1. Cyber Security in Network Centric Environment
Anvita Sharma
Middleware Architect
Red Hat

2. Agenda NCO - Network Centric Operations Cyber Security Challenge
Intelligence Driven Security Systems
Tools that can help
Questions

3. Network Centric Operations
Net-Centric Operations refers to participating as a part of a complex community of people, devices, information and services interconnected by a communications network to optimise resource management and provide superior information on events and conditions needed to empower decision makers.

4. Being able to fight a network by a Network
“Net-Centric Operations refers to participating as a part of a complex community of people, devices, information and services interconnected by a communications network to optimise resource management and provide superior information on events and conditions needed to empower decision makers.”
Primary goal of any defence establishment is to operate more efficiently and effectively than its adversaries.
Being able to fight a network by a Network
Eventually shorten the decision cycle to operate inside the adversary’s decision cycle with quality, dynamic, and mission-critical information.
Gain Information Superiority and Increased Shared Awareness.

5. NCO – Reference Model Essentially we are talking about a Large
Available and
Protected network infrastructure i.e a Global Information Grid
That enables
responsive information-centric operations
using dynamic and interoperable communication and computing capabilities.
A rich and information sharing environment in which the data and services are visible, accessible and, understandable and trusted across enterprise

6. What Problems are we trying to solve?
1. The problem statement is create a Net Centric infrastructure which comprises of all the networks, communications and information management applications required to assure delivery of data/information to the right place at the right time in the right format.
Network Centric Operations (NCO) are the series of processes and applications required by commander and staff in order to conduct military operations at the strategic, operational and tactical levels.
Set a robust, adaptable series of services to ensure information flow from source to destination.
Given the constraints of military communication environment,

7. What Problems are we trying to solve?
1. The problem statement is create a Net Centric infrastructure which comprises of all the networks, communications and information management applications required to assure delivery of data/information to the right place at the right time in the right format.
Network Centric Operations (NCO) are the series of processes and applications required by commander and staff in order to conduct military operations at the strategic, operational and tactical levels.
Set a robust, adaptable series of services to ensure information flow from source to destination.
Given the constraints of military communication environment,

8. SECURE THE NET

9. Cybersecurity Challenge
The Department of Defense (DoD) faces the challenge of developing an interoperable, globally connected information enterprise across Department, Mission Area, Component, and Program boundaries. An integrated Enterprise Architecture (EA) provides a holistic view to assist the DoD in achieving its shared vision, a Net-Centric Operational Environment.
EA is a blueprint for implementing the DoD’s shared IT vision: how the DoD will achieve
its mission objectives now and in the future. The architecture provides leaders with the tools to facilitate change and decision making at all tiers of the enterprise. When used
with Portfolio Management (PfM), an integrated EA helps ensure IT investments reach this vision. EA integration and governance of the portfolio increase the probability of successful transformation across the IT lifecycle.
For the DoD, EA and PfM provide an integrated approach to advance current systems, improve interoperability, extend network capabilities, and manage IT complexity across secure channels to achieve a shared vision.

10. It's largely about DATA..

11. Two sides of Big Data Coin – Data enables business to accomplish their mission of streamline they way they interact with customers, acquire new customers, and improve efficiency. Infrastructure enables IT to support the business’s mission.
Big Data Workloads are different
“Big Data is a blanket term for any collection of data sets so
large and complex that it becomes difficult to process using onhand
database management tools or traditional data processing
Applications……” (wikipedia)
“Big Data is a term describing the storage and analysis of large
and or complex data sets using a series of techniques including,
but not limited to: NoSQL, MapReduce and machine learning.” source: MIT Technology Review
Big Data is about new technologies to deal wit hdeficiencies to traditional data processing
The basic idea of the Big Data trend is to employ better tools that analyze information that you already have (e.g. website stats, ERP data) and combine that with additional data that you can get (either free or paid for) such as social media, market research and other information.

