Integrated Adaptive Cyber Defense: Integration Spiral Results Wende Peters, JH-APL wende.peters@jhuapl.edu iacd@jhuapl.edu September 2015 Integrated Adaptive Cyber Defense
Cybersecurity Reality in the Greater Cyber Ecosystem We aren’t controlling the space or the outcomes Source: Verizon 2014 Data Breach Investigation Report Source: M-Trends 2015: A View From the Front Lines, FireEye/Mandiant We’re getting worse at this 2 Integrated Adaptive Cyber Defense
What Does Success Look Like? Secure integration and automation across a diverse, changeable array of cyber defense capabilities DOD CIKR Private Sector SLTT Fed/Civ Sector Coordinate National-level operations National and support cross-enterprise cyber response Enable collaborative, ‘beyond -line- Regional of- sight’ defense Local Enable participants to defend themselves 3 Integrated Adaptive Cyber Defense
What Does Success Look Like? Secure integration and automation across a diverse, changeable array of cyber defense capabilities • Dramatically change timeline and effectiveness • Enable consistent effects in cyber-relevant time • Provide operational and acquisition freedom to take advantage of advances • Support use of existing and emerging standards to enable commercial-based solutions • Ensure control and action that can be achieved under network owners’ authorities and capabilities Integrated Adaptive Cyber Defense (IACD) is our initiative to address these challenges 4 Integrated Adaptive Cyber Defense
IACD Spiral Approach Using an Agile Approach – Requirements and Capability Elicitation and Efficiency and Security Improvement Demonstration 0 Make it Real IACD Spirals 1 Heterogeneity, Scalability and Auto-Indicator Sharing 2 Risk- and Mission-based Decision Complexity Robust Controls for COA Sharing 3 Today 4 Message Fabric Integration and Trust-based Access 5 Integrated Adaptive Cyber Defense
First: Every Defender Brings Their Own Enterprise Their own profile, priorities, capabilities, and risk tolerance Perimeter/Boundary Protections How do we maximize Email Guard Deep Malicious Web IDS/ Trusted Packet Behavior Content the effectiveness of our IPS Sensors Email Content Inspection Prediction Filtering Filtering current and future Repositories cyber defense and Analytic Clouds capabilities? Network/Infrastructure Protections Big Data Discovery SIEM Behavior Malicious NIDS/ Malware Based Behavior Predictive NIPS Detonation Detection Prediction Analytics How do we Host-based Protections interconnect our Continuous Human Behavior capabilities to ‘ move HIDS/ Malware App Monitoring// Input Based HIPS Detonation Whitelisting Cont Diag & left of boom ’? Detection Mitigations 6 Integrated Adaptive Cyber Defense
Challenge: Integrate and Automate Across What They Bring Perimeter/Boundary Protections Email Guard Deep Malicious Web ACTING IDS/ Trusted Packet Behavior Content IPS Sensors Email Content Inspection Prediction Filtering Filtering Repositories and Analytic Clouds DECISION- Network/Infrastructure Protections Big Data MAKING Discovery SIEM Behavior Malicious NIDS/ Malware Based Behavior Predictive NIPS Detonation Detection Prediction Analytics SENSE-MAKING Host-based Protections SENSING Continuous Human Behavior HIDS/ Malware App Monitoring// Input Based HIPS Detonation Whitelisting Cont Diag & Detection Mitigations 7 Integrated Adaptive Cyber Defense
IACD Functionality Inside the Enterprise • What core interoperable, flexible Presentation and Ops Services Presentation and Ops Services services need to exist to integrate and Visualization automate across our defenses? Analytics/Workflow Development • What will it take to create, manage, and Management Interface control this integration Response Actuator IFs • What content needs to be available and Actions Boundary Orchestration, Management Response Protections exchangeable? Controllers Control, Secure COAs Repositories Bus Rules DM Engine Network • How will we interconnect the capabilities Protections inside the enterprises? SM Analytic Analytics Framework Host Protections Data Feeds • Will performance or security drive Sensing I/F separate control needs? Services Defense Services Content • What tools must be provided to the Control Message Infrastructure analysts and operators? Information Sharing Infrastructure • What trust, identity, and security needs Sharing Infrastructure to be in place to assure mission? Trust Services: Security, Identity, Access Control 8 Integrated Adaptive Cyber Defense
