1. Cybersecurity: The Need for a Paradigm Change.
Ammar Alkassar
CEO Rohde & Schwarz Cybersecurity
September, 24th 2016 | GSS/WTSA’16 Hammamet

2. Rohde & Schwarz group at a glance
Independent family-owned company Established 1933 in Munich, Germany
Global presence in over 70 countries
Net revenue EUR 1.83 billion (FY 14/15)
90 percent export share
9900 Employees worldwide approx in Germany

3. Rohde & Schwarz Cybersecurity
Certified and award-winning security solutions
More than 20 years experience in IT security
7 centers of competence in Germany
Approx. 400 Employees
Pursuing an aggressive growth strategy 4 German enterprise security companies incorporated
Berlin
Combining the infrastructure of a high-tech organization with the drive of startup companies

4. The European Trusted Supplier for Cybersecurity
Secure networks and network analytics
Next-generation firewalls & UTM
Embedded application awareness
Incident detection / response
Encrypted backbone / WAN
Layer 3 IP encryption
Layer 2 Ethernet encryption
Secure remote access
Tap-proof communications
Voice encryption apps & devices
Secure messaging
Fax & Radio encryption
Secure endpoints
Full-disk encryption
Secure browsing & cloud
Secure desktop & mobile
Trusted management
CA, PKI, HSMs
Crypto management
Configuration, Policy
Firmware deployment
Trusted solutions from a single source

5. 12 Economically Most Disruptive Technologies McKinsey Report 2013

6. IT-Trends will change our world in a sustainable way
Cybersecurity is the basic enabler
Mobile Internet
40%
Worldwide working population has acces to Mobile Internet
Big data
100x
Power of IBM‘s Jeopardy 2011 vs. Deep Blue 1997
Internet of Things
240 Mrd.
Connected devices, sensors, machines in 2020
Cloud
80%
of US-companies are hosting/planning to host in the Cloud.

7. Challenges Example 1 Information Assurance

8. 2010. 2013. 2016. US Presidential Election & TTIP disclosures
Prism
June 2013: Leakage of sensitive documents with extensive impact, diplomatic, security-related – and economical
From an organization, expected to know how to secure what information assurance means
2010.
2016.
US Presidential Election & TTIP
disclosures
While formally huge measures are taken to protect the information
Information Leakage as political instrument used
WikiLeaks
Nov 2010: Massive leakage of sensitive Government wires, completely new dimension in quantity
Low classified documents – but huge amount

9. Challenge Example 2: Vulnerabilities

10. The Increasing Impact of Vulnerabilities
Systematic development and use of vulnerabilities in popular applications:
Lucrative black market
Nations build own capacities for exploiting vulnerabilities
Nature of Zero-Day vulnerabilities: Cannot be detected by Anti-virus scanners or traditional Firewalls
Mitarbeiter:
RS SIT (130)
GP (100)
SRX (70)
Ipoque (70)

11. The Increasing Impact of Vulnerabilities
Has been commercially offered first time in March 2014 (!)
Half-Life/Durability dramatically longer than expected.
Impact of single vulnerability much higher
Hacks cheaper and usable by a broad community
August 2016
IT-Tagung Koblenz'16
Pegasus Vulnerabilties in Sandboxing iOS  Capture via manipulierter Website…
Auch die US-Pizzakette Cicis musste Mitte 2016 einen Hackerangriff eingestehen. Wie das Unternehmen mitteilte, wurden die Kassensysteme von 130 Filialen kompromittiert. Der Diebstahl von Kreditkartendaten ist sehr wahrscheinlich. Wie im Fall von Wendy's und Target gelang es Hackern auch bei Cicis Malware in das Point-of-Sale-Kassensystem einzuschleusen. Erste Angriffe traten bereits im Jahr 2015 auf, im März 2016 verstärkten sich die Einzelattacken zu einer groß angelegten Offensive. Nach eigenen Angaben hat Cicis die Malware inzwischen beseitigt.
Im Mai 2014 wurde Ebay das Ziel von Cyberkriminellen. Zwar wurden bei der Attacke keine Zahlungsinformationen entwendet - dafür aber -Adressen, Usernamen und Passwörter von knapp 145 Millionen registrierten Kunden. Die Hacker erlangten scheinbar über von Ebay-Mitarbeitern gestohlene Logins Zugriff auf die Datenbanken des Unternehmens. Die Verantwortlichen wurden nicht identifiziert.
J.P. Morgan Chase
Mit J.P. Morgan rückte im Juli 2014 eine der größten US-Banken ins Visier von Cyberkriminellen. Rund 83 Millionen Datensätze mit Namen, Adressen und Telefonnummern von Kunden fielen den Hackern in die Hände. Zugang erlangten die Kriminellen offensichtlich über gestohlene Login-Daten eines Mitarbeiters. Allerdings musste sich J.P. Morgan den Vorwurf gefallen lassen, seine Systeme nicht ausreichend zu schützen. Inzwischen wurden in den USA und Israel vier Personen festgenommen, die mutmaßlich an diesem Hack beteiligt waren.

