Cyber Security and Smart Infrastructure: Research Dr. Stacy Prowell - - PowerPoint PPT Presentation

Cyber Security and Smart Infrastructure: Research

• Dr. Stacy Prowell

Chief Cyber Security Research Scientist Oak Ridge National Laboratory

Main Points

• Information Sharing

– Enable discovering and sharing information about real threats to better focus research and spread best practices.

• Modeling and Simulation

– Build test beds that emphasize repeatability and reproducibility

• f results.
• Research of “Baked In” Resilience

– Conduct research on resilience, both for hardware and software, that addresses the complete environment – including human processes.

• Cyber: Software and hardware, requirements and

specifications, acquisition, deployment, configuration, maintenance.

2

Information Sharing

• Need: Information sharing between public and

private sectors.

– Need the ability to share incident information and mitigation practices. – This kind of information sharing currently introduces regulatory threat, especially when sharing information on suppliers.

• This enables better research by focusing it on the

current critical needs and provides a better measure of success due to better adoption of best practices.

3

Modeling and Simulation

• Many modeling and simulation efforts already exist.

– There are large-scale hardware test beds. – Better emphasize repeatability and reproducibility of results, but also – Better fidelity – applicability to the deployed infrastructure.

• Part of the issue is information – infrastructure is privately owned.

– Smart infrastructure promises better visibility and control, but much of it is privately owned and data is not available to researchers.

• Need:

– Large-scale system modeling and simulation. – Faster than real-time simulations. – Better monitoring, measurements, and data widely available. – Better modeling of consumer response, economic and societal impacts.

4

Research on “Baked In” Resilience

• Software controls are inevitably going to replace physical controls.

– More difficult to understand failure modes, the operating envelope, and system states. – May enable a malicious actor to achieve wide-area effects with correspondingly minimal effort.

• Need: Research emphasizing resilience:

Rapid adaptation to the consequences of a severe or catastrophic event.

– Across all areas: Software, hardware, acquisition, response, …

• Ideas: Rapid reverse engineering of hardware and software in a way

that supports direct analysis and simulation, modeling of the human components of the infrastructure, novel ways of defending these systems outside of traditional cyber, …

5

THANK YOU!

Contact: Dr. Stacy Prowell (prowellsj@ornl.gov)

6