IACD Functionality Across/Among Diverse Enterprises National/Global: NCCIC, GEOC, National Cyber Centers v IACD/EASE Control Channel v Regional: Sectors, EOCs, Communities v IACD/EASE Control Channel v v v v Local: Enterprise, D/A, CIKR, B/P/C 9 Integrated Adaptive Cyber Defense
Agile Approach to Capability Demonstration and Requirements/Standards Elicitation For each 90 day spiral, focus on some subset of target IACD capabilities – Within a single enterprise or across multiple enterprises with multiple roles Integrated Adaptive Cyber Defense
Agile Approach to Capability Demonstration and Requirements/Standards Elicitation IACD Activity Scope IACD Use Cases Defend-the-Enterprise - Local Integration & Automation Compliance Checking/Auto-remediation Auto-enrichment/Decision Support Trusted Automated Information Sharing Reputation-based Decision Trusted Integrated Response Actions Detect/mitigate Vulnerabilities IACD Participant Scope Detect/mitigate Malware Fed/Civ Departments/Agencies Behavior-based Indications DOD Cross-enterprise Tipping Law Enforcement Automated Indicator Sharing Inter-Agency CIKR Low-Profile Response Private Sector Partners Regeneration Foreign Partners Rollback/Restoration SLTT Partners Ensure coverage of the operational space, including types of missions, user roles and authorities, and desired use cases Integrated Adaptive Cyber Defense
Federated Innovation, Integration & Research Environment for IACD Spirals Reputation Sources Internet Virtualized Internet National Element Enterprise 1 Enterprise 2 Enterprise 3 Enterprise 4 Integrated Adaptive Cyber Defense
Spiral 0 Emphasis: Orchestration and Automation Intra-Enterprise COA Auto-enrichment Auto-Response Decision Increasing speed of assessment, efficient use of limited analyst resources 13 Integrated Adaptive Cyber Defense
Spiral 1 Emphasis: Indicator Sharing and Auto-Response Across Communities of Trust Auto-Indicator Auto- COA Auto-Response Decision Ingest enrichment Auto-Response Auto- COA enrichment Decision Auto-Indicator Sharing IACD-informed Scale across multiple, Auto-Indicator Auto- COA Human-in-loop Recomm Ingest enrichment heterogeneous environments Response Distributed use of advanced solutions 14 Integrated Adaptive Cyber Defense
Spiral 2 Emphasis: Risk- and Mission-based Decision Complexity Indicator Auto- Auto- Auto- COA Indicator Indicator Decision Assessment Response Ingest Indicator 15 Integrated Adaptive Cyber Defense
Spiral 2 Emphasis: Risk- and Mission-based Decision Complexity Auto-Indicator Auto- COA Auto-Response Decision Ingest enrichment Auto-Response Auto- COA Auto- Auto- Auto- enrichment COA Decision Indicator Decision enrichment Response Auto-Indicator Ingest Sharing IACD-informed Auto-Indicator Auto- COA Human-in-loop Recomm Ingest enrichment Response 16 Integrated Adaptive Cyber Defense
IACD FIIRE Configuration Reputation Sources Enterprise 1 Internet Virtualized Internet National Element Represents a ‘security power user’ type enterprise with multiple security products Infrastructure Subnet • Orchestration • Domain Controller • MS Exchange • File Detonation Enterprise 1 Enterprise 2 Enterprise 3 Operations Subnet • Application User VMs (x20) Whitelisting Human Resources Subnet • AV/Host IPS User VMs (x20) • Firewall Logs • Netflow T raffic Research & Development Subnet • Indicator Storage User VMs (x20) IT Subnet • Indicator Sharing User VMs (x20) DIB Member Small CIKR/ Bus DOD 17 Integrated Adaptive Cyber Defense
IACD FIIRE Configuration Reputation Sources Internet Virtualized Internet National Element Enterprise 2 Represents a smaller, cost- sensitive enterprise utilizing open source solutions Infrastructure Subnet Enterprise 1 • Enterprise 2 Enterprise 3 Orchestration • Domain Controller • IDS • MS Exchange Operations Subnet • Web Traffic Analysis User VMs (x20) • Netflow Human Resources Subnet • File Retrieval User VMs (x20) • Firewall Logs Research & Development Subnet • Netflow T raffic • Indicator Storage User VMs (x20) DIB Member • Ticketing Small CIKR/ Bus DOD IT Subnet • Indicator Sharing User VMs (x20) 18 Integrated Adaptive Cyber Defense
Recommend
More recommend
