Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a CSW2022_03_threat_environment.pptx.pdf
Similar a CSW2022_03_threat_environment.pptx.pdf (20)
Más de SaraJayneTerp
Último
Último (20)
CSW2022_03_threat_environment.pptx.pdf
- 1. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Session 3: threat environment Disinformation/Malign Influence Training Disarm Foundation | 2022 1 1
- 2. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Course structure Understand environment 1: Introduction 2: Information and response 3: Threats Set up project 4: Project setup 5: Data collection Manage components 6: Influence 7: Narratives 8: Behaviours Manage risk 9: Risk assessment 10: Risk measurement Hotwash Module 3: Threat environment ● Threat models ● Threat actors ● Disinformation as a business ● Other threat components ● Scales ● Exercise: threat landscape 2
- 3. Disinformation/Malign Influence Training, Disarm Foundation | 2022 CogSec: Managing the whole system Information Landscape • Information seeking • Information sharing • Information posting • Information sources • Information voids Harms Landscape • Motivations • Sources/ Starting points • Effects • Misinformation narratives • Hateful speech narratives • Crossover narratives • Tactics and Techniques • Artifacts Response Landscape •Monitoring organisations •Countering organisations •Coordination •Existing policies •Technologies •etc 3
- 4. Disinformation/Malign Influence Training, Disarm Foundation | 2022 What’s in a name? Disinformation Misinformation Conspiracies Rumours 4
- 7. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Example Threat Landscape • Motivations • Geopolitics mostly absent • Party politics (internal, inter-party) • Actors • Political parties • Nationstates • Entrepreneurs • Activities • Manipulate faith communities • discredit election process • Discredit/discourage journalists • Attention (more drama) • Potential harms / severities • Assassination • Voting reduction • Sources • WhatsApp • Blogs • Facebook pages • Online newspapers • Media • Routes • Hijacked narratives • Whatsapp to blogs, vice versa • Whatsapp forwarding • facebook to whatsapp • Social media to traditional media • Social media to word of mouth 7
- 9. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Disinformation Actors Persistent Manipulators Advanced teams • Internet Research Agency • China, Iran teams etc For-profit website networks • Antivax websites • Pink slime sites • “Stolen” US election sites Nationstate media • Sputnik • Russia Today Service Providers Disinformation as a Service • Factories • Ex-marketing, spam etc Ad-Hoc paid teams • EBLA Ghana • PeaceData USA Opportunists Wares Sellers • Clicks • T-shirts • Books etc. Groups •Conspiracy groups •Extremists Individuals •Attention-seekers •Jokers etc 9
- 10. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Actor Types Entities behind disinformation ● Nationstates ● Individuals ● Companies Entities part of disinformation ● DAAS companies Image: https://gijn.org/2020/07/08/6-tools-and-6-techniques-reporters-can-use-t o-unmask-the-actors-behind-covid-19-disinformation/ 10
- 12. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Repeated attention-grabbing 12
- 16. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Because it’s a good way to get what you want… 16
- 18. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Watts’ Advanced Persistent Manipulators “with resources, talent, and technology for advancing their influence over an enduring period” (Clint Watts) ● Gen 1: disrupt the system: hacktivists ○ Hacking to shape public opinion ● Gen 2: exploit the system: extremists (ISIS) ○ Social media influence ● Gen 3: distort the system (Russia) ○ Social media influence fusion centre (personas, news sites, include in-person influence), ● Gen 4: dominate the system (trolling as a service) ○ AI, social bots, false content, in-person, apps ● Gen 5: Own the system (China, corporations) ○ Internet balkanisation to apps, create preferred reality https://www.fpri.org/article/2019/03/five-generations-of-online-manipulation-the-evolution-of-advanced-persistent-manipulators/ 18
- 19. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Disinformation as a business 19
- 20. Disinformation/Malign Influence Training, Disarm Foundation | 2022 The Business of Cognitive Security History ● See “History of information” Businesses ● Disinformation as a service models ● Financial motivations and estimates ● Business effects of disinformation ● Business models behind disinformation and cognitive security ○ Potential business attack vectors ○ Effects from disinformation ○ Hybrid campaigns that include disinformation (ransomware, hack&leak etc). Sectors ● Businesses: potential directions ● Health: medical misinformation trends in Covid19 and Vaccine hesitancy ● Elections: trends around the world ● Disasters: trends around the world ● Warfare: trends around the world ● Other potential areas for disinformation incidents and response. 20
- 21. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Business questions Is there a market here? Does the market pay enough to sustain businesses? Where’s the money coming from? What’s it paying for? Who is already in this space? Who is likely to move into this space? Who is the customer base? What features and restrictions do we have? 21 FOLLOW THE MONEY
- 22. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Market: Pink Slime and Enterpreneurs Image: https://gijn.org/2020/07/08/6-tools-and-6-techniques-reporters-can-use-to-unmask-the-actors-behind-covid-19-disinformation/ 22
