Homeland Security: Cyber Security R&D Initiatives

Homeland Security: Cyber Security R&D Initiatives
Dept. of Homeland Security Science & Technology Directorate Homeland Security: Cyber Security R&D Initiatives ACM CCS Alexandria, VA November 8, 2005 Douglas Maughan, Ph.D. Program Manager, HSARPA /

General DHS Organization (prior to 7/13/05)
Coast Guard Secret Service Citizenship & Immigration & Ombuds Civil Rights and Civil Liberties Legislative Affairs General Counsel Inspector General State & Local Coordination Private Sector Coordination International Affairs National Capital Region Coordination Counter-narcotics Small and Disadvantaged Business Privacy Officer Chief of Staff Secretary (Chertoff) & Deputy Secretary (Jackson) Management (Hale) Border & Transportation Security (Beardsworth, act.) Emergency Preparedness & Emergency Response (Paulison, act.) Information Analysis & Infrastructure Protection (Stephan, act.) Science & Technology (McQueary) Highlights the S&T image 8 November 2005

Department of Homeland Security Organization Chart
(proposed end state) SECRETARY DEPUTY SECRETARY EXECUTIVE SECRETARY CHIEF OF STAFF MILITARY LIAISON UNDER SECRETARY FOR MANAGEMENT UNDER SECRETARY FOR SCIENCE & TECHNOLOGY UNDER SECRETARY FOR POLICY UNDER SECRETARY FOR PREPAREDNESS GENERAL COUNSEL A/S CONGRESSIONAL & INTERGOVERNMENTAL AFFAIRS ASSISTANT SECRETARY PUBLIC AFFAIRS INSPECTOR GENERAL ASSISTANT SECRETARY OFFICE OF INTELLIGENCE & ANALYSIS DIRECTOR OF OPERATIONS COORDINATION DIRECTOR OF COUNTER NARCOTICS OMBUDSMAN CITIIZENSHIP & IMMIGRATION SERVICES CHIEF PRIVACY OFFICER DIRECTOR CIVIL RIGHTS/CIVIL LIBERTIES FEDERAL LAW ENFORCEMENT TRAINING CENTER DOMESTIC NUCLEAR DETECTION OFFICE SCREENING COORDINATION OFFICE LABOR RELATIONS BOARD DIRECTOR TRANSPORTATION SECURITY ADMINISTRATION COMMISSIONER CUSTOMS & BORDER PROTECTION DIRECTOR US SECRET SERVICE DIRECTOR CITIZENSHIP & IMMIGRATION SERVICES COMMISSIONER IMMIGRATION & CUSTOMS ENFORCEMENT DIRECTOR FEMA COMMANDANT US COAST GUARD 8 November 2005

Department of Homeland Security Organization Chart—Preparedness
(proposed end state) UNDER SECRETARY FOR PREPAREDNESS CHIEF MEDICAL OFFICER ASSISTANT SECRETARY FOR GRANTS AND TRAINING ASSISTANT SECRETARY FOR INFRASTRUCTURE PROTECTION FIRE ADMINISTRATION NATIONAL CAPITAL REGION DIRECTOR ASSISTANT SECRETARY FOR CYBER & TELE-COMMUNICATIONS 8 November 2005

Science and Technology (S&T) Mission
Conduct, stimulate, and enable research, development, test, evaluation and timely transition of homeland security capabilities to federal, state and local operational end-users. Here is our mission. 8 November 2005

S&T Organization Chart
Under Secretary for Science & Technology (McQueary) Office of Plans Programs and Requirements (Evans, act.) Homeland Security Advanced Research Projects Agency (Kubricky, act.) Highlights HSARPA Office of Research and Development (McCarthy) Office of Systems Engineering & Development (Kubricky) 8 November 2005

Advanced Research Projects Agency
Execution Office of Research and Development Homeland Security Advanced Research Projects Agency Systems Engineering & Development Science and Technology Directorate GFE GFI Industry Laboratories Industry Universities Universities Centers Fellowships Scholarships Laboratories Stewardship of an enduring capability Innovation, Adaptation, & Revolution Development Engineering, Production, & Deployment 8 November 2005

Crosscutting Portfolio Areas
Chemical Biological Radiological Nuclear High Explosives Cyber Security Critical Infrastructure Protection (CIP) USSS Oriented in Technology Areas 8 November 2005

