cyber defence data exchange and collaboration infrastructure (cdxi)
DESCRIPTION
Cyber Defence Data Exchange and Collaboration Infrastructure (CDXI). Luc Dandurand NATO C3 Agency [email protected]. NATO C3 Agency. Mission: Enable NATO’s success through the unbiased provision of comprehensive C4ISR capabilities - PowerPoint PPT PresentationTRANSCRIPT
Cyber Defence Data Exchange and Collaboration Infrastructure (CDXI)
Luc DandurandNATO C3 Agency
2Addressing security challenges on a global scale Geneva, 6-7 December 2010
NATO C3 Agency
Mission: Enable NATO’s success through the unbiased provision of
comprehensive C4ISR capabilities
NC3A mainly provides acquisition and scientific support to NATO and NATO NationsKey player at helping Nations achieve interoperabilityCDXI is sponsored by NATO Allied Command Transformation (ACT, Norfolk, VA)http://www.nc3a.nato.int/
3Geneva, 6-7 December 2010 Addressing security challenges on a global scale
What is the CDXI?
Ultimately, the goal of CDXI is to transport cyber defence data between organisations through a resilient, global infrastructure structure the data for machine processing feed it directly into automated applications provide assurance of its origin and quality provide access controls for confidentiality provide tools to collaborate on improving the data enable commercial exploitation
4Geneva, 6-7 December 2010 Addressing security challenges on a global scale
Cyber Defence Data
Reference Information Vulnerabilities Software (Applications and Operating Systems) Hardware Malware Patches and Fixes Verification Tests (e.g. IDS signatures & VA tests) Protocol specifications Certifications
5Geneva, 6-7 December 2010 Addressing security challenges on a global scale
Cyber Defence Data
Operational Information Events Incidents IP addresses Implicated parties
6Geneva, 6-7 December 2010 Addressing security challenges on a global scale
What problems does it solve?
Beyond the basic need to exchange data Lots of data sources saying different things
Errors & Discrepancies Different focus and taxonomies → No simple way to fix known errors and collaborate
Limited ability to automate CD applications Importing from the Web is often “manual” Limited quality assurance → THIS IS A MAJOR PROBLEM
No resilience → Need a local copy of all data! No automated implementation/enforcement of sharing
policies
7Geneva, 6-7 December 2010 Addressing security challenges on a global scale
Examples of Discrepancies
8Addressing security challenges on a global scale Geneva, 6-7 December 2010
CVE 2010-2941
18 Nov 2010
Possibly execute arbitrary code via a
crafted packet
CVE 2010-2941
9Addressing security challenges on a global scale Geneva, 6-7 December 2010
CVE 2010-2941
10Addressing security challenges on a global scale Geneva, 6-7 December 2010
CVE 2010-2941
11Addressing security challenges on a global scale Geneva, 6-7 December 2010
[…]
CVE 2010-2941
12Addressing security challenges on a global scale Geneva, 6-7 December 2010
[…]
?
?
CVE 2010-2941
13Addressing security challenges on a global scale Geneva, 6-7 December 2010
[…]
How do we fix this?
“Support dissension to reach consensus” Easily modify the data and send back to community “Multiple truths” co-exist until further research
uncovers the “ultimate truth” Reject or block erroneous data coming into own
automated systems
Custom Quality Assurance Processes
14Geneva, 6-7 December 2010 Addressing security challenges on a global scale
Structured Cyber Defence Data
Strategy of CDXI is currently based on Pure enumerations for the specified topics
Single identifier for each element (e.g. “CVE-ID”) Used to create all links to other data
Agile Data Model User-defined taxonomies User-defined relationships
CDXI could implement most, if not all, standards in CYBEX X.1500.
15Geneva, 6-7 December 2010 Addressing security challenges on a global scale
Confidentiality
Limited sharing is a reality User-based and role-based access controls Organisational sharing policies
Can limit user actions Can automate sharing
Multiple security labels and mappings Instances of CDXI exist at every security level
(Unclassified, Secret and Top Secret)
16Geneva, 6-7 December 2010 Addressing security challenges on a global scale
Commercial Exploitation
Required since Industry has lots of data,but more importantly, the resources to refine itProposed strategy is to encrypt records Sell keys to decrypt the data through contract
Industry can resell Tools that use the CDXI Content Quality assurance of content Data-mining
17Geneva, 6-7 December 2010 Addressing security challenges on a global scale
CDXI Architecture
18Addressing security challenges on a global scale Geneva, 6-7 December 2010
Relation to CYBEX
Similar to CYBEX in that use/acquisition of the data is out of scope Implements the following CYBEX functions Structuring cybersecurity information for exchange purposes Identifying and discovering cybersecurity information and entities Establishment of trust and policy agreement between exchanging entities Providing assured cybersecurity information exchange
Adds support for Dissension to reach consensus, collaboration mechanisms Custom quality assurance processes Commercial exploitation Provides Resilience
CDXI tackles the problem from a prototype implementation point-of-view, rather than the CYBEX standards-based approach
19Geneva, 6-7 December 2010 Addressing security challenges on a global scale
CDXI Way Ahead
Concept, high-level requirements and proposed architecture will be completed Q1 2011We plan to build and test a prototype in 2011We plan to continue prototype development/testing in 2012 and beyondWe hope for: Implementation by Industry? Concept valid for any knowledge centric community!
For further information: [email protected]
20Geneva, 6-7 December 2010 Addressing security challenges on a global scale