- 24. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Market: Disinformation as a service “Doctor Zhivago’s services were priced very specifically, as seen below: ● $15 for an article up to 1,000 characters ● $8 for social media posts and commentary up to 1,000 characters ● $10 for Russian to English translation up to 1,800 characters ● $25 for other language translation up to 2,000 characters ● $1,500 for SEO services to further promote social media posts and traditional media articles, with a time frame of 10 to 15 days Raskolnikov, on the other hand, had less specific pricing: ● $150 for Facebook and other social media accounts and content ● $200 for LinkedIn accounts and content ● $350–$550 per month for social media marketing ● $45 for an article up to 1,000 characters ● $65 to contact a media source directly to spread material ● $100 per 10 comments for a given article or news story” From https://www.recordedfuture.com/disinformation-service-campaigns/ 24
- 25. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Adjacent/ feeder market: Marketing 25 Image: https://chiefmartec.com/2020/04/marketing-technology-landscape-2020-martech-5000/
- 26. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Adjacent markets: ransomware, infosec 26 ● https://sec.okta.com/articles/2020/08/crimeops-operational-art-cyber-crime
- 27. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Adjacent market: Cybersecurity 27
- 29. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Incidents Time-limited events (typically 2-3 days) Areas include: ● Elections ● Disasters ● Other events (e.g. Covid19) ● Geopolitical support (e.g. Crimea) https://www.fireeye.com/blog/threat-research/2021/09/pro-prc-influence-campaign-social-media-websites-forums.html 29
- 30. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Narratives ● Covid isn’t serious ● Covid doesn’t exist ● Individual medical targets ● Medical scams ● MMS prevents ● Alcohol prevents ● etc ● Origin myths ● Escaped bioweapon ● Country x created Covid ● US soldiers took Covid to China ● Resolution myths ● Country y has a Covid cure ● Crossover with conspiracies ● Covid and 5G ● Covid and antivax / anti-Gates ● Helicopters spraying for covid ● Depopulation conspiracy ● Crossover with ‘freedom rights’ ● Anti- stayathome ● 2nd amendment ● anti-immigration ● Usual far-rightwing groups ● Geopolitics ● China, Iran: covert + overt ● “Blue check” disinfo 30
- 31. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Behaviours Techniques used in misinformation or disinformation campaigns Useful to track because they’re often repeated, and we can design mitigations and countermeasures 31
- 32. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Behaviours (RESIST toolkit) 32
- 33. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Artifacts Text, images, videos, audio etc Accounts, groups Connections between them Image: https://www.fireeye.com/blog/threat-research/2021/09/pro-prc-influence-campaign-social-media-websites-forums.html 33
- 34. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Tools ● Bots ● IFTTT variants ● Personas ● Network analysis ● Marketing tools Image: https://twitter.com/conspirator0/status/1249020176382779392 34
- 37. Disinformation/Malign Influence Training, Disarm Foundation | 2022 On every platform Image: Chris Burgess 37
- 38. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Every Country Image: OII Computational Propaganda 38
- 40. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Including Denial of Service Make a system inaccessible Distributed denial of service (DDOS): use a lot of machines to do this, so the attack appears to come from many places Image: wikipedia https://commons.wikimedia.org/wiki/File:Ddos-attack-ex.png https://sec.okta.com/articles/2020/10/kpop-fans-non-traditional-non-state-actors 40
- 42. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Threat landscape Landscape components ● Motivations ● Actors ● Activities ● Potential harms / severities ● Sources ● Routes 42
- 43. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Desk survey questions Information landscape ● What’s the population size? Demographic profile? ● How many people are online, on phones, on social media. Which social media? ● What are people searching for online ● Are they looking mainly internally, or at other countries’ outputs? Risk analysis ● Is this country in existing known disinfo groups and sites ● What’s the chatter like here around known disinformation narratives ● Are there networks of disinfo sites here yet? ● What are the hot-topic issues that disinfo could use? ● Who are the major influencers? Big questions ● How many people are online ● What are they looking at and for? ● What are the main sources of information and disinformation ● What’s from inside the country vs what’s coming in from outside (e.g. Nigeria) More sensitive questions are around partnering: are there sources of friction amongst responders, are government agencies compromised etc. 43
- 44. Disinformation/Malign Influence Training, Disarm Foundation | 2022 Desk Survey Sources ● Information landscape ○ facebook/twitter/mobile use: Datareportal.com ○ Reuters digital news report ○ Languages: wikipedia “languages in <countryname>” ○ https://worldpopulationreview.com ○ https://data.humdata.org ● Response landscape ○ Active responders: AMITT lists of groups and tools and map ○ Larger groups: DFRlab, EuVsDisinfo ○ Google searches ● Harms landscape ○ Disinformation incidents: OII 2020 ○ Websites: Mediabiasfactcheck ○ Google searches, e.g. Country/cities + mis/disinformation ● Activities ○ AMITTs: Red and Blue ○ Assessment questions: Cognitive Security ecosystem assessment 44