Legacy of HSARPA Name How is it different from DARPA?
Differences 85-90% of funds for identified DHS requirements 10-15% of funds for revolutionary research Breakthroughs, New technologies and systems These percentages likely to change over time, but we need to meet today’s requirements We are starting from a state of unpreparedness in Homeland Security. Most, early R&D will necessarily be targeted at increasing our immediate capability to counter existing and near-term threats. As our fielded capabilities grow, we will have the luxury of more, long-range, innovative R&D with higher risk. It is imperative in the beginning to foster a small high-risk high-payoff R&D program to find solutions that will reduce the probability that the terrorists can successfully conduct an attack with weapons of mass destruction. 8 November 2005

HSARPA Funding HSARPA funding is allocated from Appropriated line items 8 November 2005

Cyber Security R&D Portfolio: Scope
We focus on threats and issues that warrant national-level concern Asymmetric capabilities make cyberspace an appealing battleground for our adversaries Cyberspace presents an avenue to exploit weaknesses in our critical infrastructures The most significant cyber threats are very different from “script-kiddies” or virus writers Terrorism Organized crime Economic espionage 8 November 2005

R&D Execution Model Customers Supporting Programs Post R&D Pre R&D R&D
Coordination – Government & Industry Experiments and Exercises Post R&D Outreach – Venture Community & Industry Customers Critical Infrastructure Providers Critical Infrastructure * NCSD * NCS * USSS * National Documents Other Sectors e.g., Banking & Finance Prioritized Requirements R&D SBIRs BAAs DNSSEC Cyber Security Assessment SPRI Emerging Threats Rapid Prototyping External (e.g., I3P) Solicitation Preparation Pre R&D CIP Sector Roadmaps Workshops Supporting Programs PREDICT DETER 8 November 2005

Coordination – Government & Industry Experiments and Exercises Post R&D Outreach – Venture Community & Industry Customers Critical Infrastructure Providers Critical Infrastructure * NCSD * NCS * USSS * National Documents Other Sectors e.g., Banking & Finance Prioritized Requirements Solicitation Preparation Pre R&D CIP Sector Roadmaps Workshops R&D SBIRs BAAs DNSSEC Cyber Security Assessment SPRI Emerging Threats Rapid Prototyping External (e.g., I3P) Supporting Programs PREDICT DETER 8 November 2005

Rapid Technology Application Program (RTAP)
Similar to the existing Technical Support Working Group (TSWG) approach Requirements Generation Panel Identify general technology needs Reduce collection of general needs Explore issues and draft Statement of Requirements (SoR) Write an SoR for each technology need in detail suitable for prototype procurement 8 November 2005

Cyber Security RTAP Topics
#1 BOTNET Detection and Mitigation Tool Customer: IAIP/NCSD #2 Exercise Scenario Modeling Tool #3 DHS Secure Wireless Access Prototype Customer: S&T OCIO Pre-solicitation at 8 November 2005

HSARPA Cyber Security Broad Agency Announcement (BAA 04-17)
A critical area of focus for DHS is the development and deployment of technologies to protect the nation’s cyber infrastructure including the Internet and other critical infrastructures that depend on computer systems for their mission. The goals of the Cyber Security Research and Development (CSRD) program are: To perform research and development (R&D) aimed at improving the security of existing deployed technologies and to ensure the security of new emerging systems; To develop new and enhanced technologies for the detection of, prevention of, and response to cyber attacks on the nation’s critical information infrastructure. To facilitate the transfer of these technologies into the national infrastructure as a matter of urgency. 8 November 2005

BAA Technical Topic Areas (TTAs)
System Security Engineering Vulnerability Prevention Tools and techniques for better software development Vulnerability Discovery and Remediation Tools and techniques for analyzing software to detect security vulnerabilities Cyber Security Assessment Develop methods and tools for assessing the cyber security of information systems Security of Operational Systems Security and Trustworthiness for Critical Infrastructure Protection 1) Automated security vulnerability assessments for CI systems 2) Improvements in system robustness of critical infrastructure systems 3) Configuration and security policy management tools 4) Cross-platform and/or cross network attack correlation and aggregation 8 November 2005

BAA TTAs (continued) Security of Operational Systems
Wireless Security Security tools/products for today’s networks Solutions and standards for next generation networks Investigative and Prevention Technologies Network Attack Forensics Tools and techniques for attack traceback Technologies to Defend against Identity Theft R&D of tools and techniques for defending against identity theft and other financial systems attacks, e.g., phishing 8 November 2005

