1. System Aware Cyber Security NDIA Barry Horowitz University of Virginia February, 2013 1 Sponsor: DoD, through the Stevens Institute”s SE Research Center

2. System Aware Cyber Security Research is in its 3 rd Year Today‘s discussion focused on: Classes of Solutions (Design Patterns) Initial Prototype Implementation for an Autonomous Surveillance System 2

3. Broad Objective Reversing cyber security asymmetry from favoring our adversaries (small investment in straight forward cyber exploits upsetting major system capabilities), to favoring the US (small investments for protecting the most critical system functions using System Aware cyber security solutions that require very complex and high cost exploits to defeat) 3

4. Broad Objective Reversing cyber security asymmetry from favoring our adversaries (small investment in straight forward cyber exploits upsetting major system capabilities), to favoring the US (small investments for protecting the most critical system functions using System Aware cyber security solutions that require very complex and high cost exploits to defeat) Focus on Defense Against Exploits that Impact System Performance (e.g., Data Corruption, Functional Degradation, System Latencies) 4

5. System Aware Cyber Security Operates at the system application-layer, For security inside of the network and perimeter protection provided for the whole system Directly protects the most critical system functions Solutions are embedded within the protected functions Addresses supply chain and insider threats Includes physical systems as well as information systems Solution-space consists of reusable design patterns, reducing unnecessary duplications of design and evaluation efforts Design Patterns can be implemented in a super secure programmable Sentinel (S3) 5

6. System-Aware Cyber Security Architecture System-Aware Cyber Security Architectures combine design techniques from 3 communities – Cyber Security – Fault-Tolerant Systems – Automatic Control Systems The System-Aware solution designers need to come from the communities related to system design and system engineering, providing a new orientation to complement the established approaches of the information assurance community

7. A Set of Techniques Utilized in System-Aware Security Cyber Security *Data Provenance *Moving Target ( Virtual Control for Hopping) *Forensics Automatic Control *Physical Control for Configuration Hopping (Moving Target, Restoral) *State Estimation Techniques (Data Integrity) *System Identification (Data Integrity, Restoral) Fault-Tolerance *Diverse Redundancy (DoS, Automated Restoral) *Redundant Component Voting (Data Integrity, Restoral)

8. A Set of Techniques Utilized in System-Aware Security Cyber Security *Data Provenance *Moving Target ( Virtual Control for Hopping) *Forensics Automatic Control *Physical Control for Configuration Hopping (Moving Target, Restoral) *State Estimation (Data Integrity) *System Identification (Tactical Forensics, Restoral) Fault-Tolerance *Diverse Redundancy (DoS, Automated Restoral) *Redundant Component Voting (Data Integrity, Restoral) This combination of solutions requires adversaries to: Understand the details of how the targeted systems actually work

9. A Set of Techniques Utilized in System-Aware Security Cyber Security *Data Provenance *Moving Target ( Virtual Control for Hopping) *Forensics Automatic Control *Physical Control for Configuration Hopping (Moving Target, Restoral) *State Estimation (Data Integrity) *System Identification (Tactical Forensics, Restoral) Fault-Tolerance *Diverse Redundancy (DoS, Automated Restoral) *Redundant Component Voting (Data Integrity, Restoral) This combination of solutions requires adversaries to: Understand the details of how the targeted systems actually work Develop synchronized, distributed exploits consistent with how the attacked system actually works

10. A Set of Techniques Utilized in System-Aware Security Cyber Security *Data Provenance *Moving Target ( Virtual Control for Hopping) *Forensics Automatic Control *Physical Control for Configuration Hopping (Moving Target, Restoral) *State Estimation (Data Integrity) *System Identification (Tactical Forensics, Restoral) Fault-Tolerance *Diverse Redundancy (DoS, Automated Restoral) *Redundant Component Voting (Data Integrity, Restoral) This combination of solutions requires adversaries to: Understand the details of how the targeted systems actually work Develop synchronized, distributed exploits consistent with how the attacked system actually works Corrupt multiple supply chains

11. Integration of Fault Tolerance, Automatic Control and Information Assurance What’s Different for each technology community – Fault Tolerance Asymmetric attacks vs random failures Synchronized dependent attacks on system components vs random coupling of independent failures Time varying, situation-related, attacks vs random intermittent failures Need to adjust detection criteria based upon pre-mission intelligence and other a priori information regarding attack – Automatic Control High rates of system reconfiguration (configuration hopping) Roles of the operator – Information Assurance System Aware solutions Collateral, system-specific, performance impacts of embedded security solutions Plus: – Require secure implementation of solutions

