Jerry Cochran Principal Security Strategist Trustworthy Computing Group Microsoft Corporation

IT/Telecom Energy Transportation Banking/Finance Govt Services Cybersecurity Critical Infrastructures Critical Information Infrastructure Cross-cutting ICT interdependencies among all sectors Non-essential IT systems Enterprises Consumers Those practices and procedures that enable the secure use and operation of cyber tools and technologies

Policy Concerns Policy Responses War Terrorism Convergence Cyber Attacks Globalization Natural Disasters Laws and Regulations Emergency Response Plans Directives/Policies National Strategies

1. 1. Define Goals and Roles Identify and Prioritize Critical Functions Continuously Assess and Manage Risks Build Operational Response Frameworks Create Public-Private Partnerships Build Security/Resiliency into Operations Define Goals and Roles Identify and Prioritize Critical Functions Continuously Assess and Manage Risks Build Operational Response Frameworks Create Public-Private Partnerships Build Security/Resiliency into Operations Government and infrastructure owners/operators: Collaboratively pursue these core enablers of resiliency and infrastructure security Government and infrastructure owners/operators: Collaboratively pursue these core enablers of resiliency and infrastructure security

Incidences, emerging issues, & changing conditions : constantly update risk assessment

Establish an Open Dialog Understand the critical functions, infrastructure elements, and key resources necessary for: delivering essential services, maintaining the orderly operations of the economy, and helping to ensure public safety. Critical Function Key Resource Infrastructure Element Critical Function Key Resource Infrastructure Element Supply Chain Understand Interdependencies

Protection is the Continuous Application of Risk Management Assess Risks Identify Controls and Mitigations Implement Controls Measure Effectiveness Define Functional Requirements Evaluate Proposed Controls Estimate Risk Reduction/Cost Benefit Select Mitigation Strategy Define Functional Requirements Evaluate Proposed Controls Estimate Risk Reduction/Cost Benefit Select Mitigation Strategy Seek Holistic Approach. Organize by Control Effectiveness Implement Defense-in-Depth Seek Holistic Approach. Organize by Control Effectiveness Implement Defense-in-Depth Evaluate Program Effectiveness Leverage Findings to Improve Risk Management Evaluate Program Effectiveness Leverage Findings to Improve Risk Management Identify Key Functions Assess Risks Evaluate Consequences Identify Key Functions Assess Risks Evaluate Consequences Incidences, emerging issues, & changing conditions : constantly update risk assessment

Goal: Improve Operational Coordination Public- and private-sector organizations alike can benefit from developing joint plans for managing emergencies, including recovering critical functions in the event of significant incidents Unified Concept of Operations for Public and Private Sector CERTs Emergency response plans can mitigate damage and promote resiliency. Effective emergency response plans are generally short and highly actionable so they can be readily tested, evaluated, and implemented. Testing and exercising emergency response plans promotes trust, understanding, and greater operational coordination among public- and private- sector organizations. Exercises also provide an important opportunity to identify new risk factors that can be addressed in response plans or controlled through regular risk management functions.

Voluntary public-private partnerships  Promote trusted relationships needed for information sharing and collaborating on difficult problems  Leverage the unique skills of government and private sector organizations  Provide the flexibility needed to collaboratively address today’s dynamic threat environment  Provide a Value Proposition to the private sector Collaboration is key to protecting critical infrastructure

Security is a continuous process InfrastructureOperations Management Technical Operational SecurityControls Critical Functions (Global, National, Local) Fosters increased security and resiliency for the critical functions that support safety, security, and commerce at all levels Building security and resiliency into infrastructure operations