12. ... Machine generated data
200 billions
40%
Connected devices
by 2020
Machine data growth
by 2020
Getting DATA from MACHINES

13. DATA SILOS Getting DATA from BUSINESS Business generated data
Traditionnal sources (CRM / ERP / Finance / ETL dataquality /
normalizing data / data warehousing / business analyst / business users
STRUCTURED
Getting DATA from BUSINESS

14. Getting DATA on/from the USERS
Human Generated data
500M tweets/day
eq 6.5 Gbps
10B messages/day
eq 146 Gbps
64B messages/day
eq 830 Gbps
Source: eMarketer, Dec 2013
Source: eMarketer, Dec 2013
Getting DATA on/from the USERS

15. CONVERGENCE OF FOUR DATA TRENDS
STRUCTURED / UNSTRUCTURED DATA
Combine high velocity and historical analysis
Analyze and react to data in motion; adjust models with deep historical analysis
Combine structured and unstructured analysis
Augment data warehouse with additional external sources, such as social media
Reuse structured data for analysis
Experimentation and ad-hoc analysis with structured data

16. More Data means More Security

17. Intelligence Driven Security Model
Using Big Data to confront the unprecedented information risk arising from
Diminishing Network Boundaries
Sophisticated Adversaries
It's largely about DATA..
It's largely about DATA..
It's largely about DATA..
The Department of Defense (DoD) faces the challenge of developing an interoperable, globally connected information enterprise across Department, Mission Area, Component, and Program boundaries. An integrated Enterprise Architecture (EA) provides a holistic view to assist the DoD in achieving its shared vision, a Net-Centric Operational Environment.
EA is a blueprint for implementing the DoD’s shared IT vision: how the DoD will achieve
its mission objectives now and in the future. The architecture provides leaders with the tools to facilitate change and decision making at all tiers of the enterprise. When used
with Portfolio Management (PfM), an integrated EA helps ensure IT investments reach this vision. EA integration and governance of the portfolio increase the probability of successful transformation across the IT lifecycle.
For the DoD, EA and PfM provide an integrated approach to advance current systems, improve interoperability, extend network capabilities, and manage IT complexity across secure channels to achieve a shared vision.

18. Intelligence Driven Security Model
Monitoring Systems
Diverse Data
Sources
Standardised Views
It's largely about DATA..
It's largely about DATA..
It's largely about DATA..
Big Data Driven
Security Model
High Degree
of Integration
The Department of Defense (DoD) faces the challenge of developing an interoperable, globally connected information enterprise across Department, Mission Area, Component, and Program boundaries. An integrated Enterprise Architecture (EA) provides a holistic view to assist the DoD in achieving its shared vision, a Net-Centric Operational Environment.
EA is a blueprint for implementing the DoD’s shared IT vision: how the DoD will achieve
its mission objectives now and in the future. The architecture provides leaders with the tools to facilitate change and decision making at all tiers of the enterprise. When used
with Portfolio Management (PfM), an integrated EA helps ensure IT investments reach this vision. EA integration and governance of the portfolio increase the probability of successful transformation across the IT lifecycle.
For the DoD, EA and PfM provide an integrated approach to advance current systems, improve interoperability, extend network capabilities, and manage IT complexity across secure channels to achieve a shared vision.
Analytics Engine
Tools to collect Data
Centralised Storage

19. INTEGRATON PLATFORMS

20. With JBoss Fuse, You Can Integrate Everything...
cloud / SaaS apps
distributors
partners
devices +
HQ + integration stack
- With the JBoss Fuse & JBoss A-MQ products, enterprises are no longer limited to integration at a hub or central HQ type location.
- Now enterprises can have intelligent integration with all enterprise assets extending to devices, warehouses, distributor outlets or outlets.
- Enterprises can have an ESB to integrate applications at store or distributor outlets (with its own set of technical and resource requirements) and that ESB can also integrate the store/distributor business data with central HQ.
- Enterprises can have a Messaging Platform (JBoss A-MQ) to integrate different devices, sensors, applications and services in real-time.

