Cyber Security and Smart Infrastructure: Research Dr. Stacy Prowell - PowerPoint PPT Presentation

Cyber Security and Smart Infrastructure: Research Dr. Stacy Prowell Chief Cyber Security Research Scientist Oak Ridge National Laboratory

Main Points • Information Sharing – Enable discovering and sharing information about real threats to better focus research and spread best practices. • Modeling and Simulation – Build test beds that emphasize repeatability and reproducibility of results. • Research of “Baked In” Resilience – Conduct research on resilience, both for hardware and software, that addresses the complete environment – including human processes. • Cyber: Software and hardware, requirements and specifications, acquisition, deployment, configuration, maintenance. 2

Information Sharing • Need : Information sharing between public and private sectors. – Need the ability to share incident information and mitigation practices. – This kind of information sharing currently introduces regulatory threat , especially when sharing information on suppliers. • This enables better research by focusing it on the current critical needs and provides a better measure of success due to better adoption of best practices. 3

Modeling and Simulation • Many modeling and simulation efforts already exist. – There are large-scale hardware test beds. – Better emphasize repeatability and reproducibility of results, but also – Better fidelity – applicability to the deployed infrastructure. • Part of the issue is information – infrastructure is privately owned. – Smart infrastructure promises better visibility and control , but much of it is privately owned and data is not available to researchers. • Need : – Large-scale system modeling and simulation. – Faster than real-time simulations. – Better monitoring, measurements, and data widely available. – Better modeling of consumer response , economic and societal impacts . 4

Research on “Baked In” Resilience • Software controls are inevitably going to replace physical controls. – More difficult to understand failure modes, the operating envelope, and system states. – May enable a malicious actor to achieve wide-area effects with correspondingly minimal effort. • Need : Research emphasizing resilience: Rapid adaptation to the consequences of a severe or catastrophic event. – Across all areas: Software, hardware, acquisition, response, … • Ideas: Rapid reverse engineering of hardware and software in a way that supports direct analysis and simulation, modeling of the human components of the infrastructure, novel ways of defending these systems outside of traditional cyber, … 5

Contact: Dr. Stacy Prowell (prowellsj@ornl.gov) THANK YOU! 6