BAA Program / Proposal Structure
NOTE: Deployment Phase = Test, Evaluation, and Pilot deployment in DHS “customer” environments Type I (New Technologies) – Funding NTE 36 months New technologies with an applied research phase, a development phase, and a deployment phase (optional) Type II (Prototype Technologies) – Funding NTE 24 months More mature prototype technologies with a development phase and a deployment phase (optional) Type III (Mature Technologies) – Funding NTE 12 months Mature technology with a deployment phase only. 8 November 2005

http://www.hsarpabaa.com/; Solicitation Awards; BAA04-17 Awards
BAA Proposal Summary Solicitation Awards; BAA04-17 Awards 8 November 2005

Small Business Innovative Research (SBIRs)
CROSS-DOMAIN ATTACK CORRELATION TECHNOLOGIES (SB ) Objective: Develop a system to efficiently correlate information from multiple intrusion detection systems (IDSes) about “stealthy” sources and targets of attacks in a distributed fashion across multiple environments. REAL-TIME MALICIOUS CODE IDENTIFICATION (SB ) Objective: Develop technologies to detect anomalous network payloads destined for any service or port in a target machine in order to prevent the spread of destructive code through networks and applications. These technologies should focus on detecting “zero day attacks”, the first appearance of malicious code for which no known defense has been constructed. 8 November 2005

SBIR FY05.2 Submission Hardware-assisted System Security Monitoring
OBJECTIVE: This topic seeks technologies that provide a hardware-assist for the monitoring of system security. It is expected that the resulting solutions would be some type of inexpensive coprocessor board that would work with existing hardware and software, resulting in a system with much higher assurance than currently available. By putting the monitoring capability in hardware it is much more difficult for an attacker to disable this part of the system because the board is isolated from potential remote attackers and would require physical access to compromise the hardware-assist board, thus, providing the owner/user technology that can monitor the security health of the system in near real-time. This will ensure that even when the machine is on, but the user is not using the machine, the system will be monitored and can even be "shut down" so unknown communications is not sent while the user's away. The hardware-assist system should have the capability to collect and store information for forensic purposes and the system should also have capability to report security related events to a central monitoring station. Solicitation at 8 November 2005

DHS / NSF Cyber Security Testbed
“Justification and Requirements for a National DDOS Defense Technology Evaluation Facility”, July 2002 We still lack large-scale deployment of security technology sufficient to protect our vital infrastructures Recent investment in research on cyber security technologies by government agencies (NSF, DARPA, armed services) and industry. One important reason is the lack of an experimental infrastructure and rigorous scientific methodologies for developing and testing next-generation defensive cyber security technology The goal is to create, operate, and support a researcher-and-vendor-neutral experimental infrastructure that is open to a wide community of users and produce scientifically rigorous testing frameworks and methodologies to support the development and demonstration of next-generation cyber defense technologies 8 November 2005

DETER Testbed Architecture
Cyber Defense Experiments run on Virtual Internet UCB Internet Sparta USC-ISI 3 major sites; over 200 nodes GOAL: By end of FY07 to have 1000 nodes distributed at possibly up to 6 sites 8 November 2005

End Goal: Improve the quality of defensive cyber security technologies
A Protected REpository for Defense of Infrastructure against Cyber Threats PREDICT Program Objective “To advance the state of the research and commercial development (of network security ‘products’) we need to produce datasets for information security testing and evaluation of maturing networking technologies.” Rationale / Background / Historical: Researchers with insufficient access to data unable to adequately test their research prototypes Government technology decision-makers with no data to evaluate competing “products” End Goal: Improve the quality of defensive cyber security technologies 8 November 2005

Industry Workshop 2004 ATTENDEES AOL UUNET Verio PREDICT participant XO Comms Akamai Arbor Networks System Detection Cisco PCH PREDICT participant Symantec USC-ISI PREDICT participant Univ. of WA PREDICT participant CERT/CC LBNL PREDICT participant Internet2 PREDICT participant CAIDA PREDICT participant Merit Networks PREDICT participant Citigroup Begin the dialogue between HSARPA and industry as it pertains to the cyber security research agenda Discuss existing data collection activities and how they could be leveraged to accomplish the goals of this program Discuss data sharing issues (e.g., technical, legal, policy, privacy) that limit opportunities today and develop a plan for navigating forward Develop a process by which “data” can be “regularly” collected and shared with the network security research community 8 November 2005

