DHS S&T Cyber Security Division (CSD) Overview TCIPG Industry - - PowerPoint PPT Presentation
Dept. of Homeland Security Science & Technology Directorate DHS S&T Cyber Security Division (CSD) Overview TCIPG Industry Workshop UIUC November 8, 2011 Greg Wigton Program Manager Cyber Security Division Homeland Security Advanced
Greg Wigton Program Manager Cyber Security Division Homeland Security Advanced Research Projects Agency (HSARPA) Gregory.Wigton@dhs.gov 202-254-6140
2
Reduce the Number
Connections Deploy Passive Sensors Across Federal Systems Pursue Deployment
Defense Systems Coordinate and Redirect R&D Efforts
Establish a front line of defense
Connect Current Centers to Enhance Situational Awareness Develop Gov’t-wide Counterintelligence Plan for Cyber Increase Security of the Classified Networks Expand Education
Resolve to secure cyberspace / set conditions for long-term success
Define and Develop Enduring Leap Ahead Technologies, Strategies & Programs Define and Develop Enduring Deterrence Strategies & Programs Manage Global Supply Chain Risk Cyber Security in Critical Infrastructure Domains
Shape future environment / secure U.S. advantage / address new threats
2
3
Research Themes
Tailored Trustworthy Spaces Moving Target Defense Cyber Economics and Incentives Designed-In Security (New for FY12)
Science of Cyber Security Transition to Practice
Technology Discovery Test & Evaluation / Experimental Deployment Transition / Adoption / Commercialization
Support for National Priorities
Health IT, Smart Grid, NSTIC (Trusted Identity), NICE (Education),
Financial Services
4 28 October 2011
5
The Core Missions
1. Preventing terrorism and enhancing security; 2. Securing and managing our borders; 3. Enforcing and administering our immigration laws; 4. Safeguarding and securing cyberspace; and 5. Ensuring resilience to disasters.
Mission 6: Maturing and Strengthening the Homeland Security Enterprise
Foster Innovative Solutions Through Science and Technology
technological solutions
create innovative approaches to key homeland security challenges
28 October 2011
28 October 2011 6
28 October 2011 7
28 October 2011
8
29 October 2010 9
Research Infrastructure to Support Cybersecurity
Trustworthy Cyber Infrastructure (TCI) Cyber Technology Evaluation and Transition (CTET) Foundational Elements of Cyber Systems (FECS) Cybersecurity User Protection and Education (CUPE)
Experimental Research Testbed (DETER)
Researcher and vendor-neutral experimental infrastructure DETER - http://www.isi.edu/deter/
Research Data Repository (PREDICT)
Repository of network data for use by the U.S.- based
PREDICT – https://www.predict.org
Software Quality Assurance (SWAMP)
A software assurance testing and evaluation facility and the
28 October 2011 10
Secure Protocols
DNSSEC – Domain Name System Security SPRI – Secure Protocols for Routing Infrastructure
Process Control Systems
LOGIIC – Linking Oil & Gas Industry to Improve
TCIPG – Trustworthy Computing Infrastructure for the
Internet Measurement and Attack Modeling
Geographic mapping of Internet resources Logically and/or physically connected maps of Internet
Monitoring and archiving of BGP route information
28 October 2011 11
Assessment and Evaluations
Red Teaming of DHS S&T-funded technologies
Experiments and Pilots
Experimental Deployment of DHS S&T-funded
Transition to Practice (CNCI)
New FY12 Initiative
28 October 2011 12
Enterprise Level Security Metrics and Usability Homeland Open Security Technology (HOST) Software Quality Assurance Cyber Economic Incentives (CNCI)
New FY12 Initiative
Leap Ahead Technologies (CNCI) Moving Target Defense (CNCI)
New FY12 Initiative
Tailored Trustworthy Spaces (CNCI)
New FY12 Initiative
28 October 2011 13
Cyber Security Competitions
National Initiative for Cybersecurity Education (NICE) NCCDC (Collegiate); U.S. Cyber Challenge (High School)
Cyber Security Forensics
More later
Identity Management
National Strategy for Trusted Identities
Data Privacy Technologies
New Start in FY13
28 October 2011 14
28 October 2011 15
PEOPLE SYSTEMS INFRASTRUCTURE RESEARCH INFRASTRUCTURE
Secure Protocols Identity Management Enterprise Level Security Metrics & Usability Data Privacy Cyber Forensics Competitions Process Control Systems Internet Measurement & Attack Modeling Experimental Research Testbed (DETER) Research Data Repository (PREDICT) Software Quality Assurance (SWAMP) Software Quality Assurance Homeland Open Security Technology Experiments & Pilots Assessments & Evaluations Cyber Economic Incentives Moving Target Defense Tailored Trustworthy Spaces Leap Ahead Technologies Transition To Practice
DECIDE (Distributed Environment for Critical Infrastructure Decision-
making Exercises)
Provide a dedicated exercise capability to foster an effective, practiced business
continuity effort to deal with increasingly sophisticated cyber threats
Enterprises initiate their own exercises, define their own scenarios, protect their
proprietary data, and learn vital lessons to enhance business continuity
The Financial Services Sector Coordinating Council R&D Committee has
financial institutions to support the project over the next two years.