21. DATA GRID

22. What is a data grid? Key data grid characteristics:
An in-memory distributed data store designed for fast access to large volumes of data and scalability
Commonly a complementary layer to the relational database and the application.
Store and Compute Data/Events
Key data grid characteristics:
In-memory, distributed caching
Elastic scalability
Advanced querying
Data replication
Processing for streaming data
Transaction capabilities

23. COMPLEX EVENT PROCESSING

24. What is Complex Event Processing?
What is an Event?
A significant change of state at a particular point in time.
What is Complex Event Processing?
The ability to detect, correlate, abstract, aggregate or compose and react to events.

25. CEP and BRMS Enables: Event Detection (Temporal) Event Correlation
From an event cloud or set of streams, select all the meaningful events and only then:
(Temporal) Event Correlation
Ability to correlate events and facts declaring both temporal and non-temporal constraints between them. Ability to reason over event aggregation.
Event abstraction
Ability to compose complex events from atomic events AND reason over them.

26. Model: CEP Modes Cloud Mode Stream Mode Events must be time-ordered
Default Mode – All facts and events are loaded before reasoning
Many to many pattern matching by the engine
No notion of flow of time, no clock synchronization
Ordering is not required
Event lifecycle managed by user
Sliding window is not needed
Events must be time-ordered
Engine synchronizes between streams using session clock
Engine applies the notion of flow
Engine manages the event lifecycle
Sliding window option could be used
Negative patterns could be used. Ex. Fire detected, no sprinkler turned on in 10 sec sound alarm
JBoss Enteprise BRMS (new in 2009)
Enables critical business rules to be managed in a more centralized manner (e.g. Insurance = policy risk assess and pricing; Heathcare = claims processing annual regulatory changes)
Avoids need to otherwise re-code business rules redundantly in multiple applications
Leverages JBoss Rules execution engine which has been available for years
Adds new browser-based Rules Mgmt app, enabling business users to participate in the review, editing, and maintenance of business rule changes
Also adds Repository to provide version management of multiple sets of business rules
Supports the deployment of business rules to JBoss middleware platforms and non-JBoss runtime environments 26

27. Model: Temporal Relationships
when
Shipment( $pickupTime : scheduledPickupTime )
not ShipmentPickup( this before $pickupTime )
then
// shipment not picked up... Action required.
end
rule “Shipment not picked up in time”
Temporal
Relationship
13 Operators are Supported
Event A before Event B
Event A meets Event B
Event A overlaps Event B
Event A finishes Event B
Event A includes Event B
Event A starts Event B
Event A coincides Event B
Event A after Event B
Event A metBy Event B
Event A overlapedBy Event B
Event A finishedBy Event B
Event A during Event B
Event A finishes Event B
JBoss Enteprise BRMS (new in 2009)
Enables critical business rules to be managed in a more centralized manner (e.g. Insurance = policy risk assess and pricing; Heathcare = claims processing annual regulatory changes)
Avoids need to otherwise re-code business rules redundantly in multiple applications
Leverages JBoss Rules execution engine which has been available for years
Adds new browser-based Rules Mgmt app, enabling business users to participate in the review, editing, and maintenance of business rule changes
Also adds Repository to provide version management of multiple sets of business rules
Supports the deployment of business rules to JBoss middleware platforms and non-JBoss runtime environments 27