Data Collection Activities
Classes of data that are interesting, people want collected, and seem reasonable to collect Netflow Packet traces – headers and full packet (context dependent) Critical infrastructure – BGP and DNS data Topology data IDS / firewall logs Performance data Network management data (i.e., SNMP) VoIP (1400 IP-phone network) Blackhole Monitor traffic 8 November 2005

PREDICT Information : https://www.predict.org Recent Workshop
8 November 2005

Internet Infrastructure Security Motivation
The National Strategy to Secure Cyberspace (2003) recognized the DNS as a critical weakness NSSC called for the Department of Homeland Security to coordinate public-private partnerships to encourage the adoption of improved security protocols, such as DNS The security and continued functioning of the Internet will be greatly influenced by the success or failure of implementing more secure and more robust BGP and DNS. The Nation has a vital interest in ensuring that this work proceeds. The government should play a role when private efforts break down due to a need for coordination or a lack of proper incentives. 8 November 2005

Domain Name System Security (DNSSEC) Program
DNSSEC Program Objective “Carry forward to completion the recommendation from the National Strategy to Secure Cyberspace by engaging industry, government, and academia to enable all DNS-related traffic on the Internet to be DNSSEC compliant” Rationale / Background / Historical: DNS is a critical component of the Internet infrastructure and was not designed for security DNS vulnerabilities have been identified for over a decade and we are addressing these vulnerabilities End Goal: Greatly increase the security of the Internet (as critical infrastructure) by securing the DNS through the use of crypto signatures 8 November 2005

The Domain Name System DNS database maps:
Root DNS database maps: Name to IP address = And many other mappings (mail servers, IPv6, reverse…) Data organized as tree structure: Each zone is authoritative for its own data Minimal coordination between zone operators edu mil ru isi darpa usmc mil nge alpha 8 November 2005

DNS Attacks Attacks via and against the DNS infrastructure are increasing Attacks are becoming costly and difficult to remedy Consumer confidence in Internet accuracy is decreasing Financial/large enterprises are seeing a significant increase in online attacks for fraudulent purposes Hijacking (virtual theft of domain names) Phishing (look-alike fraudulent s and web sites) Pharming (phishing combined with DNS attacks) Other attacks include DNS name mismatches or browser tricks aimed at careless users 8 November 2005

DNSSEC – What it provides
Provides an approach so DNS users can: Validate that data they receive came from the correct originator, i.e., Source Authenticity Validate that data they receive is the data the originator put into the DNS, i.e., Data Integrity Approach integrates with existing server infrastructure and user clients DNSSEC awareness by application Results of DNSSEC validation functions provided to applications Applications can take different actions based on DNSSEC validation results, e.g. won’t connect to without good validation but will connect to without it. Examples: Web browsers servers and clients 8 November 2005

DNSSEC Initiative Activities
Roadmap published in February 2005 Multiple workshops held world-wide DNSSEC testbed developed by Involvement with numerous deployment pilots Working with Civilian government (.gov) to develop policy and technical guidance for secure DNS operations and beginning deployment activities at all levels. Working with the operators of the “.us” and “.mil” zones towards DNSSEC deployment and compliance 8 November 2005

DNSSEC Design / Use Secure DNS Guidance Documents Announcement from:
NIST 800 Series Documents for operators and policy/decision makers. Define the problem space Outline BCP for securing current DNS operations Guidelines for deployment and use of DNSSEC Series of outreach efforts Announcement from: August 11, 2005: Draft NIST Special Publication , Secure Domain Name System (DNS) Deployment Guide Request for Comments closed Sept. 29th, 2005 Marketing to the policy decision makers – technical training to the operators. .GOV make it real in the government. 8 November 2005

Secure Protocols for the Routing Infrastructure (SPRI)
BGP is the routing protocol that connects ISPs and subscriber networks together to form the Internet BGP does not forward subscriber traffic, but it determines the paths subscriber traffic follows The BGP architecture makes it highly vulnerable to human errors and malicious attacks against Links between routers The routers themselves Management stations that control routers Work with industry to develop solutions for our current routing security problems and future technologies 8 November 2005

SPRI Activities To Date
Formation of government and industry “steering committee” DHS, DOD, DOCommerce, NIST, ICANN, IETF Held first industry requirements workshop; March 15-16, 2005 in WDC Held second workshop on operational security; May 18-19, 2005 in Seattle in conjunction with NANOG. Held third workshop on registry operations; Sept , 2005 in WDC; Outputs submitted at recent ARIN mtg 8 November 2005

