Application of GIS to Cybersecurity. Brian Biesecker Ken Mitchell

Transcription

1 Application of GIS to Cybersecurity Brian Biesecker Ken Mitchell

2 Fundamental Problems that GIS can help you solve What are the impacts to your mission, operations, business activities, critical systems, or critical infrastructure from a Cyber Attack, IT outage or impairment? How do you prioritize the work of your IT Team or Cyber Security Team in the context of your most important missions, operations, business activities, critical systems, or critical infrastructure? How do you provide shared situational awareness across your organization? How can you refine your Cyber Forensics Analysis efforts?

3 Cyberspace Re-Considered It s mappable Social / Persona Layer Device Layer Logical Network Layer Physical Network Layer Geographic Layer Each device in cyberspace is owned by someone (no global commons ) Electro-mechanical devices exist in space-time and interact with physical events Geography is required to integrate and align cyberspace with other data

4 Cyberspace Re-Considered It s mappable ArcSchematic Social / Persona Layer Device Layer Logical Network Layer Physical Network Layer Geographic Layer Each device in cyberspace is owned by someone (no global commons ) Electro-mechanical devices exist in space-time and interact with physical events Geography is required to integrate and align cyberspace with other data

5 Cyberspace Re-Considered It s mappable Utility Network Social / Persona Layer Device Layer Logical Network Layer Physical Network Layer Geographic Layer Each device in cyberspace is owned by someone (no global commons ) Electro-mechanical devices exist in space-time and interact with physical events Geography is required to integrate and align cyberspace with other data

6 Applies to many domains Missions / Operations Critical Systems Information Technology Critical Infrastructure

7 The Cyber Supply Line A vector of devices and network paths Mission Data Flow WAN LAN LAN Bldg Net Bldg Net Campus #1 Campus #2 Cyber Supply Line (CSL) is a consistent path through the infrastructure CSL focuses resources on only the devices that are critical Managing data flows is similar to traffic routing; an Esri core competency

8 The Cyber Supply Line A vector of devices and network paths Mission Data Flow LAN Bldg Net WAN Cyber Supply Line LAN Bldg Net Campus #1 Campus #2 Cyber Supply Line (CSL) is a consistent path through the infrastructure CSL focuses resources on only the devices that are critical Managing data flows is similar to traffic routing; an Esri core competency

9 Share Situational Awareness Integrating to improve information sharing Executives / Commanders Enterprise - focused Operations Process-focused IT Infrastructure Device-Focused Awareness Recovery Prevention Protection Response Cyber Security Event-focused

10 Rio Olympics Demo Ken Mitchell

11 Enhancing Cyber Common Operating Pictures Geography provides deeper understanding Cyber Comms COP Server w/geoevent Extension Intrusion Detection System IP-Geo Lookup Server Intrusion Data

12 ArcGIS Integration with Cyber Security Tools Executive Dashboards - Status Reports, Trends, Brand Sentiment, Financials Cyber Tools & Data- IDS/IPS, HBSS, Virus Scanning, Patch Monitoring Desktop Web Device Ops Data - Mission Activity, Status Reports, Real-time monitoring Portal Ops Dashboard IT Tools & Databases - IT Inventory, Device Locations, Health and Status Monitoring HR Database - Personnel, Orgs, Locations, Travel Server Online Content and Services Facilities Data - CAD & GIS of Buildings and Campuses, Electric, Water, HVAC, Facilities Monitoring, Physical Security

13 Linking your data to create the necessary relationships Human Resources Database Person Org Location Bill Team 1 2Q001 IT Inventory Database Mission Orgs Personnel Rapid Response Team Team 1 Bill John Team 1 2Q002 Team 1 Person Device Identifier Sue Team 1 2Q003 Team 1 Rick Team 2 Bill 1W003 PC1 00:0a:95:9d:68:16 June Team 2 John 1W004 PC2 00:4d:36:8c:54:08 IT Network Drop Database Eva Team 2 Sue 1W005 PC3Building Room Network Drop (IP) Dan Team 2 Rick 1W006 PC5Q 2Q001 xxx.xxx June PC6Q 2Q002 xxx.xxx Eva PC7Q 2Q003 xxx.xxx Dan PC8W 1W003 xxx.xxx W 1W004 xxx.xxx W 1W005 xxx.xxx W 1W006 xxx.xxx John Sue

14 Data Linkages Mission / Operational activities to Organizations / People Organizations to People People to Their location People to Devices they use Devices to Their location Devices to Their logical network connection Logical Network to Physical Network Logical / Physical Network to Network Devices Cyber Threats to Devices IT Health and Status to Devices Impacted Devices to Impacted Mission

15 Cyber Summary

16 Print Your Certificate of Attendance Print stations located in the 140 Concourse Tuesday 12:30 pm 6:30 pm GIS Solutions Expo Hall B Wednesday 10:30 am 5:15 pm GIS Solutions Expo Hall B 5:00 pm 6:30 pm GIS Solutions Expo Social Hall B 6:30 pm 9:00 pm Networking Reception Smithsonian National Portrait Gallery

17 Download the Esri Events app and find your event Please Take Our Survey in the Esri Events App Select the session you attended Scroll down to find the feedback section Complete answers and select Submit

18