28. Model: CEP – Sliding Windows
Joined window
Sliding Time Window
- Reason Over events occurring next set time duration
Sliding Length Window
- Reason Over set number of events occuring
Example: Raise alarm if avg temp reading from sensor over last 10m is above the threshold
Example: Raise alarm if avg temp from last 100 sensor readings is above the threshold
JBoss Enteprise BRMS (new in 2009)
Enables critical business rules to be managed in a more centralized manner (e.g. Insurance = policy risk assess and pricing; Heathcare = claims processing annual regulatory changes)
Avoids need to otherwise re-code business rules redundantly in multiple applications
Leverages JBoss Rules execution engine which has been available for years
Adds new browser-based Rules Mgmt app, enabling business users to participate in the review, editing, and maintenance of business rule changes
Also adds Repository to provide version management of multiple sets of business rules
Supports the deployment of business rules to JBoss middleware platforms and non-JBoss runtime environments
rule "Sound the alarm in case temperature rises above threshold"
when
TemperatureThreshold( $max : max )
Number( doubleValue > $max ) from accumulate(
SensorReading( $temp : temperature ) over window:time( 10m ),
average( $temp ) )
then
// sound the alarm
end
rule "Sound the alarm in case temperature rises above threshold"
when
TemperatureThreshold( $max : max )
Number( doubleValue > $max ) from accumulate(
SensorReading( $temp : temperature ) over window:length( 100 ),
average( $temp ) )
then
// sound the alarm
end 28

29. DATA VIRTUALIZATION AND FEDERATION

30. What is Data Virtualization software?
S o l e t s d e f i n e w h a t a r e t h e a t t r i b u t e s o f D a t a V i r t u a l i z a t i o n s o l u t i o n . T h e f i r s t t h i n g t h a t d a t a v i r t u a l i z a t i o n p r o d u c t d o e s i s v i r t u a l i z e s t h e d a t a , r e g a r d l e s s o f w h e r e i t i s . I t m a k e s t h e d a t a l o o k a s i f i t w a s i n o n e p l a c e . S o a p p l i c a t i o n s d o n ’ t n e e d t o k n o w w h e r e t h e d a t a i s , b e c a u s e t h e d a t a v i r t u a l i z a t i o n s o f t w a r e d o e s t h a t f o r y o u .
T h e s e c o n d t h i n g t h a t d a t a v i r t u a l i z a t i o n d o e s i s f e d e r a t i n g t h e d a t a . Y o u ’ r e r u n n i n g a q u e r y w h i c h s p a n s m u l t i p l e d a t a b a s e s o r d a t a w a r e h o u s e s . Y o u w a n t t h a t q u e r y t o r u n s u f f i c i e n t l y a n d w i t h o p t i m u m p e r f o r m a n c e . S o i n o r d e r t o d o t h a t , y o u n e e d a v a r i e t y o f t e c h n i q u e s , l i k e c a c h i n g , l i k e p u s h d o w n o p t i m i z a t i o n , y o u n e e d t o h a v e k n o w l e d g e o f t h e s o u r c e d a t a b a s e s t o m a k e t h i s w h o l e e n v i r o n m e n t r u n a s s m o o t h l y a n d e f f i c i e n t l y a s p o s s i b l e .
T h i r d l y , i t a b s t r a c t s t h e d a t a i n t o t h e f o r m a t o f c h o i c e . I t c o n f o r m s t h e d a t a s o t h a t i t ’ s i n a c o n s i s t e n t f o r m a t , a n d t h a t ’ s r e g a r d l e s s o f t h e n a t i v e s t r u c t u r e o r s y n t a x o f t h e d a t a . A n d o n e p o i n t I s h o u l d m a k e h e r e i s t h a t y o u w a n t t o b e a b l e t o – y o u d o n ’ t w a n t a t o o l w h i c h w i l l f o r c e y o u t o h a v e a p a r t i c u l a r f o r m a t . W h a t y o u w a n t i s a f o r m a t t h a t s u i t s y o u r b u s i n e s s , r a t h e r t h a n o n e w h i c h i s i m p o s e d o n y o u . S o y o u n e e d t o h a v e , t h e d a t a v i r t u a l i z a t i o n t o o l i t s e l f n e e d s t o b e a g i l e a n d f l e x i b l e , i n t h e s e n s e o f b e i n g a b l e t o p r o v i d e a d a t a f o r m a t t h a t s u i t s y o u .
A n d t h e n t h e f o u r t h t h i n g y o u h a v e a r e q u i r e m e n t f o r i s t o p r e s e n t t h e d a t a i n a c o n s i s t e n t f a s h i o n . A n d i t d o e s n ’ t m a t t e r w h e t h e r i t ’ s a b u s i n e s s i n t e l l i g e n c e a p p l i c a t i o n , i t ’ s a m a s h - u p , i t ’ s a r e g u l a r a p p l i c a t i o n ; w h a t e v e r i t i s , y o u w a n t t o b e a b l e t o p r e s e n t t h e d a t a i n a c o n s i s t e n t f o r m a t t o t h e b u s i n e s s , t o p a r t i c i p a t i n g a p p l i c a t i o n s .
Imagine if all the up-to-date data you need to take informed action, is available to you on demand as one unified source. This is the capability provided by Data Virtualization software.
3030
What is Data Virtualization software?
BI Reports
SOA Applications
Easy,
Real-time
Information
Access
Data Virtualization software makes data that is spread across various disparate sources; available to applications as if it is coming from a single dedicated data source.
Data Virtualization Software
Virtual Data Source
Virtualize
Abstract
Federate
Siloed &
Complex
Oracle DW
SAP
XML, CSV
& Excel files
Salesforce.com