Cyber Security Assessment Activities
Cyber Economics Study Dept. of Treasury – “Key Business Processes in the event of a Crisis” Study 8 November 2005

DHS/Cyber Security IMPACT
Economic Analysis of Cyber Security and Private-Sector Investment Decisions The objective of the study is to investigate Internet stakeholders’ investment decisions for bolstering the security of their information technology (IT) networks. To achieve the study objectives, RTI will review existing studies to assess the economics of cyber security, conduct a series of interviews within eight industry sectors to assess companies’ investment decisions related to securing their IT networks, and identify potential areas for government involvement and/or support for the deployment and adoption of existing cyber security technologies. DHS/Cyber Security IMPACT DHS is interested in economic decisions that may lead to inadequate investment in cyber security measures. Better information on the costs and benefits of security technologies and adverse events will help inform private investment decisions. Understanding the public goods nature of Internet security may inform government’s involvement in cyber security. SCHEDULE Notes: Review Slide #: 2 Slide Title: Program Summary Use in Reviews: Provided by PM using this template for Annual Reviews and reviews of New Starts. Provided for Interim Reviews, if program changes necessitate a document change. Key Points: Top level -- should be written for a broad audience -- may be used outside of TTO. Includes a graphic/pictorial representation of technical product or capability. Sample Text: TECHNICAL OBJECTIVES Develop and mature a solid-state inertial measurement technology and unit for affordable, light weight, precise navigation. Combine an all solid-state inertial measurement unit with a miniature Global Positioning System receiver to exploit known mutual synergism. MANAGEMENT STRATEGY A three phase approach design, test, and production, as developed by DoD/industry workshops and the Tri-Service Team, is being used. Phenomenology evaluation to be performed by the Jasons. Missed milestones will trigger a Tiger Team investigation and report. MILITARY IMPACT/SPONSORSHIP Evaluated as next generation navigation set for Army fire control vehicles with delivery of Phase 2 units in FY Phase 2 has been declared the Navy's Advanced Integrated Navigation and Control Package. Joint Advanced Strike Technology is evaluating the demonstration of navigation units for use in an aircraft weapons system concept for use in adverse weather conditions. 8 November 2005

DESCRIPTION / OBJECTIVES / METHODS DHS/Cyber Security IMPACT
Prototyping of a Business Process Model (A Computer Simulation) of the Finance Sector DESCRIPTION / OBJECTIVES / METHODS “Proof of Concept” activities are designed to assess initial technical and operational feasibility, including scoping and development of a concept of operations, before stakeholders invest substantial resources in full-scale development. Various private and public-sector stakeholders have determined the immediate operational need for this capability; it meets several gaps defined by the Treasury Department and sector-level coordinating councils. The research involves 4 phases: Engage SMEs to help define the logical and physical extent of the sector at a high level; Determine an appropriate subset of sector transactions to model as a proof of concept; Use rapid prototyping to define simulation requirements; Report on technical and operational feasibility DHS/Cyber Security IMPACT This project addresses the requirement for a man-in-the loop simulation that emulates sector-wide disruptions and their operational (business) impact. Sector-level simulation of impacts resulting from cyber and physical disruptions of business processes and transactions between critical entities in the Finance Sector will provide government and industry stakeholders and users with unique insight of operational risks, single points of failure, and mitigation strategies. Potential users include risk managers responsible for the operational health of the sector; also enterprise risk managers BUDGET & SCHEDULE Notes: Review Slide #: 2 Slide Title: Program Summary Use in Reviews: Provided by PM using this template for Annual Reviews and reviews of New Starts. Provided for Interim Reviews, if program changes necessitate a document change. Key Points: Top level -- should be written for a broad audience -- may be used outside of TTO. Includes a graphic/pictorial representation of technical product or capability. Sample Text: TECHNICAL OBJECTIVES Develop and mature a solid-state inertial measurement technology and unit for affordable, light weight, precise navigation. Combine an all solid-state inertial measurement unit with a miniature Global Positioning System receiver to exploit known mutual synergism. MANAGEMENT STRATEGY A three phase approach design, test, and production, as developed by DoD/industry workshops and the Tri-Service Team, is being used. Phenomenology evaluation to be performed by the Jasons. Missed milestones will trigger a Tiger Team investigation and report. MILITARY IMPACT/SPONSORSHIP Evaluated as next generation navigation set for Army fire control vehicles with delivery of Phase 2 units in FY Phase 2 has been declared the Navy's Advanced Integrated Navigation and Control Package. Joint Advanced Strike Technology is evaluating the demonstration of navigation units for use in an aircraft weapons system concept for use in adverse weather conditions. TASK FY05 FY06 FY07 Proof of Concept (Feasibility) Phase 1 Requirements Definition Phase 1 Simulation Design Phase 1 Implementation, Integration, Testing, and Roll-out 8 November 2005

