Nationwide Cyber Situational Awareness Framework for Critical In - - PowerPoint PPT Presentation

A A Conceptual Nationwide Cyber Situational Awareness Framework for Critical In Infrastructures

Hayretdin Bahşi, Olaf Manuel Maennel Centre For Digital Forensics and Cyber Security Tallinn University of Technology

Evolvement of Cyber Security

Technical Technical Organizational Technical Organizational National

Cyber Security of Critical Infrastructures

• National security vs cyber security
• Physical effects of cyber threats
• Dependencies among national

infrastructures

• Cascading effects
• Targets of various hacker groups including

state sponsored ones

What is Situational Awareness (SA)?

Endsley’s Definition

“The perception of the elements in the environment within a volume of time and space, the comprehension

• f their meaning and the projection
• f their status in the near future”

Perception Comprehension Projection

Different Interpretations of Cyber Situational Awareness

High Level Security Reports Information Sharing Network Monitoring Security Event Correlation

Cyber Situational Awareness at National Level

• Situational awareness and national strategies
• National CERTs to national cyber security
• perations
• Capability imrovement beyond of incident

response

• Threat monitoring systems
• Information sharing

Objectives of Nationwide Cyber Situational Awareness

Risk Assessment Support

• Threat
• Vulnerability
• Bussiness
• Benefit from Safety

Domain

Support for Different Decision Making Levels

• National
• Organizational

Nationwide Analysis

• Dependencies among

different CIs

• Detection of coordinated

attacks

Conceptual Nationwide Cyber Situational Awareness Framework

Decision Making Hierarchy

National Level

National security responsibilities

Strategic Level

Alignment of IT and Cyber Security activities with strategic goals and missions

Tactical Level

Management activities of IT and core business units

Operational Level

Day-to-day technical cyber security

• perations

National Decision Makers Decision Makers of Critical Infrastructures

• Incident responders
• Security administrators
• Security analysts
• IT specialists
• IT Unit Managers
• Security Unit

Managers

• Business Unit

Managers

• CEOs
• CIOs
• CISOs
• Heads of Auditing
• Disaster Management

Authorities

• Regulatory Bodies
• National Cyber

Security Council Members

General View of Subsystems

Organizational CSA Subsystems

National CSA Subsytem

Research Agenda

Research Agenda

Socia- Technical Model Ontology Development Data Correlation Privacy Preserving Methods Cyber Threat Intelligence with Honeynets Big Data Analytics

Data Visualization