31. Turn Data to Actionable Information
Mobile Applications
BI Reports & Analytics
ESB, ETL
SOA Applications & Portals
Easy,
Real-time
Information
Access
Data Consumers
Consume
Design Tools
Standard based Data Provisioning
JDBC, ODBC, SOAP, REST, OData
Dashboard
Compose
Unified Virtual Database / Common Data Model
Optimization
Virtualize
Abstract
Federate
JDV
Unified Customer View
Unified
Product View
Unified
Supplier View
Caching
Connect
The data virtualization software provides 3 step process to connect data sources and data consumers:
Connect: Fast Access to data from disparate systems (databases, files, services, applications, etc.) with disparate access method and storage models.
Compose: Easily create reusable, unified common data model and virtual data views by combining and transforming data from multiple sources.
Consume: Seamlessly exposing unified, virtual data model and views available in real-time through a variety of open standards data access methods to support different tools and applications.
JBoss Data Virtualization software implements all three steps internally while isolating/hiding complexity of data access methods, transformation and data merge logic details from information consumers.
This enables organization to acquire actionable, unified information when they want it and the way they want it; i.e. at the business speed.
Security
Native Data Connectivity
Metadata
Siloed &
Complex
Data Sources
Data Warehouse
& Databases
XML, CSV
& Excel Files
Enterprise Apps
Hadoop
NoSQL
Cloud Apps
Mainframe

32. Data Virtualization: Supported Data Sources
Enterprise RDBMS:
Oracle
IBM DB2
Microsoft SQL Server
Sybase ASE
MySQL
PostgreSQL
Ingres
Enterprise EDW:
Teradata
Netezza
Greenplum
Hadoop:
Apache
HortonWorks
Cloudera
More coming…
Office Productivity:
Microsoft Excel
Microsoft Access
Google Spreadsheets
Specialty Data Sources:
ModeShape Repository
Mondrian
MetaMatrix
LDAP
NoSQL:
JBoss Data Grid
MongoDB
Enterprise & Cloud Applications:
Salesforce.com
SAP
Technology Connectors:
Flat Files, XML Files, XML over HTTP
SOAP Web Services
REST Web Services
OData Services

33. ANALYTICS

34. BAM: Process Dashboard – Instance Details
JBoss Enteprise BRMS (new in 2009)
Enables critical business rules to be managed in a more centralized manner (e.g. Insurance = policy risk assess and pricing; Heathcare = claims processing annual regulatory changes)
Avoids need to otherwise re-code business rules redundantly in multiple applications
Leverages JBoss Rules execution engine which has been available for years
Adds new browser-based Rules Mgmt app, enabling business users to participate in the review, editing, and maintenance of business rule changes
Also adds Repository to provide version management of multiple sets of business rules
Supports the deployment of business rules to JBoss middleware platforms and non-JBoss runtime environments 34

