[PPT] - Shaping Cyberspace for Our Advantage Randy Cieslak Chief PowerPoint Presentation

SLIDE 1

Shaping Cyberspace for Our Advantage

Randy Cieslak Chief Information Officer 12 November 2013

1

SLIDE 2

Shaping Cyberspace to Our Advantage

1. Understanding Cyberspace 2. Characterizing Cyberspace 3. Using Cyberspace 4. Protecting Cyberspace using Risk Management 5. Protecting Cyberspace through the Information Assurance Framework 6. Suggestions, Solutions and Our Way Ahead

2

SLIDE 3

Understanding Cyberspace

3

“Gimme some of that cyber stuff” “Release the cyber forces!”

SLIDE 4

Cyber – Historical Background

Cyber: Greek: steersman, pilot, helmsman; to steer, guide, govern,

governor

Used today as the short term for “cybernetics” which means:

– The science or study of communication in organisms, organic processes, and mechanical or electronic systems.

Coined by U.S. mathematician Norbert Wiener (1894-1964) who

hypothesized that there is a similarity between the human nervous system and electronic machines.

In his book, Neuromancer (1984), science fiction writer William Gibson (b.

1948) presents the idea of global information network called the Matrix, and the term Cyberspace, by which he meant a virtual reality simulation with a direct neural feedback.

– During the years since Gibson wrote Neuromancer, other names have been created for that shadowy space where computer data exist: the Internet, the Net, the Web, the Cloud, the Matrix, the Metaverse, the Datasphere, the Electronic Frontier, and even the Information Superhighway. – Gibson’s coined term may be the most lasting because by 1989 it was borrowed by the

nline community to describe today’s interconnected computer systems; especially, the

millions of computers on the Internet, and not just a science-fiction fantasy in the author’s imagination.

4

Source: WordInfo.info, Senior Scribe Publications under normal fair use exceptions.

SLIDE 5

Cyberspace Definitions

Cyberspace: the interdependent network of information technology

infrastructures, and includes the Internet, telecommunications networks, computer systems, and embedded processors and controllers in critical industries. Common usage of the term also refers to the virtual environment of information and interactions between people.

5

National Security Presidential Directive 54/Homeland Security Presidential Directive 23 (NSPD-54/HSPD23)

Cyberspace Operations: The employment of cyber capabilities

where the primary purpose is to achieve objectives in or through

cyberspace. Such operations include computer network operations

and activities to operate and defend the Global Information Grid.

JP 1-02

SLIDE 6

Cyberspace Definitions (continued)

6

Cybersecurity Policy: The strategy, policy, and standards regarding

the security of and operations in cyberspace, and encompasses the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network

perations, information assurance, law enforcement, diplomacy,

military, and intelligence missions as they relate to the security and stability of the global information and communications

infrastructure. The scope does not include other information and

communications policy unrelated to national security or securing the infrastructure.

White House Cyberspace Policy Review, June 2009

SLIDE 7

Characterizing Cyberspace

7

“Information Technology and Cyber are different.” Huh?

SLIDE 8

Cyber / Infostructure Modernization Approach

1. Framework to capture efforts
2. Objectives, guidelines and principles to map efforts to the

framework

3. Solutions to meet the requirements from the objectives
4. Architecture that maps the solutions to implementation
5. Plans to implement the solutions
6. Projects to execute the plan
7. Infostructure (Information Infrastructure) Info to provide capability

services

8. Services to provide and enable capabilities
9. Capabilities to accomplish the mission
10. Mission to support and protect our national interests

8

UNCLASSIFIED//FOUO

SLIDE 9

INFORMATION ASSURANCE LAYER

(BACKPLANE)

Information Conditioning & Control Personnel Education & Awareness Identification & Authentication Authorization & Privilege Mgt. Vulnerability Mgt. Boundary Defense Incident Mgt. Continuity

f Ops.

Network Enclave Mgt. Physical Enclave Mgt.