12. Design Patterns Being Prototyped Diverse Redundancy for post-attack restoration Diverse Redundancy + Verifiable Voting for trans-attack attack deflection Physical Configuration Hopping for moving target defense Virtual Configuration Hopping for moving target defense Data Consistency Checking for data integrity and operator display protection Parameter Assurance for parameter controlled SW functions System Restoration using diverse redundancy 12

13. Design Patterns Being Prototyped Diverse Redundancy for post-attack restoration Diverse Redundancy + Verifiable Voting for trans-attack attack deflection Physical Configuration Hopping for moving target defense Virtual Configuration Hopping for moving target defense Data Consistency Checking for data integrity and operator display protection Parameter Assurance for parameter controlled system functions System Restoration using diverse redundancy As new applications are addressed, new design patterns will emerge, leading to an expanding library for reuse

14. CASE 1: SHIP CONTROL SYSTEM FOR PHYSICAL PLANT “A System-Aware Cyber Security Method for Shipboard Control Systems”- Accepted for 2012 IEEE Homeland Security Conference Guy L. Babineau Northrop Grumman Naval & Marine Systems Division Rick A. Jones and Barry Horowitz University of Virginia Department of Systems and Information Engineering 14

15. Block Diagram Illustrating the Current System Architecture 15

16. System-Aware Security Solution 16

17. 17

18. 18

19. CASE 2: DYNAMIC SYSTEM MODELS AND STATE ESTIMATION TECHNOLOGY FOR DATA INTEGRITY AND OPERATOR DISPLAY ATTACKS Barry M. Horowitz, Katherine Pierce, Application of Diversely Redundant Designs, Dynamic System Models and State Estimation Technology to the Cyber Security of Physical Systems, Systems Engineering, Volume 16, No. 3, 2013 19

20. The Problem Being Addressed Highly automated physical system Operator monitoring function, including criteria for human over-ride of the automation Critical system states for both operator observation and feedback control – consider as least trusted from cyber security viewpoint Other measured system states – consider as more trusted from cyber security viewpoint CYBER ATTACK: Create a problematic outcome by disrupting human display data and/or critical feedback control data. 20

21. Protected Physical System System Operator Information Consistency Checking Information Consistency Checking Cyber Attack Alerts and Responses State Estimator 1 Diversely Redundant State Estimator 2 Applicable Subsystems and Users Simplified Block Diagram for Inference-Based Data Integrity Detection System 21

22. Simulated System Output Based Upon Controller Attack 22

23. Simulated Regulator Attack True Monitored State Operator Observed State Inferred Monitored State Δ in Operator and Inferred States 23

24. Case 3: Parameter Assurance 24

25. Parameters in Systems Parameters control how systems function – for instance: – Detection Thresholds For example, target detection for Active sensors (Radar), Passive sensors (SIGINT), impacting missed detection/false alarm performance – Decision Thresholds Tactical: Satellite time-to-collision decision time, impacting timing for taking action; obstacle avoidance threshold before taking action Strategic: Mission Planning System mission timing parameters – Flight control boundary values For example, artificial bounds on accelerations, altitude – Navigation Waypoints – Tracking algorithm parameters determine sensitivity and latencies for position/velocity estimates relative to timing of accelerations – Communication system mode parameters, impacting QOS 25

26. Parameters in Systems Parameters control how systems function – for instance: – Detection Thresholds For example, target detection for Active sensors (Radar), Passive sensors (SIGINT), impacting missed detection/false alarm performance – Decision Thresholds Tactical: Satellite time-to-collision decision time, impacting timing for taking action; obstacle avoidance threshold before taking action Strategic: Mission Planning System mission timing parameters – Flight control boundary values For example, artificial bounds on accelerations, altitude – Navigation Waypoints – Tracking algorithm parameters determine sensitivity and latencies for position/velocity estimates relative to timing of accelerations – Communication system mode parameters, impacting QOS Parameter tables provide an organized means for changing parameters and a high leverage opportunity for exploits 26

