DISA Global Operations Cyber Defense Program Overview Sandy J. Radesky Deputy, Future Plans and Programs Division/Lead Cyber Strategist DISA Global Operations Command 10 Jan 2017

Me… In a Nutshell

DOD’s Cyber Focus Department of Defense Priority Cyber Missions: Defend DOD Networks, Systems and Information Defend US Homeland and US National Interests against Cyberattacks Provide Cyber Support to Military Operational and Contingency Plans Expand Cyber Mission Forces: 133 Teams by 2018 Snippets from DOD’s Cyber Strategy: Build technical capabilities for Cyber Operations Build the Joint Information Environment (JIE) Single Security Architecture Improve Computer Network Defense Service Provider (CNDSP) References: http://www.defense.gov/News/Special-Reports/0415_Cyber-Strategy http://www.defense.gov/Portals/1/features/2015/0415_cyber-strategy/Final_2015_DoD_CYBER_STRATEGY_for_web.pdf

DISA’s Cyber Focus “We will bring the business of defensive cyberspace operations support for the DoD under one roof — Our Roof…”  “DODIN” “…Eliminating Department duplication of effort, capitalizing on the range of commercial cloud solutions, and maintaining the operational cyberspace integrity of the DODIN services we defend, operate, and assure” “Authorized, authenticated user access and freedom of maneuver to cloud, collaboration, and command and control capabilities; without impact from rogue entities, hacktivists, nation states, or insider threats” Deploy & Operationalize Joint Regional Security Stacks Enhance mobility & collaboration efforts Superior delivery of capability to mission partners/warfighter Reference: http://www.disa.mil/~/media/files/disa/about/strategic-plan.pdf

Scope… DISA’s Cyber Defense Environment

C2 How? ... By Integrating Missions & Unity of Effort Positive CM/CC enabling NA and MA How? ... By Integrating Missions & Unity of Effort INTEL Engineering Defense Operations C2 Capability Delivery Problem/Configuration Management (Implement, Configure, Secure, Sustain & Maintain) Provide engineering/trend analysis, modeling, performance, QA, IT&A, change and problem mgt for DODIN Ops Defensive Cyber Ops Real Time Analysts and Countermeasures (Passive and Active Defense, Detect, Analyze, Mitigate, Hunting, Countermeasures) Triage analytics and Incident Response across the DODIN Perimeters DODIN Ops Incident Management (Operate, Maintain, Secure, Mission Assure) Synchronization of NetOps through Incident Management Mission Assurance Network Assurance Integrated / Mission Focused / Threat Specific / Responsive

High Fidelity Analytics Analytics: Going Back to the Basics What Do We Know? Who’s Who ? What’s What ? It’s that bad! Content Development Correlation Enrich Threat Data Intelligence Increase Cyber SA High Fidelity Analytics Countermeasures Cyber Fusion Real Time Analysis Let’s Make Sure…. Now Let’s Manage This!

Analytic Values Accuracy Drives Value Analytics Values Triage Content specific Correlation rules Pipeline, IP Sets, Behaviors Network Profiling HBEs, DDoS Dark Space BotNets / Malware Specific Spearphising /Email Campaigns End-point Behaviors  Mobility Specific Values Intelligence Incident Reports Profiling Metrics Countermeasures Collaboration Products Indicator Trends Knowledge Gained Triage Specific Environments or Missions Discovery Accuracy Drives Value

Understand the Value of Context & Integrate! Data & More Data… What goes where and why? Base it on the threat vectors and networks Base it on workflow and Community of Interest Base it on fidelity Base it on periodicity What else? SIEM Big Data SiLK Understand the Value of Context & Integrate!

Case Study 1: Port Abuse

Case Study 1: Port Abuse Know your network Build continuous checks -> pipeline & correlation Don’t dismiss blocked traffic SSL/TLS traffic (>2.4gb) and HTTP traffic (>38mb) excluded for clarity

Traffic of Interest, before/after Countermeasures Introduced Case Study 2: Blocking Effectiveness Accuracy was achievable… NOT fun Metrics are IMPORTANT… Evolve with strategies as they evolve! Traffic of Interest, before/after Countermeasures Introduced Absolute Change: Considerable Required blocking effectiveness: 99.9% Measured: 98.4%

…So What? Knowing your infrastructure helps to identify the gaps Remove the noise & carve out “discovery” opportunities Outcomes: Significant improvement of policy enforcement; validate what is happening is “by design” or NOT! Leverage indicators as reconnaissance information Create a manageable capability with automation Prove value through real metrics – show your work!

In Closing… And… Thank you! Be agile and listen to the “analysts” Drive integration at all levels – knowing the “context” is a game changer  Big Data + Cyber Collaboration: Ability to work between Industry, Academia and Government