Navy-Led JTF Agency-Led JTF Army-Led JTF JSOTF USAF-Led JTF USMC-Led JTF

USPACOM C2/CS Architecture Framework

Based on the Information Services Reference Model SENSOR & ACTUATOR LAYER

Undersea Sensors Overhead Sensors Cyber Sensors Space Sensors Ground Sensors Unattended Autonomous Vehicles Weapon Platforms

SENSORS ACTUATORS & COMPUTING LAYER TELECOMMUNICATIONS LAYER

Space DSCS WGS UHF EHF-LDR EHF-MDR GBS AEHF LOS/BLOS Radio HF UHF VHF Wireless Mobile Phone / IP Data WIMAX WiFi GSM EVDO Terrestrial / Undersea Undersea Cabling Defense Data Transport Services Commercial Data Transport Services Area Cable Plants LMR TMR CWSP INMARSAT Iridium BBS Commercial Military TSAT JTRS Strategic Direction Exchange Situational Information Monitor Plan Execution Provide / Obtain Authorities Maintain SA / Replan as Necessary Allocate Forces (JTF) Make Sound Decisions

OPERATIONS LAYER

Based on ADM Willard’s C2 Cycle

NETWORKING & ENCLAVING LAYER

Tactical Link 16 TADIL-J Internet NIPRNET SIPRNET CENTRIXSs JWICS DSN DVS-G Link 11 TADIL-A VPNs NSANet POTS

APPLICATIONS LAYER

Common Applications File / Print / Share / E-Mail / Web / Chat / Office Automation / AMHS /GPS / Voice / Video / Collaboration NetCentric Command & Control Battlespace Awareness IntelLink / Intelipedia Force Application BMD / JADOCS Logistics GCSS Force Management Building Partnerships TSCMIS / APAN Protection Corporate Management & Support GCCS / NECC NCES/DCO/CyberDefense Information Retrieval Content Discovery / People Discovery / Service Discovery Mediation Operational Logic Business Rules

INFORMATION CONTENT LAYER

Data Sourcing Timely and Accurate Information Conditioning Common formatting and tagging Presentation & Knowledge Management Dashboards Rendering information for mental consumption Protect the Homeland

STRATEGIC LAYER

Robust Military Capability Cooperative Security Arrangements Strengthen Relationships Reduce Violent Extremism Deter Military Aggression Deter Adversaries from using WMDs

UNCLASSIFIED//FOUO

SLIDE 10

Cyber Discussion Framework

10

Dimensions of Cyberspace Lines of Cyberspace Operations / Capabilities Information Capabilities Exploitation Capabilities Provisioning Operations Defense Active Defense Exploitation Attack Physical Logical (Virtual) Cognitive (Mental)

UNCLASSIFIED//FOUO

SLIDE 11

Cyber Discussion Framework with ISRM*

11

Dimensions of Cyberspace Lines of Cyberspace Operations / Capabilities Information Capabilities Exploitation Capabilities Provisioning Operations Defense Active Defense Exploitation Attack Physical Logical (Virtual) Cognitive (Mental)

MISSIONS, OPERATIONS & EFFORTS

Overarching set of activities to accomplish a major

bjective

PROCESS, TASKS & TRAINING SERVICES

Work and activities to make decisions and produce results – fueled by information INFORMATION CONTENT SERVICES The products and payload for awareness, knowledge, and understanding APPLICATION SERVICES The ability to process, display, produce and consume information SUPPORT, MAINTENANCE, SUSTAINMENT, SHELTER & SPACE Activities and resources that provide manpower, facilities, consumables and technical support of the Infostructure TELECOMMUNICATION SERVICES The ability to move and distribute signals, data and information NETWORKING SERVICES The ability to connect communities for sharing and collaboration

EDGE/COMPUTING SERVICES

The ability to sense and process data, and execute controls

INFORMATION ASSURANCE SERVICES

The ability to protect and assure information and infostructure

GOVERNANCE, MANAGEMENT, ARCHITECTURE, Policies, guidance and activities to design, plan, resource,

rganize, coordinate and oversee

information capabilities and uses PLANNING, & DEVELOPMENT

* ISRM - Information Services Reference Model

UNCLASSIFIED//FOUO

SLIDE 12

Cyber Discussion Framework with ISRM* for Dependencies

12

Dimensions of Cyberspace

Lines of Cyberspace Operations / Capabilities Information Capabilities Exploitation Capabilities Provisioning Operations Defense Active Defense Exploitation Attack

