1. Integration Community of Interest
Kickoff Harley Parkes and Brett Waldman, JHU/APL

2. Agenda When We First Met Why an Integrator’s COI Purpose Objectives
Value
COI Value Discussion

3. IACD: Support to Operational Adoption
Experimentation & Prototyping
“Prove it Works”
Pilots & Deployments
“Prove it Scales”
Interoperability Specifications & Adoption Support
“Make It Work For Vendors”
Shareable Playbooks & Implementation Guides
“Make It Work For Defenders”
So how are we going to help change that culture? By influencing the greater cybersecurity community. We are building and leading the IACD community by using this influence process to ensure solutions stick. We start with lab experiments and prototypes to prove out concepts for hard problems and to broadly demonstrate the art of the possible. As we share our results out to the community, we work with select forward-leaning organizations to deploy a pilot in their security operations. The lessons learned from there inform our interoperability specifications and adoption support, and lead into shareable cyber defense “playbooks” and implementation guides. Our mission is to ensure all of our lessons learned throughout this process are shared as broadly as possible: to help advance the state of the art. Let’s take a quick look at two of our recent examples at different points in this process.

4. Prior Discussion: Community Day - March 2017
What would help you create, market, and implement IACD solutions?
What is needed to facilitate customer adoption of IACD solutions?
What would help you remove barriers to adoption?
What would help you market IACD integration investments to existing customers?
How can we help meet these needs as a community?

5. Why an IntCOI
Purpose: To advance the “adoption” of IACD concepts across a broad range of customer operational environments.
Scalability
Sustainability

6. Objectives
Demonstrate the effectiveness of Security Automation, Orchestration and Information Sharing with Integrators
Expand IACD competencies and solution reach to meet growing demand.
Understand needs of the integration community.
Understand unique challenges/aspects of various sectors or environments.
Capture best practices for playbooks to improve cyber operations.
Share and capture measures & metrics for IACD ROI/TCO.
Expand IACD solution research.
Needs
Challenges
Experimentation
What outputs do we need to resonate with the *** sector?

7. What do Integrators get out of COI?
Opportunity to connect with parties looking to engage industry for assistance deploying IACD strategies
Access to IACD innovations available to use in business pursuits
Opportunity to collaborate on technical challenges or solutions addressing gaps inhibiting IACD adoption or effectiveness
Access to a community of security practitioners, solution providers & industry partners determined to demonstrate the value and opportunities to advance IACD
Opportunity to influence acquisition priorities and highlight differentiators with communities interested in evaluating or demonstrating the value for SA&O and Information Sharing.
Influence over new or evolving specifications/documentation:
Playbooks
Automation Readiness Assessments
IACD Value Proposition White Paper
Anonymized metrics & lessons learned
Broader adopter education
Outputs
Integrators
Adoptors
How is this output used?
How can it be improved?
What are others doing?
Who wants to engage?

8. Keys to Success Collaboration (by all participants)
Investment (time & resources)
Innovation (across the community)
Value (to all participants)

9. COI Value Discussion
Do you see value for your organization in being part of an Integrator’s COI? If so, what is the value proposition for you?
What would your organization be willing to contribute to the COI?
What would you NOT be willing to share due to the need for market differentiation, etc.?
What products, output, collaborations would help you implement and sustain IACD solutions?
How can we help meet these needs as a community?

10. COI Value Discussion
What unique challenges/aspects do you see with the COI concept?
How do we measure/assess the value of the COI to participating organizations?
How can we encourage others to join?

11. Schedule/Tempo Initial kickoff meeting (16 October 2017)
Quarterly virtual meetings initially
Adjust tempo based on need
Face-to-face meetings in conjunction with Integrated Cyber

12. Questions/Final Thoughts?