PROJECT DESCRIPTION / OVERVIEW
Rapid Prototyping – Authoritative SSL Auditing PROJECT DESCRIPTION / OVERVIEW Client Machine Client Machine Goal: Enable organizations to audit secure communications to prove policy compliance, investigate attacks, and arbitrate disputes. Approach: Use a passive network device to record SSL traffic, sign it with a hardware security module, and open communications when necessary. Requires the cooperation of the original secure sever to keep its keys secure. Web portal restricts access to authorized personnel. Status: Alpha Aug 15, 2005; Beta planned for Dec 15, 2005 End Users: Information technology and security officers in government agencies and commercial organizations, especially those that need to comply with regulations such as HIPAA, FACTA, and Sarbanes-Oxley. Client Machine Client Machine Server Machine Server Machine Client Machine Server Machine Client Application Server Application Network Switch SSL Client SSL Server Key Shield Auditing Device Portal Device Recording Application Signing Application Auditing Portal BUDGET & SCHEDULE DHS/Cyber Security Impact Complete, authoritative records of electronic transactions Ensure users/organizations follow security policies Better investigate attacks and fraud over SSL All records remain confidential until specifically reviewed Very low total cost of ownership encourages adoption Notes: Review Slide #: 2 Slide Title: Program Summary Use in Reviews: Provided by PM using this template for Annual Reviews and reviews of New Starts. Provided for Interim Reviews, if program changes necessitate a document change. Key Points: Top level -- should be written for a broad audience -- may be used outside of TTO. Includes a graphic/pictorial representation of technical product or capability. Sample Text: TECHNICAL OBJECTIVES Develop and mature a solid-state inertial measurement technology and unit for affordable, light weight, precise navigation. Combine an all solid-state inertial measurement unit with a miniature Global Positioning System receiver to exploit known mutual synergism. MANAGEMENT STRATEGY A three phase approach design, test, and production, as developed by DoD/industry workshops and the Tri-Service Team, is being used. Phenomenology evaluation to be performed by the Jasons. Missed milestones will trigger a Tiger Team investigation and report. MILITARY IMPACT/SPONSORSHIP Evaluated as next generation navigation set for Army fire control vehicles with delivery of Phase 2 units in FY Phase 2 has been declared the Navy's Advanced Integrated Navigation and Control Package. Joint Advanced Strike Technology is evaluating the demonstration of navigation units for use in an aircraft weapons system concept for use in adverse weather conditions. TASK FY05 FY06 FY07 Reqmnts. & Design Alpha System Beta System Final System 8 November 2005

Emerging Threats – VME-DEP
Virtual Machine Environment - Detection and Escape Prevention VME use is increasing in industry and government, and is starting to be used in classified networks Goals of this project are to Gain a better understanding of where VMEs are used and for what purpose Determine how an attacker might break the security models defined by a VME Develop techniques for preventing those attacks Develop a “secured” open source VME 8 November 2005

Emerging Threats - NGCD
Next Generation Crimeware Defenses Crimeware: Malicious software specifically designed to steal identity information and other associated financial information Goals of this project are: Gain an understanding of the nature of crimeware technologies and how to defend against their increasing sophistication Collect and analyze crimeware samples Build threat and vulnerability models based on the attack types and goals of stealing access credentials and identity information and correlated to popular computing environments Develop a “secure computing environment”: web browser (based on open-source Mozilla), secure keyboard and embedded co-processor to proactively prevent crimeware 8 November 2005

The Institute for Information Infrastructure Protection (I3P)
The I3P is a consortium of 24 academic and not-for-profit research organizations The I3P embodies a concept developed in studies between 1998 and 2000 by PCAST, IDA, and OSTP The I3P was formed in September 2001 and funded by congressionally appropriated funds assigned to Dartmouth College DHS/S&T/HSARPA now oversees the I3P funding $ M Congressional Earmark for the Institute for Security Technologies Studies (ISTS) at Dartmouth College Inherited from Office of Domestic Preparedness (ODP) during R&D consolidation activity 8 November 2005