12. Challenge Example 2: New „Business“ Models… … and simple threats.

13. Cybercrime: Highly Profitable Business
Cyber-Crime became an attractive business model: the expected volumes to compete drugs trade!
Development of a collaborative eco system
Professionalizing and substantial amounts of financial and technical resources
Top-seller 2016: Ransomware

14. Collateral Damage
Even not been targeted, the financial damage is significant

15. But … … what about IT-Security?

16. Altough much more IT security tools available
More incidents
Altough much more IT security tools available
Number of cyber security incidents
Traditional Approachs
IDS
Port- Control
FDE
VPN
Port
Firewall
Desktops
Mobile
Web-
Proxy
Link encryption AV
90s
2000s
2010s
Time
Mitarbeiter:
RS SIT (130)
GP (100)
SRX (70)
Ipoque (70)

17. Exploitable vulnerabilities in all pieces of SW
Too many vulnerabilities in software
The quality of software of the operating systems and applications is not good enough!
Error rate: Number of errors (bugs) per 1,000 Lines of Code (LoC).
Error rate
Classification of programs
< 0.5
stable programs
0.5 … 3
maturing programs
3 … 6
unstable programs
6 … 10
error-prone programs
> 10
useless programs
Operating systems have more than 30 million LoC
 expected >9,000 errors (Error rate 0.3 )
and thus too many potential vulnerabilities

18. Paradigm change towards pro-active
„Security by Design“
Today’s approaches
„Airbag-Method“: If it happens, make it „less hurting“
Adequate Cybersecurity
„ESP strategy“: Avoid accidents before they happen
Mitarbeiter:
RS SIT (130)
GP (100)
SRX (70)
Ipoque (70)

19. 3 Paradigms Preemptive Protection rather than Reactive Measures
Providing reliable IT-infrastructures and giving functional guarantees, but keeping them useful
Strong Isolation of sensitive applications from all other legacy stuff.

20. 3 Paradigms Preemptive Protection rather than Reactive Measures
Providing reliable IT-infrastructures and giving functional guarantees, but keeping them useful
Strong Isolation of sensitive applications from all other legacy stuff.
Separation, Attestation
Separation of critical areas into separated, fully virtualized components
Reducing the size of security relevant components (TCB)
Integrity protection of these components
Data exchange only through clearly defined interfaces
TECHNOLOGIES: Virtualization, Security Kernels
Next Generation Firewalls with white listing
Only known, validated protocols are accepted
Non-alignable packets will be dropped
TECHNOLOGIES: Deep-Packet Inspection Engine

21. 3 Paradigms Preemptive Protection rather than Reactive Measures
Providing reliable IT-infrastructures and giving functional guarantees, but keeping them useful
Strong Isolation of sensitive applications from all other legacy stuff.

22. 3 Paradigms Preemptive Protection rather than Reactive Measures
Providing reliable IT-infrastructures and giving functional guarantees, but keeping them useful
Strong Isolation of sensitive applications from all other legacy stuff.
Information Flow Control rather than Access Control
Protecting a piece of data from creation until destruction (object lifecycle protection)
Requires distributed policy enforcement to ensure that my data is processed according to my policies, even on foreign systems that are not controlled by myself.

23. 3 Paradigms Preemptive Protection rather than Reactive Measures
Providing reliable IT-infrastructures and giving functional guarantees, but keeping them useful
Strong Isolation of sensitive applications from all other legacy stuff.
Information Flow Control rather than Access Control
Protecting a piece of data from creation until destruction (object lifecycle protection)
Requires distributed policy enforcement to ensure that my data is processed according to my policies, even on foreign systems that are not controlled by myself.
Leveraging users from unfulfillable responsibility
Reducing user’s efforts with impact on security to be minimal
User means end-user as well as administrators.

24. National Experience: Germany drives the Paradigm Shift
Massive research and development support since early 2000
BMWi-, BMBF-, BSI and EU programs
Extensive product development by the industry

25. National Experience: Germany drives the Paradigm Shift
Massive research and development support since early 2000
BMWi-, BMBF-, BSI and EU programs
Extensive product development by the industry
Focusing on an reasonable security by applying a layered model (Trusted Computing Base)
Proactive technologies are today available and getting more and more commodity in large-scale deployment and usage
Example: APT/Vulnerability protecting BitBox:
Example: APT/Vulnerability protecting and secure chat/voice BizzTrust:

26. Conclusion Cybersecurity will become even more critical in the future
Currently deployed security tools are far behind to be adequate, compared to the values to be protected
We need to define a set of new standards, following a Paradigm Shift in IT-Security to cope with the an increasingly smarter threat environment

27. Rohde & Schwarz Cybersecurity
Rohde & Schwarz Cybersecurity GmbH
Mühldorfstraße 15
81671 München
Phone
Web cybersecurity.rohde-schwarz.com
Rohde & Schwarz Cybersecurity