27. Parameter Assurance Design Pattern Parameter change detection – Case 1: Exploit changes values in a parameter table - Monitor parameter tables and operator actions to determine if an automated change occurred – Case 2: Embedded exploit over-rides table parameter values as part of its execution - Monitor computer-derived decisions and data that led to the derived decisions to estimate the corresponding parameter that caused the result, and compare to parameter table value Parameter restoration (complex process/simplified explanation) – Reverse parameter value – Inhibit responsive change-back – Inform appropriate operator(s) 27

28. Sentinel Concept for Monitoring Critical System Functions 28

29. Example: Autonomous Surveillance Platform Protection 29

30. Sentinel with Low Scale, More Securable SW and HW Our research to-date indicates that: – Monitoring functions require limited processing capacity and small computer programs – Voting requires limited processing and small computer programs – The timing and synchronization factors for monitoring and control functions are not demanding – The functions of a Sentinel can be distributed across many small, diverse redundant machines 30

31. Sentinel with Low Scale, More Securable SW and HW Our research to-date indicates that: – Monitoring functions require limited processing capacity and small computer programs – Voting requires limited processing and small computer programs – The timing and synchronization factors for monitoring and control functions are not demanding – The functions of a Sentinel can be distributed across many small, diverse redundant machines The securing of the Sentinel can use security techniques that may not be practical for large system application, but can potentially be suitable for a low-scale application as represented by the System-Aware Sentinel 31

32. Example: Autonomous Surveillance Platform Protection Config. hopping Diverse redundancy Port Hopping Dedicated voting processing SW power utilization fingerprint SW CPU and memory usage fingerprint For Security Control Only Spread Spectrum Waveform Low Data Rate 32

33. Super Secure Sentinel (S3) Design Concept 33

34. High Level Architectural Overview System to be Protected Sentinel Providing System-Aware Security Internal Measurements Outputs Internal Controls 34

35. Sentinel Data Flow 35 Switchable Diversely Redundant Components Switchable Diversely Redundant Components

36. Possible Sentinel HW/SW Architectures Footprint sensitive programmable family of HW with support SW for different types of programmable features: – Virtual hopping, – Physical hopping, – SW signature analysis, – Diverse redundancy (HW and SW) IaaS-based Sentinel (Sentinel as a Service) for systems which are not seriously constrained by footprint limits, using private Cloud technology for agility and flexibility – Virtual hopping (within a Cloud-based Sentinel) – Diversity for critical Cloud components (e.g., diverse Hypervisors) – Hopping across geographically dispersed Private Clouds Certified Sentinels 36

37. Integrating System-of-Systems Security 37 Perimeter Monitor(s) System 1 Sentinel Network Monitor(s) System 2 Sentinel System 3 Sentinel System “n” Sentinel

38. Going Forward UVA/GTRI are developing the operational prototype – For emulation this year – For field testing next year UVA is refining & adding to our concepts and evaluations for Operator in the loop part of the System-Aware Cyber Security approach Architecture decision support tools for selecting cost-effective System Aware solutions Need new application cases resulting in new Design Patterns – Command and Control systems – Big Data Systems Expand efforts on the S3 Sentinel and alternate implementation approaches, including private Cloud-based approaches Need to get industry engaged, to: – Pursue applications – Create design patterns and implementations – Integrate their Systems Groups and their IA Groups for System-Aware Security applications 38

39. Publications B. M. Horowtiz and K. M. Pierce, The integration of diversely redundant designs, dynamic system models, and state estimation technology to the cyber security of physical systems, Systems Engineering, Volume 16, No. 3 (2013) R. A. Jones and B. M. Horowitz, A system-aware cyber security architecture, Systems Engineering, Volume 15, No. 2 (2012), 224-240. J. L. Bayuk and B. M. Horowitz, An architectural systems engineering methodology for addressing cyber security, Systems Engineering 14 (2011), 294-304. G. L. Babineau, R. A. Jones, and B. M. Horowitz, A system-aware cyber security method for shipboard control systems, 2012 IEEE International Conference on Technologies for Homeland Security (HST), 2012 R.A. Jones, T.V. Nguyen, and B.M. Horowitz, System-Aware security for nuclear power systems, 2011 IEEE International Conference on Technologies for Homeland Security (HST), 2011, pp. 224-229. R. A. Jones and B. M. Horowitz, System-Aware cyber security, itng, 2011 Eighth International Conference on Information Technology: New Generations, 2011, pp. 914-917. 39