Physical Logical (Virtual) Cognitive (Mental)

MISSIONS, OPERATIONS & EFFORTS

Overarching set of activities to accomplish a major

bjective

PROCESS, TASKS & TRAINING SERVICES

Work and activities to make decisions and produce results – fueled by information INFORMATION CONTENT SERVICES The products and payload for awareness, knowledge, and understanding

APPLICATION SERVICES

SUPPORT, MAINTENANCE, SUSTAINMENT, SHELTER & SPACE

Activities and resources that provide manpower, facilities, consumables and technical support of the Infostructure

TELECOMMUNICATION SERVICES

NETWORKING SERVICES

INFORMATION ASSURANCE SERVICES

The ability to protect and assure information and infostructure GOVERNANCE, MANAGEMENT, ARCHITECTURE, Policies, guidance and activities to design, plan, resource,

rganize, coordinate and oversee

information capabilities and uses PLANNING, & DEVELOPMENT

* ISRM - Information Services Reference Model

EDGE/COMPUTING SERVICES

Th pro exe

SLIDE 13

Cyberspace Operations at USPACOM

13

“Cyberspace Box”

OBSERVE ORIENT DECIDE ACT OBSERVE ORIENT DECIDE ACT

Friendly Decision Loop Adversary Decision Loop CYBERSPACE

Communications (J6) :

Enable capability
Empower users
Protect information
Maintain security
Respond to threats &

vulnerabilities Operations (J3):

Make decisions
Execute C2
Assess impacts

Intelligence (J2):

Assess adversary info gains
Assess threats & vectors
Assess adversary vulnerabilities

Joint Cyber Center

Fuses these operations

Cognitive Friendly Adversary Neutral

Commons

Logical Physical Information Service Reference Model (ISRM)

SLIDE 14

Using Cyberspace

14

“Wouldn’t life be better without computers and cell phones?” “I hate PowerPoint. “I hate e-mail.” “I hate ...”

SLIDE 15

Why we need good information capabilities

15

Effective work
Good decisions
Situation awareness
Learning and understanding
Automatic responsive control
Command and control
Collaboration, coordination and cooperation
Direct
Guide
Inform
Report

Information Actions

SLIDE 16

Share with partners

Our Challenge in Cyber

E m ail/M e ssa gin g Prod uc t T as kin g In p uts fro m c on su m er, P ro du ct av aila bility C o lla bo ra tio n T oo ls W hite B oar d C hat Video /A u dio S har ed A pps C o llab o ra tio n b etw e en A n alys ts, C o ns um e rs In fo rm atio n P us h C ros s-IN T inte llige nc e p rod u cts S elec t P rofile: P rofile 1 C o llec tio n S tatu s

. . .

S ta tus o f co llec tio n ta sks Se arc h Info rm ation S ea rc h o f A ll IN T In tel S o urce s K ey W o rds : P ro d uc t S tatu s S tatu s o f p rod u ction task s A B

Everyday Applications Protect against adversaries

INFORMATION & APPLICATIONS

SLIDE 17

Our Challenge in Cyber

Emphasis on Sharing

Easier to exploit
Good interoperability
Ease of providing new applications
User friendly
Rapid development

Emphasis on Protecting

Harder to exploit
Frustration with safeguards &

controls

Poor interoperability
Technology obsolescence
Slower development

SLIDE 18

Our Challenge in Cyber

Balancing Sharing and Protection

Harder to exploit
Good interoperability
Ease of providing new applications
User friendly
Rapid development

