1. Cybersecurity & Technology
CWAG
Cybersecurity & Technology
Forum
Cybersecurity
Policy in 2017
February 2
Park City
Chris Boyer
Assistant VP - Global Public Policy

2. AT&T’s approach to network security
24/7/365 global situational awareness
8 Global Security Operations Centers
179 Security and Privacy Patents
Near real-time analysis of security indicators
Global network infrastructure
~ 126 Petabytes of data per day
30B vulnerability scans/ 400M spam messages daily
3198% increase - IoT vulnerability scans last 3 years
Integrated management and response capability
Embed security capabilities into the network
Security enforcement nodes
Enterprise protection and managed services
Secure core network infrastructure
Internal risk management program
ISO27001 certified
Wide variety of industry & standards activities

3. DDoS Activity Trend over 4 years – 10 day moving average
DDoS attacks are commercialized & allow for use in more scenarios. DDoS extortion is increasingly popular. Generally threats that come in but are not accompanied by an actual attack are not credible. Some threats come with a demo attack, but there may be no follow through if the ransom is not paid.
Ransomware continues to evolve with aggressive spamming campaigns and more advanced encryption technology. Some doesn’t encrypt – it just deletes data.
We had a phase of what appeared to be targeted ransomware extortion attacks against health care providers, but I haven’t heard of many cases lately. However, this sort of threat is still a concern. Business continuity planning in the face of destructive threats is increasingly a concern.

4. Count of Unique Sources Scanning on Popular IoT Ports 3 years (as of Oct 3, 2016)
Concern (not a threat)
Virtual currency has fueled extortion and ransom attacks
Poorly secured IoT devices have facilitated very large botnets that can be used in DDoS attacks (among other things). Pay attention to what you connect to the internet.
We cover topics like this in more depth on ThreatTraq weekly
Jason, what is your team seeing with our business customers?

5. Today’s threat landscape requires a multi-layered approach
Data/Application Securing workloads/applications
Endpoint Mobile, IoT, Office/fixed
Connectivity Securing the network
Jason:
[TELL THE LAYERED APPROACH STORY]
Evolving technology trends, including cloud computing and virtualization, and the impact of these technologies on businesses, regularly come up in my conversations with customers.
LOB is looking for feature rich applications with no regards for their technology integration implications
Legacy Applications-big investment to invest in cloud
Brian, what is happening in the Threat Intelligence front?
Threat Management Detection & response

6. Communications Sector Partnership with Government
National Security Telecommunications Advisory Committee (NSTAC)
IOT Paper
ICT Mobilization
ETSV Paper
Big Data Analytics Paper
Promoted NCCIC, NSTIC etc.
Enduring Security Framework (DHS/WH)
Policy
Planning
Operations
Communications Sector Coordinating Council (CSCC)
Executive Order Implementation
NIST Framework
National Sector Risk Assessment (NSRA)
Communications Sector Specific Plan (CSSP)/Sector Annual Report (SAR)
National Incident Response Plan
National Security Information Exchange (NSIE)
National Cybersecurity & Communications Integration Center (NCCIC)
On call 24/7 center
US CERT
ICS CERT
National Coordinating Center (NCC)
CSCC Cyber Committee Initiatives
Comms Sector Role in Cybersecurity
Initiative Inventory
Recent CSCC/Cyber Committee Engagements
GAO Inquiries (Cyber Standards/Supply Chain)
DHS Supply Chain Working Group
Cross-Sector Cybersecurity Working Group
DHS Cyber Blueprint
Sector Risk Assessments
DHS National Sector Risk Assessment (NCS)
DHS Cyber Risk Assessment (OEC)

7. Federal Cybersecurity Policy Landscape
White House
Commerce
DOJ
CI Executive Order 13636
Presidential Policy Directive 21
Info Sharing Executive Order
Sanctions Executive Order
NSTAC/ESF
NIST Framework
NTIA Internet Task Force
NTIA Upgradeability/IoT
Baldridge Award Program/NCCoE
ECPA Guidance
Anti-trust policy statement
National Cybersecurity Incident Joint Task Force (NCIJTF) (FBI)
DHS
GSA
Comms Sector Specific Agency
National Communications Cybersecurity Integration Center (NCCIC)
National Security Info Exchange (NSIE)
National Cyber Incident Response Plan (NCIRP)
Federal Procurement (Applying framework to Federal procurement)
FEDERAL
CYBER POLICY
LANDSCAPE
SEC
FTC
SEC reporting
Board governance
Data Breach
Mobile Security Review
“Reasonable” Security Standards
IoT Devices
FCC
Congress
Privacy NPRM
Spectrum Frontiers Order
Tech Transitions Order
CSRIC (Working Groups 5-7)
Technology Advisory Council (TAC)
Information Sharing Legislation
DHS Re-Organization ??
Cyber R&D
Others 

8. NSTAC Highlights Funded in 1982 by President Reagan
Focus on National Security/Emergency Preparedness
Original focus on physical disaster recovery issues
Greater focus on cyber related matters in recent years
Recent papers include the following:
NSTAC Emerging Technologies Strategic Vision (ETSV) Letter to the President
NSTAC Report to the President on Big Data Analytics
NSTAC Information and Communications Technology Mobilization Report
NSTAC Internet of Things Report
NSTAC Report on the NS/EP Implications of Nationwide Public Safety Broadband Network
Report to the President on Secure Government Communications

9. 2017 Potential Cybersecurity Priorities
Executive Order (possibly today)
Securing Federal Agencies – raising profile, requiring agencies to use NIST framework
60 day review potentially led by OMB
Enhancing critical infrastructure cybersecurity
DHS 60 day review
Possible discussion of deterrence/international strategy
Modernizing Federal IT
Congress
HR584 – Cybersecurity coordination with states
Possibly DHS reorganization
Continued discussion about active defense/offensive measures
Information Sharing Implementation (CISA)
Internet of Things (IoT) security
Cyber R&D/Workforce Development

10. Considerations for State Governments
Partner and coordinate with private sector/Federal agencies to protect critical infrastructure
Leverage various federal, regional, state and local venues (e.g., Fusion centers, MS-ISAC; State, Local and Tribal Coordinating Council; National Level Exercise)
Use caution in establishing state level rules. Differing rules in each state increase the risk of fragmentation and force companies into a “least common denominator” approach that reduces rather than enhances security.
There is no one-size fits all solution in the current dynamic environment. To the extent that any new rules are determined to be necessary they should be more process oriented than prescriptive.
Enhance awareness and education/workforce development - support the National Cybersecurity Awareness Campaign, STOP THINK CONNECT, build computer security and digital citizenship into classroom curriculum, increase importance of secure software design at University level.
Increase support for law enforcement in pursuing cyber criminals
Lead by Example – deploy cyber security solutions across state government systems

11. Q&A