Enterprise Mission Assurance Support Service (eMASS) system and Telos Xacta. Presently certified in DoD 8570 IAM Level III.; held other IAT Level III certifications.
Steve Warzala
Mr. Warzala is a Senior Program Manager with Quanterion Solutions Incorporated (QSI) and serves as the CSIAC Outreach Manager. He has nearly 40 years of experience in defining, developing and managing novel research and development (R&D) projects to provide solutions for critically challenging scientific and technical (S&T) problems. His areas of technical specialty include fault tolerant computing, parallel processing and secure computer information systems and networks. Mr. Warzala has served in a variety of functional capacities with Government agencies, commercial organizations and academic institutions. He has a Computer Science degree from Syracuse University and completed extensive graduate coursework in Computer Engineering, Information Science as well as Engineering Management.
Roderick A. Nettles
Mr. Roderick A. Nettles is currently serving as the Deputy Director under our current Cyber Security and Information Systems IAC (CSIAC) Basic Center Operations (BCO) contract, developing/implementing means of improving/assuring performance with existing resources to meet and exceed the customer’s requirements. Mr. Nettles is responsible for leading Quanterion efforts to develop and maintain a viable training program under the CSIAC BCO contract using a mix of company, subcontractor and subject matter expert instructed courses. In addition, serving as the Chief Editor of a cybersecurity journal. Responsible for managing all the day-to-day operations of a quarterly publication. As the editor-in-chief, oversee the editorial board and peer-review team of the quarterly publication and ensures each issue is released on time. Mr. Nettles has a bachelor’s degree in Computer Science and Master in Information Technology Management. He has over 20 years of oversight of Cyber Command and Control Mission System weapon system to include Automated Information Systems which enables mission by synchronizing other cyber weapon systems to produce operational level effects in support of Combatant Commanders worldwide. Mr. Nettles was assigned to CONUS NORAD Region (CONR) 1AF/A6 at Tyndall Air Force Base as the Office In Charge , Command and Control Systems Branch. He was responsible for developing cyber defense Table Top Exercise; validated C2 Tactics, Techniques and Procedures with Twenty-Fourth Air Force (24AF), 33d Network Warfare Squadron (33NWS), Canadian Forces Network Operations Centre (CFNOC), Canadian NORAD Region (CANR) & 5 Air Defense Sectors to hardened NOARD's front line Command and Control Systems. Mr. Nettles was charged with eliminating security vulnerabilities systems—secured C2 mission systems. As the Chief of C2 Systems Branch, Mr. Nettles bridged CANR, CONR & 6 sectors to Defensive Cyber Operations combat methodologies. As a Cyber Operational Planner, he led efforts to identify mission key terrain, "Mapped the Mission” for NORAD Network Enterprise.
Very insightful. Data manipulation cyber attacks are not as mainstream or as well known as other forms of attacks. Considering the effectiveness of unknown and tiny little changes to information here and there, the consequences can be enormous whether financially or politically motivated.
Data manipulation in my industry (central banking) can have serious financial and even economic ramifications . Any thoughts on new tactics/techniques to secure data and prevent such threats from materialising?
Very timely. Thanks for sharing. Next level of analysis can involve mitigation for data manipulation at rest, in transit and during usage inside a computer system by rogue processes.