SLIDE 19

Information Assurance

Available - Making sure the information is there when we need it
Sharable - Making sure the information can be disseminated to those

who need it

Integrity - Making sure the information we use, transmit, process, or

stored has not been corrupted or adversely manipulated

Authorized - Making sure we know and allow those accessing our

information

Authenticated - Making sure there is someone responsible for the

information being published or disseminated

Confidential - Making sure the information is protected from

unauthorized disclosure

Non-Repudiable - Making sure the information is ‘tagged’ so when we

send it – we know it got there, and the recipient knows who sent it

SLIDE 20

Cyber Actions to Assure Information Capabilities

6. Assure

– Informed sound decisions – Situational awareness through understanding – Effective and efficient functional capability (work)

5. Assure effective use of application and production processes
4. Maintain and operate cyberspace
3. Sustain and administrate cyberspace
2. Control and manage the cyberspace configuration
1. Resource, control and manage the cyberspace architecture

20

SLIDE 21

Protecting Cyberspace using Risk Management

21

“A risk assumed by one is a risk assumed by all.” We can do better than that.

SLIDE 22

Optimizing Risk, Resources and Rewards

Resources to Achieve Objectives Resources to Avoid Failures Accomplish the Mission Optimal Capability Acceptable Risk Confidence Capability Cyber Design & Implementation Must Balance Risk, Rewards and Resources to Accomplish the Mission

SLIDE 23

Threat - Vulnerability – Exploitation Matrix

Exploit Type

Human / User Technical / System Environmental Unintended Negligence, Ignorance, Lack of Training System Faults; Logical, Physical Natural Calamities Exposure OPSEC Violations Weak Disclosure Policy Weak Classification Guidance Poor Design Design Flaws Poor Quality Natural Calamities Intrusion Social Engineering, Manipulation Lack of Training, Drills Malicious Software (Malware) Mis-Configurations Natural Calamities

Vulnerability Vector Easiest Exploits Most Attended To

23

Threat – Exploitation Matrix

SLIDE 24

Mission Impact Severity Multiplier

Exploit Relative Severity Multiplier Discovery Bad x -1 Denial Worse x -2 Exposure Even Worse x -3 Exfiltration Worse Still x -4 Deception Almost Worst x -5 Takeover Worst X-10

By increasing severity:

24

Mission Impact Severity Multiplier

UNCLASSIFIED//FOUO

SLIDE 25

Defending Cyberspace Through Risk Management

Risk Threat Impact Assurance Measures Vulnerability = x x

f

Adverse Intent Exploitation Capability Asset Value Information Value Mission Accomplishment Operational Capability Endeavor Success Lives at Stake Architecture Asset & Configuration Management Controls, Measures, Safeguards Policies, Practices, Processes Education, Training, Awareness Culture

SLIDE 26

Defending Cyberspace Through Risk Management

Risk Threat Impact Assurance Measures Users Trust System Exposure Vulnerability = Vulnerability = x x

f f

x Procedural Weakness x

Access to System Exposure & Procedural Weaknesses Public: Low Access Partners: Medium Access Private: Selective Access Administrators: High Access No certification No updates No virus protection Poor design No scanning No firewalls Weak passwords Exposed info storage No backups Improper disposal Weak physical protection Poor training

System design and operation must accommodate varying trust levels

SLIDE 27

Controlling Risk

Risk Threat Impact Assurance Measures Vulnerability = x x

f

Minimize Maximize Limit Exposure: Internet Intranet Extranets Adequate Protection Physical Protection Electronic Isolation Cryptographic Isolation Manage Access Access control lists High assurance guards Intrusion detection “DMZ” & Proxies Computer Hygiene Software updates Virus protection Bot detection Clean dead files Best Practices Backup data Manage passwords Maintain vigilance Understand threats Enhanced Practices Honey pots Intrusion traps Redundancy Diversity

SLIDE 28

Cyber Defense Solution Elements

1. Compartmentalization a. Protection of Information Controls b. Separation of Risk Tolerance Deltas 2. Precise Discretionary Access Control 3. Information Conditioning 4. Cyber Awareness 5. Infostructure Control 6. Infostructure Concealment

28

Required Security Acceptable Risk Threshold Information Sensitivity User Trust = =

SLIDE 29

Protecting Cyberspace through the Information Assurance Framework

29

If we can’t describe it, we can’t manage it. If we can’t manage it, we can’t protect it. If we’re not building security into the system, then we’re building the system for the enemy.