LOGIIC – Linking the Oil & Gas Industry to Improve Cybersecurity
A collaboration of oil and natural gas companies and DHS S&T to facilitate
cooperative research, development, testing, and evaluation procedures to improve cyber security in Industrial Automation and Control Systems
Consortium under the Automation Federation
TCIPG – Trustworthy Computing Infrastructure for the Power Grid
Partnership with DOE funded at UIUC with several partner universities and
industry participation
Drive the design of an adaptive, resilient, and trustworthy cyber infrastructure
for transmission & distribution of electric power, including new resilient “smart” power grid
16
17
Enable enterprise decision-makers to think through responses to operational disruptions
Sector(s), Market(s), Institution(s)
Provide a dedicated exercise capability for several critical infrastructures in the U.S.
Beginning with Banking and Finance
Foster an effective, practiced business continuity effort to deal with increasingly sophisticated cyber threats
Enterprises will be able to initiate their own large-scale exercises, define their own scenarios, protect their proprietary data, and learn vital lessons to enhance business continuity, all from their desktops
Think through sector impacts of the National Planning Scenarios
Enhance coordination during a large-scale disruption to key infrastructures
The concept has been reviewed by and developed with input from experts at ChicagoFIRST, the Options Clearing Corporation, ABN-AMRO, Eurex, Archipelago, Bank of New York, and CitiBank.
The Financial Services Sector Coordinating Council R&D Committee is organizing a user-group of subject matter experts paid by their respective financial institutions to support the project over the next two years.
Began as a gleam in the eye of a BNY Risk Manager in 2004
Seen as a logical follow-on the the 2003 Livewire Cyber Exercise Simulation Designed to stress the massive interdependencies of critical infrastructures and
help them prepare for low probability / high consequence disruptions
Prototyped in 2005 / 2006 with some Homeland Security funding
Gained FSSCC Support in 2006
Meets a priority FSCCC R&D Need
Transitioned to a $15 million full-scale R&D effort funded by the Department
R&D team led by Norwich University Applied Research Institutes
18
environment for sector-risk exercises
19
Project LOGIIC is a model for
Industry contributes
Requirements and operational expertise Project management Product vendor channels
DHS S&T contributes
National Security Perspective on threats Access to long term security research Independent researchers with technical expertise Testing facilities
20
Opportunity: Reduce vulnerabilities
environments by correlating and analyzing abnormal events to identify and prevent cyber security threats
Approach:
Identify new types of security
sensors for process control networks
Adapt a best-of-breed correlation
engine to this environment
Integrate in testbed and
demonstrate
Transfer technology to industry
Network
Control Network
Correlation Engine
Events
Indications and
21
Federation (AF)
Security of Safety Instrumented Systems SIS Objective: bring a process plant to a safe state when an excursion
SIS increasingly integrated with PCS – is the integrity of production
facilities jeopardized?
LOGIIC SIS will result in
–
Final summary report provides architectural recommendations for PCS/SIS integration
–
Outreach to standards bodies and the sector is underway
Current TCIPG Effort
Jointly funded with Department Of Energy
University of Illinois at Urbana-Champaign Washington State University Cornell University Dartmouth University University of California at Davis
Over 40 Graduate and Undergraduate Students External Advisory Board (8 members) Industry interaction board (75 members)
23
Administered by the Dept. of Homeland Security’s Control Systems
Security Program.
