to Address Cyber Physical Systems Security (CPSSEC)

Transcription

1 Combating Threats: S&T is Building a Resilient Cyber Ecosystem to Address Cyber Physical Systems Security (CPSSEC) Follow us at dhsscitech

2 CPS Security is Critical Smart cars, grids, medical devices, manufacturing, homes, buildings, smart everything! We bet our lives on these systems cyber security physical safety! Yet, CPS are cobbled together from stuff found on the Web! (OK, there are good guys too) Who minds the shop? Our buildings Our stuff Our transport Our health

3 3 S&T PROGRAM STRUCTURE OBJECTIVE Enable progress through market-driven requirements 1. Specific Industry APPROACH Industry Consortium Develop sector-specific groups Develop economically feasible solutions 2. DHS Focus Areas Applied Research CPSSEC Program Leverage cross-cutting CPS research 3. Cyber Physical System Concepts Joint Research Inter-Agency Efforts

4 4 Example Focus Area: Vehicle Security 200M lines of code in a modern vehicle! Telematics Remote control (locks, start) Remote diagnostics Remote repair (updates) Driver support Navigation Collision warning/avoidance Augmented vision System automation Dynamic EV charging Computer control of engine, brakes, etc. Content and communication Voice and data Information and entertainment

5 Automotive: Securing Telematics Problem - Telematics needed to save fuel, reduce maintenance costs and for vehicle monitoring Although telematics has seen extensive use, security has not been a focus. Solutions Telematics Cyber Security Primer for Agencies (to be made public) Automotive Cybersecurity Industry Consortium (ACIC) Performers DHS S&T, DoT Volpe, SRI International 5

6 6 Automotive: Software Updates Problem Software-Over-the-Air (SOTA) updates are needed to rapidly correct critical flaws in vehicle software. Solutions Uptane: a new generation of software updater that ensures separation of role with explicit/implicit key revocation muptane: derivative implementation to solve compatibility concerns encountered by OEMs Performers New York University (NYU) and University of Michigan Transportation Research Institute (UMTRI)

7 Automotive: Side-Channel Causal Analysis Problem Directly connected IDSs that actively monitor vehicle operations may be detected. Need solutions undetectable by intruders Solution Side-channel monitoring to reveal causal inconsistencies during system operation to detect intrusions to find and secure vulnerabilities while providing low-cost IDS solutions - developed over sel4 Performer HRL Laboratory 7

8 Medical Devices Problem Many medical devices lack even basic security, exposing users to loss of privacy and safety Solution The Intrinsically Secure, Open and Safe Cyber-Physically Enabled, Life- Critical Essential Services (ISOSCELES) architecture - a reference implementation for future mixed-criticality medical and Internet of Things (IoT) system designs developed over sel4 Performer Adventium Labs Infusion Pump

9 Building Automation Systems Problem Isolate critical processes and critical system management and maintain functionality even when partially compromised Solution exploit isolation and proof of correctness provided by a micro-kernel such as sel4, used as a hypervisor Temperature Control Alarm System Performer: USF/KSU, Honeywell HVAC: Fan & Sensor Building Controller

10 Other Stakeholder Engagements Strong Engagement with the Medical Industry S&T-developed risk assessment platform in use by multiple large hospital chains (MDISS) Additional CPSSEC Engagements (co-funded with NSF) SmartGrid thread modeling and testbed (ASU) Smart manufacturing to secure products at the factory (Virginia Tech/Vanderbilt) 10

11 DHS Transition to Practice Program (TTP) Focuses on enabling technology transition from the lab to the marketplace. Identifies innovative, federally funded technologies and guides them through a proven maturation process that includes training, technology and market validation, pilots, and mentorship. Connects research with venture, tech, and government to create better solutions through partnerships.

12 What Makes TTP Unique? Specifically focused on transition, no new R&D Not limited to DHS-funded technologies Any area of cyber Commercialization is a priority Flexible, multiple transition paths Encourage diversity of technical approaches

13 From Lab to Market Place

14 After DHS Revitalization Program expanded to include other areas in S&T, such as data analysis, mining and visualization physical security For universities: Be proactive and contact the TTP office No transition partner required (but welcomed) All federally funded research, not only DHS-funded

15 Contact Info Christos Papadopoulos DHS Science & Technology Directorate dhs.gov/cyber-research TTP PM: Nadia Carlsten #TTPdemo Follow us at dhsscitech