Presentation is loading. Please wait.

Presentation is loading. Please wait.

Defence R&D Canada R et D pour la défense Canada Visualisation for Network Situational Awareness in Computer Network Defence Marc Grégoire, DRDC Ottawa.

Similar presentations


Presentation on theme: "Defence R&D Canada R et D pour la défense Canada Visualisation for Network Situational Awareness in Computer Network Defence Marc Grégoire, DRDC Ottawa."— Presentation transcript:

1 Defence R&D Canada R et D pour la défense Canada Visualisation for Network Situational Awareness in Computer Network Defence Marc Grégoire, DRDC Ottawa Luc Beaudoin, Bologik Inc.

2 Defence R&D Canada R et D pour la défense, Canada Outline Network as a battlespace Need for Network SA Joint Network Defence & Management System (JNDMS) JNDMS Challenges –Visualisation –Integration into COP

3 Defence R&D Canada R et D pour la défense, Canada Networks are critical assets to Canadian Forces Operations –Assure network services in support of operations Email GCCS HRMS, FMAS, CFSSU –Defend network during operations Vs hackers Vs virus Vs technical failures

4 Defence R&D Canada R et D pour la défense, Canada The network as a Battlespace Avenues of Approach Firewall & Guard Intrusion Sensor CND CNE Ref: LCol R. Knight, CFIOG, DND Must maintain network situational awareness

5 Defence R&D Canada R et D pour la défense, Canada Network Situational Awareness Knowing the level of threats and the current status of all network assets supporting military operations. –IT Infrastructure (circuits, hardware, software) –Defensive posture; –Security events (C, I, A, etc) ; –Military Operations; –Interdependencies.

6 Defence R&D Canada R et D pour la défense, Canada Fight the Networks Operational Command Network Operations Centre IT Service Desk Network Control Computer Incident Response Team

7 Defence R&D Canada R et D pour la défense, Canada Mission/Role Operational Command Network Operations Centre IT Service Desk Network Control Computer Incident Response Team – Peace Keeping; – Search and Rescue; – Assistance to civil power; – NORAD; – NATO; For operational IT systems: – Fight the Networks – Preserve Confidentiality; – Maintain Integrity; – Assure Availability. – Provide user with 1 st line IT support; – Assure quality of IT service to the users. – Maintain connectivity; – Monitor network performance; – Network security monitoring; – Intrusion detection; – Intelligence analysis;

8 Defence R&D Canada R et D pour la défense, Canada Information Types Operational Command Network Operations Centre IT Service Desk Network Control Computer Incident Response Team - Resources - Priorities - IT services - Supporting ops - Locations - Schedule - Trouble tickets - Users - Hosts - Locations - Applications - IP addresses - Ports - Host - Locations - Vulnerabilities - Attack signatures - Host Status (Up/Down) - Links usage - Circuits/Topology - Locations ALL TYPES

9 Defence R&D Canada R et D pour la défense, Canada Example: Inputs resulting from events Operational Command Network Operations Centre IT Service Desk Network Control Computer Incident Response Team 3 users report that a military Web site providing weather maps is not responding. Intrusion detection system alerts of intensive scanning activities on a subnet. Monitoring tool alerts of sudden surge in traffic on a base Local Area Network (LAN).

10 Defence R&D Canada R et D pour la défense, Canada IT Service Desk View IT SD

11 Defence R&D Canada R et D pour la défense, Canada Network Control View NetCon

12 Defence R&D Canada R et D pour la défense, Canada CIRT View CIRT

13 Defence R&D Canada R et D pour la défense, Canada NOC View NOC So what ? 3 users report that a military Web site providing weather maps is not responding. Intrusion detection system alerts of intense scanning activities on a subnet. Monitoring tool alerts of sudden surge in traffic on a base LAN.

14 Defence R&D Canada R et D pour la défense, Canada Operational Command View Option 1: Option 2: Silos information report : Cmd -SERVICES: -3 users report that a military Web site providing weather maps is not responding. ; - PERFORMANCE: -Monitoring tool alerts of sudden surge in traffic on a base LAN. - SECURITY: -Intrusion detection system alerts of intense scanning activities on a subnet. OR -IMPACT: -Weather services to all deployed ships is inaccessible. - CAUSE: - One vulnerable IIS server infected by SQLSlammer worm. Infected server is scanning surrounding hosts to propagate the worm. This scanning activity creates a denial of service for all servers on subnet. Integrated information report:

15 Defence R&D Canada R et D pour la défense, Canada How to get option 2, and quicker? Integrate data –IT infrastructure –Security events –Military operations Common source of information to achieve Network Situational Awareness at the NOC and to answer the So what? Improve decision making –Faster (option space Vs time) –Quality (support risk acceptance option) –Prioritize NOC

16 Defence R&D Canada R et D pour la défense, Canada Sharing Share with the NOC sub-units to improve their own processes by giving them more context. Tactical decisions may require strategic level information. Let others look at it in a way meaningful to them (UDOP: User Defined Operating Picture) NOC

17 Defence R&D Canada R et D pour la défense, Canada Joint Network Defence & Management System (JNDMS)

18 Defence R&D Canada R et D pour la défense, Canada JNDMS Visualisation Challenges Filtering/aggregating/tailoring Real-time display requirements? –Battle tempo in cyberspace could be fast Logical and geospatial views –Correlate cyber events and physical events Display defensive posture Symbology Displaying interdependencies Large volume of data Historical data

19 Defence R&D Canada R et D pour la défense, Canada JNDMS Integration of data Data correlation Data presentation DRDC, Impact assessment tool DRDC, JNDMS Concept document

20 Defence R&D Canada R et D pour la défense, Canada Contributing to Ops Commanders COP Should we? We think so! How? –Sharing data: Requires compatible data sets. C2IEDM? Possibly, needs extension. –How to display? Does it imply geospatial map? (not always relevant, symbology, clutter issue) Need to capture reliance of military operations on cyber assets. At what level of details? Export snapshot of NOC view –e.g. a separate window in COP 21 Cmd

21 Defence R&D Canada R et D pour la défense, Canada

22 Defence R&D Canada R et D pour la défense Canada Questions?


Download ppt "Defence R&D Canada R et D pour la défense Canada Visualisation for Network Situational Awareness in Computer Network Defence Marc Grégoire, DRDC Ottawa."

Similar presentations


Ads by Google