Provides a vehicle for collaboration between government and private
sector control systems stakeholders
Government Coordinating Council Sector Coordinating Council Subject Matter Experts
Meets twice a year in conference as a plenary session, sub groups
meet as needed.
Includes 5 subgroups plus 1 Pending
ICS Roadmap Development International Research and Development Standards and Metrics (pending) Vendor / Public Coordination Workforce Development
24
planned research and development needs and priorities as they relate to industrial control systems
relate to ICS
sharing sensitive R&D information
25
Delivers both near-term and medium-term solutions
To develop new and enhanced technologies for the detection of, prevention
infrastructure, based on customer requirements
To perform research and development (R&D) aimed at improving the security
cybersecurity systems;
To facilitate the transfer of these technologies into operational environments.
Proposals Received According to 3 Levels of Technology Maturity
28 October 2011 26
Type I (New Technologies) Applied Research Phase Development Phase Demo in Op Environ. Funding ≤ $3M & 36 mos. Type II (Prototype Technologies) More Mature Prototypes Development Phase Demo in Op Environ. Funding ≤ $2M & 24 mos. Type III (Mature Technologies) Mature Technology Demo Only in Op Environ. Funding ≤ $750K & 12 mos.
Note: Technology Demonstrations = Test, Evaluation, and Pilot deployment in DHS “customer” environments
28 October 2011 27
TTA-1
TTA-2
TTA-3
TTA-4
TTA-5
TTA-6
TTA-7
TTA-8
TTA-9
TTA-10
TTA-11
TTA-12
TTA-13
TTA-14
28 October 2011 28
Important program for creating new innovation and
Since 2004, DHS S&T Cyber Security has had:
60 Phase I efforts 27 Phase II efforts 4 Phase II efforts currently in progress 9 commercial/open source products available Three acquisitions
Komoku, Inc. (MD) acquired by Microsoft in March 2008 Endeavor Systems (VA) acquired by McAfee in January 2009 Solidcore (CA) acquired by McAfee in June 2009
28 October 2011 29
Initial requirements working group held November 2008
Attendees from USSS, CBP, ICE, FLETC, FBI, NIJ, TSWG,
Initial list of project requirements -
Mobile device and GPS forensic tools LE First responder “field analysis kit” High-speed data capture and deep packet inspection Live stream capture for gaming systems Memory analysis and malware tools Info Clearing House
Mobile Device Forensics NAND/NOR Chip Forensics (Lab Tool)
Reading the data stored on the chip Reverse engineering of the wear-leveling algorithm Mounting the file system
Bypassing PIN/PUK Codes
Tool to extract PIN / PUK codes from locked SIM cards
Disposable Cell Phone Analysis
Demonstration and development of methods and tools
28 October 2011 30
28 October 2011 31
1997 1998 2000 2001 2003 2004 2005 2006 1999 2002 2007 President’s Commission on CIP (PCCIP) NRC CSTB Trust in Cyberspace I3P R&D Agenda National Strategy to Secure Cyberspace Computing Research Association – 4 Challenges NIAC Hardening the Internet PITAC - Cyber Security: A Crisis of Prioritization IRC Hard Problems List NSTC Federal Plan for CSIA R&D NRC CSTB Toward a Safer and More Secure Cyberspace All documents available at http://www.cyber.st.dhs.gov
28 October 2011 32
http://www.cyber.st.dhs.gov
Scalable Trustrworthy Systems Enterprise Level Metrics System Evaluation Lifecycle Combatting Insider Threats Combatting Malware and Botnets Global-Scale Identity Management Survivability of Time-Critical
Systems
Situational Understanding and Attack
Attribution
Information Provenance Privacy-Aware Security Usable Security
Cybersecurity research is a key area of innovation
DHS S&T continues with an aggressive cyber
Working to solve the cyber security problems of our
Working with academe and industry to improve research
Looking at future R&D agendas with the most impact for
Need to continue strong emphasis on technology
28 October 2011 33
28 October 2011 34
Greg Wigton Program Manager Cyber Security Division Homeland Security Advanced Research Projects Agency (HSARPA) Gregory.Wigton@dhs.gov 202-254-6140