SLIDE 30

Adversaries

Cyber Defense Core Depiction

30

System Infrastructure IA / IT / IM Professionals Information Content Users

SLIDE 31

Cyber Defense Core Depiction – Defense in Depth

31

Information Content Community Enclave System Infrastructure USER ACCESS AND PRIVILEGE BASED ON TRUST

Limited Information Access Limited Member Access Limited System Access

SLIDE 32

Cyber Defense Core Depiction – Defense in Depth

32

Information Content Community Enclave System Infrastructure USER ACCESS AND PRIVILEGE BASED ON TRUST

Limited Information Access Limited Member Access Limited System Access

SLIDE 33

Content-Centric Defense-in-Depth

Information Content Community Enclave System Infrastructure USER ACCESS AND PRIVILEGE BASED ON TRUST

Limited Information Access Limited Information Access Limited Member Access Limited Member Access Limited System Access Limited System Access

1. Information Content

Conditioning & Control

2. Identity Authentication

& Authorization

6. Education Training &

Awareness

3. Design, Configuration,

Operations & Admin.

5. Physical Security

Services

Leads to IA Measures

Information Sharing AND Information Protection through a seven layer model

4. Cyber Security

Services

7. Continuity of

Operations

SLIDE 34

Information Assurance Functional Areas

a) Maintain Integrity b) Maintain Availability c) Maintain Confidentiality d) Manage Trust e) Protect Services f) Detect Risks g) React to Intrusions h) Restore Operations

Sustain Defend Respond

Share Information Assures communication, collaboration and information capability for mission accomplishment Protect Information Assure the Mission

SLIDE 35

c. Maintain Confidentiality
d. Manage Trust
e. Protect Services
f. Detect Risks
g. React to Intrusions
h. Restore Operations
a. Maintain Integrity
b. Maintain Availability

SUSTAIN DEFEND RESPOND

Cost of Implementation > Information Assurance Framework

IA Measures IA Functions

Information Assurance Framework

SLIDE 36

Framework cells enable higher fidelity in cost-risk- benefit decisions

Functions CONTROL MITIGATION

Mission Impact? Acceptable Risk? Acceptable Cost?

RESIDUAL RISK COST

36

THREAT

SLIDE 37

Functions Functions Functions

IAF enables alignment to more accurately target measures and determine residual risk

Threats Threat Vectors Potential Vulnerabilities Controls Policy Practices Remaining Vulnerabilities Mitigations Residual Risk

Functions Functions

37

SLIDE 38

Information Assurance Framework

7. Information Content

Control

6. Identity Authentication &

Authorization

5. Education Training &

Awareness

4. Security Operations &

Administration

1. Physical Security

Services a . M a i n t a i n I n t e g r i t y b . M a n a g e T r u s t c . P r

t

e c t S e r v i c e s d . D e t e c t R i s k s e . R e a c t t

I

n t r u s i

n

s f . R e s t

r

e O p e r a t i

n

s FUNCTIONAL ASSESSMENT C O N TR O L M EAS UR ES FUNCTIONS SUSTAIN DEFEND RESPOND

2. Cyber Security

Services CONTROL MEASURES ASSESSMENT

3. Continuity of

Operations

ASSESSMENT “White Team” ANALYSIS “Blue Team” ASSISTANCE “Green Team” EVALUATION “Red Team”

Reversible Class 4

Specific set of measures of the IA Framework is subject to the proficiency activity

Class 1

All elements

f the IA

Framework are subject to the proficiency activity

Class 2

Several selected major areas

f the IA

Framework are subject to the proficiency activity

Class 3

A single functional area of the IA Framework is subject to the proficiency activity