Other Activities – Institute for Infrastructure Protection (I3P)
Creation of two research plans for cyber security, one in Supervisory Control and Data Acquisition (SCADA) systems, and one in economic and policy issues Two Independent Research Advisory Boards (RABs) established to review final research plans submitted for I3P support. Two-year, $8.5 million research program to protect SCADA systems in the oil and gas industry and other critical infrastructure sectors. Led by Sandia, comprises 10 research institutions with expertise in cyber security, risk management, and infrastructure systems analysis. Kickoff meeting held April at Sandia National Laboratories’ Center for SCADA Security in Albuquerque Attended by project researchers along with oil and gas experts from ChevronTexaco, Ergon Refining, Public Utility of New Mexico, and Williams Provided training on SCADA hardware, software, and typical system configurations, as well as common threats and vulnerabilities associated with these systems 8 November 2005

I3P Cyber Economics Project
Two project goals: How to quantify the cost of cyber security and the effects of cyber attacks? How to measure the effectiveness of current security tools and policies? Three intertwined threads National perspective: Views the information infrastructure as an element of national security, where cyber security incidents can disrupt, impair or destroy critical economic capabilities. Enterprise or corporate perspective: Considers the effects of degraded or destroyed infrastructure on the degree to which an enterprise can maintain its bottom line by developing and delivering products and services. Technological perspective: Addresses those technologies that protect the infrastructure, by deterring particular threats, preventing certain classes of attacks, or mitigating the consequences of attack. Participants: RAND Corporation, University of Virginia, MIT Lincoln Laboratory, George Mason University, Dartmouth 8 November 2005

Experiments and Exercises
U.S. / Canada Secure Blackberry Experiment PSTP-agreed upon deployment activity Oil and Gas Sector Working with DOE and industry Finance Sector CIDDAC U.S. NORTHCOM CWID 2005 (originally known as JWID) Exercises National Cyber Security Exercise (Cyber Storm) National Critical Infrastructure Exercise (NCIE) Exercise led by industry 8 November 2005

US-CAN Secure Wireless Trial
Objective Test effectiveness of US/Canadian cross-border secure wireless architecture to cope with real-time communication in variety of scenarios Technologies PKI (S/MIME), Identity-based encryption, enforcement of policy and compliance Trial Activity July: U.S.-only initial four-day test period October: Four-day test period with 35 activities and with 40+ participants acting out homeland security scenarios using BlackBerry devices 8 November 2005

LOGI2C – Linking the Oil and Gas Industry to Improve Cybersecurity
LOGI2C is a 12-month technology integration and demonstration project driven by industry, supported by DHS Technical goal: Attack indications and warnings through event analysis and correlation across business and process control networks Approach: Identify new types of security sensors for process control networks Adapt a best-of-breed correlation engine to this environment Integrate in testbed and demonstrate Transfer technology to industry Business Network Process Control Network LOGI2C Correlation Engine External Events Attack Indications and Warnings 8 November 2005

LOGI2C Partners LOGI2C is a model for how DHS S&T and industry can work together in a public-private partnership to address a critical R&D need Industry contributes Requirements and operational expertise Project management Product vendor channels DHS S&T contributes Independent researchers with technical security expertise Testing facilities 8 November 2005

S&T and Cyber Storm Exercise Objectives: Success criteria:
To incorporate elements of cyber defense and response technology into the exercise moving it gradually away from the “table top” format. To socialize the DETER test bed with the exercise participants and make them aware of its capability and its potential value to their respective organizations. Success criteria: Recognizing the complexity of the exercise and its key focus, S&T would consider their objective met if the DETER test bed were used in the planning of the exercise (to lend realism to scenario elements) and if one or more session can be arranged during the exercise, where the players could see the test bed in action being used to test exercise relevant problems or decisions. The session(s) should show the value of the tool and add defensive technology to the exercise. 8 November 2005

