Rules of Thumb to Mathematical Rule- A Cyber Security Journey Bryan Lillie, CTO Cyber QinetiQ

Agenda How did we get here? Today’s state of play SoC Architectures Cyber Security Data Analytics in Cyber AI, Machine Learning and Deep Learning SoC Architectures IDS SIEM Intelligence Led IoT and Industry 4.0 Opportunities for change?

The past….path to the future

Today

Anatomy of an Advanced Cyber Attack Reconnaissance Delivery Exploitation Control Act on intent Egress Find names of employees and set up email accounts in their name Sent a phishing email with a link to a malicious ZIP file sometimes hidden as a pdf Back door opened by link being clicked on by employees. Access through back door, then pass-the-hash or password dumping to escalate privileges Navigate laterally around the network and gather up IP, business contracts, negotiation tactics, internal comms. Extract info from network and share with companies / organisations to get commercial and diplomatic advantage.

Machine learning, AI, Deep learning picture + AV, Anomaly detection, Biological techniques – Attack/Defence Deep Learning Machine Learning Artificial Intelligence Heuristics Pattern Matching Anomaly detection Biological techniques Statistical technique Decision support Automated Attack Engine Data Engineering Data Analytics

Integrated Defences Internet of Evil™ Email Monitor Proxy IDS Firewall Packet Capture Internet of Evil™ Email Monitor Proxy IDS Firewall IPS Web Server Syslog Server NetflowCollector

IoT and Industry 4.0

The Beginning of a journey

Cyber Security Process Forensics Intrusion testing Protective Monitoring Intelligence

Security where next ? Technology Analysis Design Process People

summary Cyber has its roots in Security By Design It has evolved dynamically due to fast moving threat changes Computing power and analytical techniques will allow Machine learning including deep learning Enhanced decision support moving forward Improvements in all aspects of defence including Supply chain management IoT Notes of Caution Attackers can use these techniques Attackers can exploit these techniques

Questions and Discussion Bryan Lillie, CTO Cyber QinetiQ