IA Readiness Assessments

Information Assurance Framework

7. Information Content

Control

6. Identity Authentication &

Authorization

5. Education Training &

Awareness

4. Security Operations &

Administration

1. Physical Security

Services a . M a i n t a i n I n t e g r i t y b . M a n a g e T r u s t c . P r

t

e c t S e r v i c e s d . D e t e c t R i s k s e . R e a c t t

I

n t r u s i

n

s f . R e s t

r

e O p e r a t i

n

s FUNCTIONAL ASSESSMENT C O N TR O L M EAS UR ES FUNCTIONS SUSTAIN DEFEND RESPOND

2. Cyber Security

Services CONTROL MEASURES ASSESSMENT

3. Continuity of

Operations

Information Assurance Framework

7. Information Content

Control

6. Identity Authentication &

Authorization

5. Education Training &

Awareness

4. Security Operations &

Administration

1. Physical Security

Services a . M a i n t a i n I n t e g r i t y b . M a n a g e T r u s t c . P r

t

e c t S e r v i c e s d . D e t e c t R i s k s e . R e a c t t

I

n t r u s i

n

s f . R e s t

r

e O p e r a t i

n

s FUNCTIONAL ASSESSMENT C O N TR O L M EAS UR ES FUNCTIONS SUSTAIN DEFEND RESPOND

2. Cyber Security

Services CONTROL MEASURES ASSESSMENT

3. Continuity of

Operations

OR

Information Assurance Framework

7. Information Content

Conditioning & Control

6. Identity Authentication &

Authorization

5. Education Training &

Awareness

4. Design, Configuration,

Operations & Administration

1. Physical Security

Services a . M a i n t a i n I n t e g r i t y b . M a n a g e T r u s t c . P r

t

e c t S e r v i c e s d . D e t e c t R i s k s e . R e a c t t

I

n t r u s i

n

s f . R e s t

r

e O p e r a t i

n

s FUNCTIONAL ASSESSMENT CONTROL MEASURES FUNCTIONS SUSTAIN DEFEND RESPOND

2. Cyber Security

Services C O N T R O L M E A S U R E S A S S E S S M E N T

3. Continuity of

Operations

SLIDE 39

Suggestions, Solutions and Our Way Ahead

39

It’s a journey, not a destination; but there are milestones and checkpoints along the way.

SLIDE 40

Suggested Approach

1. Categorize information to denote the impact of denial or loss 2. Determine the extent of exposure to which community 3. Develop an internet, intranet and extranet design strategy 4. Develop security measures for each network zone a) Isolation means b) Access controls c) Intrusion detection 5. Establish policies, practices and procedures a) Ensure a chain of accountability 6. Manage system interfaces 7. Maintain computer host hygiene and control 8. Provide for awareness, training and education 9. Maintain readiness: Monitor – Detect – React – Respond – Restore

10. Frequently groom and refresh
11. Use teams of experts

White – Blue – Green – Red

12. Resource (fund) accordingly

SLIDE 41

Cyberspace Operational Solutions

Defendable cyber infrastructure

– Shapeable to meet the threat and respond to emergent operational needs – Accommodates risk profiles attendant to each COCOM’s specific mission set so that a risk assumed by one is not a risk assumed by all

Command Attention to Network and Computer Hygiene
Sufficient billets and manpower to maintain, shape and operate Cyberspace
Adequate instrumentation to provide situation awareness, indications and

warnings that can be tailored to each COCOM mission

– To support a tailorable, scalable red/blue cyber dashboard that can support a cyber common operational picture (COP)

Authorities and procedures

– To direct cyber activities – To rapidly ask, task or execute cyber efforts in support of theater missions

Audit and assessment capability

– To perform deep analysis to discover emergent threat vectors and system vulnerabilities

Enhanced planning capability

– To prepare for cyber configuration to be implemented upon mission execution

41

SLIDE 42

USPACOM’s Cyber Defense Development Approach

Primary Goal: C2 Assurance
Challenges: Our C2 infrastructure – “Infostructure,” is inadequate to

support the future needs of decision making and cyber defense – Agile segmentation without isolation – Responsive, flexible acquisition – Defense in Depth – Agility versus robustness

Development Drivers

– Unified Command and Control (UC2) – Computer Aided Network Defense-in-Depth (CANDID) – Discretionary Risk Acceptance

Through Cyber Joint Operating Areas (Cyber JOA)
Operational Network Domains (OND)
Primary Effort: Joint Information Environment Increment 2

42

SLIDE 43