Integration Community of Interest Kickoff Harley Parkes and Brett Waldman, JHU/APL

Agenda When We First Met Why an Integrator’s COI Purpose Objectives Value COI Value Discussion

IACD: Support to Operational Adoption Experimentation & Prototyping “Prove it Works” Pilots & Deployments “Prove it Scales” Interoperability Specifications & Adoption Support “Make It Work For Vendors” Shareable Playbooks & Implementation Guides “Make It Work For Defenders” So how are we going to help change that culture? By influencing the greater cybersecurity community. We are building and leading the IACD community by using this influence process to ensure solutions stick. We start with lab experiments and prototypes to prove out concepts for hard problems and to broadly demonstrate the art of the possible. As we share our results out to the community, we work with select forward-leaning organizations to deploy a pilot in their security operations. The lessons learned from there inform our interoperability specifications and adoption support, and lead into shareable cyber defense “playbooks” and implementation guides. Our mission is to ensure all of our lessons learned throughout this process are shared as broadly as possible: to help advance the state of the art. Let’s take a quick look at two of our recent examples at different points in this process.

Prior Discussion: Community Day - March 2017 What would help you create, market, and implement IACD solutions? What is needed to facilitate customer adoption of IACD solutions? What would help you remove barriers to adoption? What would help you market IACD integration investments to existing customers? How can we help meet these needs as a community?

Why an IntCOI Purpose: To advance the “adoption” of IACD concepts across a broad range of customer operational environments. Scalability Sustainability

Objectives Demonstrate the effectiveness of Security Automation, Orchestration and Information Sharing with Integrators Expand IACD competencies and solution reach to meet growing demand. Understand needs of the integration community. Understand unique challenges/aspects of various sectors or environments. Capture best practices for playbooks to improve cyber operations. Share and capture measures & metrics for IACD ROI/TCO. Expand IACD solution research. Needs Challenges Experimentation What outputs do we need to resonate with the *** sector?

What do Integrators get out of COI? Opportunity to connect with parties looking to engage industry for assistance deploying IACD strategies Access to IACD innovations available to use in business pursuits Opportunity to collaborate on technical challenges or solutions addressing gaps inhibiting IACD adoption or effectiveness Access to a community of security practitioners, solution providers & industry partners determined to demonstrate the value and opportunities to advance IACD Opportunity to influence acquisition priorities and highlight differentiators with communities interested in evaluating or demonstrating the value for SA&O and Information Sharing. Influence over new or evolving specifications/documentation: Playbooks Automation Readiness Assessments IACD Value Proposition White Paper Anonymized metrics & lessons learned Broader adopter education Outputs Integrators Adoptors How is this output used? How can it be improved? What are others doing? Who wants to engage?

Keys to Success Collaboration (by all participants) Investment (time & resources) Innovation (across the community) Value (to all participants)

COI Value Discussion Do you see value for your organization in being part of an Integrator’s COI? If so, what is the value proposition for you? What would your organization be willing to contribute to the COI? What would you NOT be willing to share due to the need for market differentiation, etc.? What products, output, collaborations would help you implement and sustain IACD solutions? How can we help meet these needs as a community?

COI Value Discussion What unique challenges/aspects do you see with the COI concept? How do we measure/assess the value of the COI to participating organizations? How can we encourage others to join?

Schedule/Tempo Initial kickoff meeting (16 October 2017) Quarterly virtual meetings initially Adjust tempo based on need Face-to-face meetings in conjunction with Integrated Cyber

Questions/Final Thoughts?