Cyber Maryland 2017: Continuous Innovation and Cyber Incident Response

Transcription

1 Cyber Maryland 2017: Continuous Innovation and Cyber Incident Response Thursday 10/12/17 Michael Misumi, CIO

2 Johns Hopkins University Applied Physics Lab (APL) University Affiliated Research Center Sponsors include DOD, NASA, DHS ~6,500 staff $1.5 B revenue

3 Unclassified Network Internet Public Internal

4 Unclassified Network Korea China Hong Kong Canada Internet Public Internal

5 Unclassified Network Korea China Hong Kong Canada Internet Public SSLVPN Internal

6 Unclassified Network Korea China Hong Kong Canada Internet Public SSLVPN Internal Virtual Machines

7 Unclassified Network Korea China Hong Kong Canada Internet X Public SSLVPN Internal Virtual Machines

8 Unclassified Network Korea China Hong Kong Canada Internet X Public X SSLVPN Internal Virtual Machines

9 Unclassified Network Korea China Hong Kong Canada Internet Public SSLVPN Social Networking Internal Virtual Machines

10 Unclassified Network Korea China Hong Kong Canada Internet Public SSLVPN Internal Virtual Machines

11 Cyber Innovation Single organization Multi-organization collaboration Multi-organization automated response Red Teaming

12

13

14 Coordinating Regional Cyber Response Fusion Cell Cyber Communications Law Enforcement Legal Analysis Cell Cyber Analysts Regional Defensive Teams Team 1 Team 2 Team 3 Team 4 Team 5 Team X

15 Regional Cyber Response: Positive Exercise Outcomes 1. Increasing amount of threat information shared by defensive teams 2. Crowd-sourced intelligence leads to a broad view of adversary tactics 3. Adversaries shut down after first attack due to information sharing 4. Analysts told to pause sharing Intelligence with Defensive Teams because they were too fast 5. Adversaries must bring increasing numbers of staff and infrastructure due to Intelligence-sharing capability

16 Visualize the Battlespace: Galaxy Replay Capability Replay capability helps illustrate sequences of events. Here, a malicious actor finds a vulnerability and spreads through a network.

17 Visualize the Battlespace: Galaxy Main View Filters for major event types, lets the analyst turn off noise Primary view is a node-link graph helping the analyst make sense of heterogeneous event data Interactive selection of the focal time window and playback Zoomable timeline shows all events, provides a sense of scale.

18 Cyber Innovation Single organization Multi-organization collaboration Multi-organization automated response Red Teaming

19 Internet National Element Enterprise 1 Enterprise 2 Enterprise 3 19

20 STIX-formatted indicators published via TAXII Malware C2 Internet National Element Enterprise 1 Enterprise 2 Enterprise 3 20

21 Enterprise 1 analytics say threat meets threshold for auto response. Malware C2 Internet Orchestrator blocks file and IP National Element Enterprise 1 Enterprise 2 Enterprise 3 21

22 Enterprise 2 requires human-in-the-loop Malware C2 Orchestrator generates ticket including enrichment and potential COA impact Internet National Element Enterprise 1 Enterprise 2 Enterprise 3 22

23 IP already banned (site whitelists IPs) Minimal Action Needed Malware C2 Internet National Element Enterprise 1 Enterprise 2 Enterprise 3 23

24 SCENARIO MEASUREMENTS: AT-THE- BOUNDARY TRIGGER File Intercept-to-Comms Generation Send Receipt to Block/Act National Element Enterprise 1 5 sec Fully orchestrated Enterprise Minutes?? Action via Human-in-loop firewalls and app decision Fully time whitelisting orchestrated varies update to epo Enterprise 3 30 sec epo-to-host changes are on 5 minute cycle Integrated Adaptive Cyber Defense AOS CFNR2 24

25 AUTOMATED CYBER DEFENSE (IACD) INTEGRATIONS

26 Cyber Innovation Single organization Multi-organization collaboration Multi-organization automated response Red Teaming

27 Everyone Owning the Outcome Defense Monitors Offense

28

29

30 Space Exploration New Horizons Continues to Deliver Great Science New Horizons continues to deliver amazing scientific discoveries

31 Leveraging Synergy at JHUAPL Mission Systems Corporate Cyber Cyber Research

32