Upload File

cybersecurity€¦ · problem •cyber threat is becoming more prevalent •cyber threat is...

  • Home
  • Documents
  • Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The
14
Ken Stoni and Scott Cecilio Cybersecurity

Upload: others

Post on 19-Aug-2020

7 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Ken Stoni and Scott Cecilio

Cybersecurity

Page 2: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Problem

• Cyber threat is becoming more prevalent

• Cyber threat is becoming more serious

- Data compromise is an existential threat to many organizations

• The current approach to cybersecurity is device-centric & resource-intensive

- Protect all devices at all times

- Organizations have insufficient resources to implement this approach

• Organizations have legacy cybersecurity technology that can’t be abandoned

• It is sometimes difficult to integrate IT activities with the rest of the organization

Page 3: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Cyberspace Re-Considered It’s Mappable

Social / Persona Layer

Device Layer

Logical Network Layer

Physical Network Layer

Geographic Layer

• Each device in cyberspace is owned by someone (no ‘global commons’)

• Electro-mechanical devices exist in space-time and interact with physical events

• Geography is required to integrate and align cyberspace with other data

Page 4: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Solution Strategy

Protection

Recovery Prevention

Awareness

Response

Executives / Commanders Enterprise - focused

Operations Process-focused

IT Infrastructure Device-Focused

Cyber Security Event-focused

Development of a Cyber Common Operational Picture (COP)

Page 5: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Cybersecurity Activity

WAN

Mission Assurance

(Cyber Supply Line)

Known Bad

Anomaly Detection

Page 6: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

LAN

Bldg Net

Bldg Net

LAN

Campus #1 Campus #2

The Cyber Supply Line A vector of devices

1. Cyber Supply Line (CSL) is a consistent path through the infrastructure

2. CSL focuses resources on only the devices that are critical

3. Managing data flows is similar to traffic routing; an Esri core competency

Verizon AT&T DISA

WAN

Mission Data Flow

Mission Data Flow

WAN

Cyber Supply Line

Page 7: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Effect Propagation

Multi-Level Model of Data Flow

Maintain Data Flow Mission Assurance

Page 8: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Geo-Enabling Cybersecurity

Configuring Logging

Filtering (passive pattern-matching)

Alerting

Trending Scanning (active pattern-matching)

“'Geo-Enable' suggests the application of location or geospatial information as part of

business processes …

“… or using ‘location intelligence’ to augment non-spatial information systems and/or Business

Intelligence (BI)”

Page 9: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Rio 2016 Olympic Games

Demonstration

Page 10: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Consolidated Cyber Framework

Critical Data

Flows

Mission Impact

Target

Hardware

Firmware

Operating System

Application

Socio-Technical System

Cyber Device (above)

Support Devices

Procedures

Users

Environment

Social

Physical

WAN

Cyber Supply Line

Critical Devices Ordinary

Devices

Attack Characterization I&W Defense

Device Malfunction

Attack

Vector

Impact

Indicator Maintenance Attack Mitigation Remediation

AS&W

Page 11: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Solution Strategy

Integrate Cyber into existing Operational Pictures

Service-Oriented Architectures/Cloud

Multi-Domain

Info & Ops

Social

Media

Threats &

Warnings

Sensors Weather

Apps

Command Group CIO Group

CEO CIO

CTO

COO

Infrastructure

Apps

Buildings CCTV

Power Physical

Security GEOINT

Geospatial

Apps

Local Area

Network

Wide Area

Network

Net Arch Net Status

Static View (structure)

Dynamic View (behavior)

Cyber Infrastructure Data & Apps

Page 12: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Implementation Outline

Source Analysis Target Analysis (External Analysis +)

Cyber Supply Line (Target Analysis +)

ArcGIS Platform Facility Blueprints IT Typology

(RedSeal, other)

Network Data (F/W Logs, IDS/IPS, etc.)

IT Inventory

(device-room-function mapping)

Mission Data Flows

(location, data, format)

Location of Sensors Support System Mapping

(optional) Other Data of Interest

IP-to-Geolocation Service Other Data of Interest Organizational Workflows

Other Data of Interest Organizational Workflows

Organizational Workflows

Page 13: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

Cybersecurity Summary

• Geography matters for cybersecurity

• ArcGIS Platform ‘as is’ can integrate cyber with other mission data

• Multi-jurisdictional response improves mission effectiveness

• Shared Situational Awareness is more effective than direct

communication

Page 14: Cybersecurity€¦ · Problem •Cyber threat is becoming more prevalent •Cyber threat is becoming more serious -Data compromise is an existential threat to many organizations •The

For Additional Discussion

Christopher Van Dolson

Navy Cyber Defense Operations Center

Q&A Sessions

(The Lounge, EXPO, Hall B)

• Monday, 5:30 – 6:30

• Tuesday, 10:45 – 12:30

• Tuesday, 2:30 – 4:00


CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

SecBI: Cyber Threat Intelligence

Cisco Cyber Threat Defense

Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

Cyber Threat Intelligence Report

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

PERMA Cyber Threat Brief

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Global Cyber Threat Intelligence

Operational Cyber Threat Intelligence:

CYBER THREAT BULLETIN

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence

Cyber Threat Framework (Version 4) Translating Cyber into ...€¦ · Cyber Threat Framework (CTF) Overview The Cyber Threat Framework was developed by the US Government to enable

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

National Cyber Security Centre Unclassified Cyber Threat ... · National Cyber Security Centre Unclassified Cyber Threat ... It also produces threat prevention and ... can however

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Wittaya Janmayka 8 December 2016 - Enterprise IT Pro Cyber Threat... · 2016 Cyber Threat Observations. Cyber Threat Predictions Tipping Point For Cybersecurity in 2017 . 4 Cyber

CYBER THREAT- SCAPE REPORT - Accenture€¦ · The Cyber Threat-scape Report examines cyber- ... worldwide businesses, governments, ... CONTACTS Josh Ray

CYBER THREAT ASSESSMENT

The New Cyber Threat

Introducing Cyber Threat Monitoring - StarHub€¦ · Introducing Cyber Threat Monitoring A unique, telco-centric cyber defence solution for enterprise Cyber Threat Monitoring (CTM)

Cyber Threat Metrics

Cyber Threat Intelligence

IBM Cyber Threat Analysis

Countering the Cyber Threat

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

THREAT REPORT - Cyber€¦ · The Australian Cyber Security Centre Threat Report 2015 Foreword The cyber threat to Australian organisations is undeniable, unrelenting and continues

Cyber threat alerts 2011

Cyber Threat Monitor Report

Cyber Threat Characterization

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Security Conference - Rethinking cyber-threat

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Cyber threat trends