Panel Discussion Can We Handle an Advanced Cyber Threat? Roy Wilson, CISSP, CEH, SEC+ Professor of Acquisition Cybersecurity Defense Acquisition University Mid-Atlantic Region roy.wilson@dau.mil

Can We Handle an Advanced Cyber Threat? Break the question down “Handle” “Advanced” Handle Systems are designed to prevent, mitigate and recover from cyber-attacks. Adversary Threat Tier (ATT) Advanced – ATT 4, Complex, long-term cyber-attack Moderate – ATT 3, Use customized malware Limited – ATT 2, Attack easily accessible unencrypted networks Nascent – ATT 1, Little-to-no organized cyber Students should be able to understand: the difference between threat, risk, attack and vulnerability how threats materialize into attacks where to find information about threats, vulnerabilities and attacks typical threats, attacks and exploits and the motivations behind them high-level understanding of how example attacks work (e.g. DDOS, phishing and buffer overflow) how users are targeted in an attack and why this must be considered in defending against such attacks the concept of a threat landscape, its dynamic nature and how to create a landscape for an organization how to classify threats and example categories that there are different attacks, which have different patterns and different steps – for example be able to compare a DDOS to an attack designed to copy information how to classify threats and example categories that there are different types of malware – for example viruses, Trojans and spyware – their distribution mechanism and a detailed understanding of how they compromise information and systems that attacks can be combined for greater effect (e.g. phishing email, followed by social engineering phone call) Can We Survive in a Cyber Contested Environment? Source – JCS Cyber Survivability Endorsement Implementation Guide, Rev 1.01a

Can We survive in a cyber contested environment? System Survivability KPP SS KPP = Kinetic, EW & Cyber Cyber Survivability Pillars Prevent – design principles that protect system’s mission functions from most likely cyber threats Mitigate – design principles to detect and respond to cyber- attacks; enable the mission system to survive attacks and complete the mission Recover – design principles to enable recovery from cyber- attacks and prepare mission systems for the next fight Students should be able to understand: the difference between threat, risk, attack and vulnerability how threats materialize into attacks where to find information about threats, vulnerabilities and attacks typical threats, attacks and exploits and the motivations behind them high-level understanding of how example attacks work (e.g. DDOS, phishing and buffer overflow) how users are targeted in an attack and why this must be considered in defending against such attacks the concept of a threat landscape, its dynamic nature and how to create a landscape for an organization how to classify threats and example categories that there are different attacks, which have different patterns and different steps – for example be able to compare a DDOS to an attack designed to copy information how to classify threats and example categories that there are different types of malware – for example viruses, Trojans and spyware – their distribution mechanism and a detailed understanding of how they compromise information and systems that attacks can be combined for greater effect (e.g. phishing email, followed by social engineering phone call) Source – JCS Cyber Survivability Endorsement Implementation Guide, Rev 1.01a

The Panel CAPT Dave Glennister Mr. Bryan Lopez Dr. Marv Langston Students should be able to understand: the difference between threat, risk, attack and vulnerability how threats materialize into attacks where to find information about threats, vulnerabilities and attacks typical threats, attacks and exploits and the motivations behind them high-level understanding of how example attacks work (e.g. DDOS, phishing and buffer overflow) how users are targeted in an attack and why this must be considered in defending against such attacks the concept of a threat landscape, its dynamic nature and how to create a landscape for an organization how to classify threats and example categories that there are different attacks, which have different patterns and different steps – for example be able to compare a DDOS to an attack designed to copy information how to classify threats and example categories that there are different types of malware – for example viruses, Trojans and spyware – their distribution mechanism and a detailed understanding of how they compromise information and systems that attacks can be combined for greater effect (e.g. phishing email, followed by social engineering phone call) Dr. Marv Langston Mr. Peter Bybee