35. Some have done it already
What for ?

36. Red Hat Customer Success
3636
Red Hat Customer Success
Red Hat Embedded Partner
in military
Global Banking Institution
Red Hat JBoss and Storage solutions power the Risk Management group of a Tier 1 global Bank with infrastructure to run Liquidity Risk algorithms on multiple intervals (intraday to annual), to optimize rule-based decisions and provide long term data retention
Realtime
Variety
Aggregate
Retention
Mission critical
This is for JPMorgan
Most large banking infrastructures, on a typical day, process millions of derivative trades. The main implication is that there are a large number of data inserts and updates to handle. Once the data is loaded into the infrastructure there needs to be complex mathematical calculations that need to be done in near real time to calculate intraday positions. Typical Risk Management calculations require that for each time point, and for each product line, separate simulations are run to derive higher order result.
Once this is done, the resulting intermediate data then needs
to be aligned to collateral valuations, derivate settlement agreements and any other relevant regulatory to arrive at a final portfolio position. Further there needs to be a mechanism to pull in data that needs be available from a reference perspective for a given set of clients and/or portfolios.
At the same time, long term positions need to be calculated for stress tests, for instance, typically using at 12 to 24 months of data pertaining to a given product set.
Finally the two streams of data may be compared to produce a CVA (Credit Valuation Adjustment) value.
The average Investment Bank deals with potentially 50 to 80 future datesand up to 3,000 different market paths, thus computation resource demands are huge. Reports are produced daily, and under special conditions multiple times per day. What-if scenarios with strawman portfolios canalso be run to assess regulatory impacts and to evaluate business options.
The following are the broad business goals for any such implementation –
* Provide a centralized location for aggregating at a housewide level and subsequent analysis of market data, counterparties, liabilities and exposures
* Support the execution of liquidity analysis on a intraday or multi-day basis while providing long term data retention capabilities
* Provide strong but optional capabilities for layering in business workflow and rule based decisioning as an outcome of analysis
* Support the execution of liquidity analysis on a intraday or multiday basis while providing long term data retention capabilities
* Provide strong but optional capabilities for layering in businessworkflow and rule based decisioning as an outcome of analysis
Direct feeds from market data, to inject those data into intra-day calcultation
Multi-period calculations, from intraday to over the year calculations. Up to 80 future dates and 3000 different market paths
Market data live feeds with other counterparties, liabilities and exposures ; mix of hadoop-based data analysis and realtime data analysis
Long term retention of data to compute year-long risk analysis (up to 2 years)
System reliability and availability with data caching, persistent messages and high availability architecture

37. Red Hat Customer Success
3737
Red Hat Customer Success
Red Hat Embedded Partner
in military
France Electricity provider ERDF
Red Hat JBoss solutions power the ERDF Intelligent System with complex data filtering, event processing and data collected by the millions of intelligent and connected home electric meters
Detect
Collect
Filter and
correlate
Diagnose
Mission critical
Overview
Linky is the name of the intelligent meter device from ERDF (French Electricity Home Distribution branch) ;
Using BRMS / CEP in the Datacenter tier to provide filtering and analysis of events , with correlation capabilities ; 8 millions events a day ; help to diagnose dysfunctioninhg
Meters and Collectors monitoring, Event collection for QoS and performance monitoring
Data and Event collection
8 millions multi-format events per day, stored for 5 years.
On the fly KPI calculation
Contextual behavior analysis via CEP, to identify malfunctions and unwanted floods, to control and manage context
Automatic diagnosis based on complex rules and context management. Manual diagnosis via mobile device and applications, structured data and cartography
System reliability and availability with data caching, persistent messages and high availability architecture

38. Questions
and
Discussion