National Critical Infrastructure Exercise (NCIE)
Exercise is co-managed by BearingPoint and Yoran Associates Funded by the private sector with public/private technology demonstrations Objectives Conduct a private sector exercise Exercise threat scenarios against SCADA operations Test and evaluate organizational plans, policies, and procedures Capture performance data to evaluate Critical Infrastructure Resiliency metrics and models – U.S. comparison against other countries Primary participants: senior operations managers and corporate executives from utility/energy sector Secondary participation: industry collaboration groups, government agencies, first responders, and others identified by primary participants during planning 8 November 2005

Commercial Outreach Strategy
Assist commercial companies in providing technology to DHS and other government agencies Emerging Security Technology Forums (ESTF) Assist DHS S&T-funded researchers in transferring technology to larger, established security technology companies DHS Mentor / Protégé program Partner with the venture capital community to transfer technology to existing portfolio companies, or to create new ventures Established Commercial Companies Emerging Government Funder/Customer DHS Researchers Customers 8 November 2005

Emerging Security Technology Forum
ESTF held April 13-14, 2005 in Arlington, VA Opportunity to introduce government representatives to smaller-sized information security technology vendors with innovative technology approaches For this ESTF vendors presented and demonstrated current and emerging information security technologies that defend against DDOS and worm attacks Next ESTF to be held in May 2006 Topic: Identity Management technologies Audience will include industry and government 8 November 2005

Emerging Security Technology Forum
Arbor Networks CounterStorm, Inc. Cs3, Inc. CyberShield Networks, Inc. Determina, Inc. ForeScout Technologies IntruGuard Devices, Inc. Kerio Technologies netZentry, Inc. Prolexic Technologies Q1 Labs Inc. Top Layer Networks, Inc. V-Secure Technologies 8 November 2005

DHS Mentor/Protégé Program
Objective Provide start-up emerging security companies with mentor support in sales & marketing to government Existing Mentor/Protégé programs in government are procurement oriented. New S&T Mentor/Protégé program will focus on rapidly transitioning cyber security technologies into government through existing relationships. Mentors will be large, established government contractors with cyber security experience Protégés will provide innovative cyber security technology. There are no set-aside requirements (e.g. disadvantaged, HubZone business) Selection Process The Cyber Security R&D Center will solicit government/industry technology requirements to identify gaps in the US cyber infrastructure. These requirements will guide selection of mentors. Protégés, with technology to meet infrastructure gaps, will be proposed to the mentors by the Center. 8 November 2005

ITTC – The DHS-SRI Identity Theft Technology Council
ITTC is a revived and expanded Silicon Valley expert group originally convened by the U.S. Secret Service Experts and leaders from Government Financial and IT sectors Venture capital Academia and science ITTC works closely with The Anti-Phishing Working Group (APWG) Consultant and ITTC Coordinator: Robert Rodriguez, retired head of the Secret Service Field Office in San Francisco The ITTC was formed in April, and has four active working groups: Phishing Technology Report Data collection and sharing Future threats Development and deployment 8 November 2005

Tackling Cyber Security Challenges: Business Not as Usual
Strong mission focus (avoid mission creep) Close coordination with other Federal agencies Outreach to communities outside of the Federal government Building public-private partnerships (the industry-government *dance* is a new tango) Strong emphasis on technology diffusion and technology transfer Migration paths to a more secure infrastructure Awareness of economic realities 8 November 2005

Summary DHS S&T is moving forward with an aggressive cyber security research agenda Working with industry to solve the cyber security problems of our current infrastructure DNSSEC, Secure Routing Working with academe and industry to improve research tools and datasets DHS/NSF Cyber Security Testbed, PREDICT Looking at future RDT&E agendas with the most impact for the nation SBIRs, BAA 04-17, RTAP 8 November 2005

Other Areas of Interest (were $ available)
Cyber Situational Awareness – Indications & Warnings Insider Threat Detection & Mitigation Information Privacy Technologies Large-scale network survivability, rapid recovery and reconstitution Secure operating systems (open source) Network modeling and simulation – security policy reconfiguration impact on networks Highly scalable identity management 8 November 2005

Program Manager, HSARPA douglas.maughan@dhs.gov
Douglas Maughan, Ph.D. Program Manager, HSARPA / 8 November 2005

Homeland Security: Cyber Security R&D Initiatives

Similar presentations

Presentation on theme: "Homeland Security: Cyber Security R&D Initiatives"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Homeland Security: Cyber Security R&D Initiatives

Similar presentations

Presentation on theme: "Homeland Security: Cyber Security R&D Initiatives"— Presentation transcript:

Similar presentations

About project

Feedback