1. 10/29/20091 Innovation Partnerhsip Models with the Finance Sector Dept. of Homeland Security Science & Technology Directorate Douglas Maughan, Ph.D. Branch Chief / Program Mgr. douglas.maughan@dhs.gov 202-254-6145 / 202-360-3170 NCDI Workshop BITS, Washington, DC October 29, 2009

2. 10/29/2009 2 Science and Technology (S&T) Mission Conduct, stimulate, and enable research, development, test, evaluation and timely transition of homeland security capabilities to federal, state and local operational end-users.

3. 10/29/2009 3 Examples of Partnership Models LOGIIC – Linking Oil and Gas Industry to Improve Cybersecurity PPISC-ES – Payment Processing Information Sharing Council – Enhance Security Working Group DECIDE – Distributed Exercises TCIP – Trustworthy Cyber Infrastructure for Power S 2 ERC – Security and Software Engineering Research Center I3P – Institute for Information Infrastructure Protection SIF – System Integrator Forum ITSEF – IT Security Entrepreneur Forum

4. 10/29/2009 4 History ChevronTexaco approached DHS in March 2004 about possible opportunities to secure O&G cyber infrastructure Ensuing discussions determined that this should be done sector-wide Convened workshop in July 2004 in Washington, DC Outcome of meeting was to determine if it was possible for government and industry to work together to (a) establish a SCADA testbed and (b) determine a working model for future research and development activities.

5. 10/29/2009 5 History (cont’d) Industry partners agreed on technical project focus  April 2005 Project officially started July 1, 2005 Invited technology providers to show capabilities  Aug-Sept 2005 Industry selected winning candidates Project presented to O&G industry - Sept. 11, 2006  Captured in LOGIIC DVD

6. 10/29/2009 6 Partnership Project LOGIIC is a model for government-industry technology integration and demonstration efforts to address critical R&D needs Industry contributes  Requirements and operational expertise  Project management  Product vendor channels DHS S&T contributes  National Security Perspective on threats  Access to long term security research  Independent researchers with technical expertise  Testing facilities

7. 10/29/2009 7 Overview Opportunity: Reduce vulnerabilities of oil & gas process control environments by correlating and analyzing abnormal events to identify and prevent cyber security threats Approach:  Identify new types of security sensors for process control networks  Adapt a best-of-breed correlation engine to this environment  Integrate in testbed and demonstrate  Transfer technology to industry Business Network Process Control Network LOGIIC Correlation Engine External Events Attack Indications and Warnings

8. 10/29/2009 8 Project Execution Technology Integration Model (TIM) Integration Execution Phase Integration Validation Phase Solution Identification Phase Integration Definition Phase

9. 10/29/2009 9 Project Execution Technology Advancement Model (TAM) Advancement Execution Phase Advancement Validation Phase Solution Definition Phase Advancement Definition Phase

10. 10/29/2009 10 LOGIIC Consortium - NOW CRADA Oil & Gas Sector Participating Companies Project #1Project #2Project #3Project #4 Project #N Researchers Vendors Labs Competitive DHS S&T ISA Automation Federation (AF) DHS PCII

11. 10/29/2009 11 DECIDE (Distributed Environment for Critical Infrastructure Decision-making Exercises) Enable enterprise decision-makers to think through responses to operational disruptions of market-based transactions across networks - Sector(s), Market(s), Institution(s) Provide a dedicated exercise capability for several critical infrastructures in the U.S.  Enterprises will be able to initiate their own large-scale exercises, define their own scenarios, protect their proprietary data, and learn vital lessons to enhance business continuity, all from their desktops The concept has been reviewed by and developed with input from experts at ChicagoFIRST, the Options Clearing Corporation, ABN- AMRO, Eurex, Archipelago, Bank of New York, and CitiBank. The Financial Services Sector Coordinating Council R&D Committee has organized a user-group of subject matter experts (SMART team) paid by their respective financial institutions to support the project over the next three years.

12. 10/29/2009 12 Current TCIP Scale of Effort $1.5 M per year for 5 years Funded by National Science Foundation  With additional support from Department Of Energy, Department of Homeland Security 4 universities, 20 senior investigators  University of Illinois at Urbana-Champaign  Washington State University  Cornell University  Dartmouth University 35 Graduate and Undergraduate Students Industry advisory board (35 owners, operators, vendors)

13. 10/29/200913

14. 10/29/2009 14 Questions that need Answers What do you really want to do?  More formally organize information sharing and someone own it?  Known technology exploration and evaluation?  New R&D to support finance sector? FSSCC R&D Agenda What do you really think the government’s role is (depends on the answer to the first question)? What “formal agreements” do you have and do you believe you need others? Are all of the “stakeholders” present? If not, do they need to be? If they’re not, can you still succeed? Do you plan to put money on the table to accomplish what you want? Will everyone contribute equally? Tons of others – anti-trust, liability, IPR, etc.