Cyber Security and the National Broadband Strategy John C. Nagengast nagengast@att.com

What is Cyber Security? For AT&T, cyber security is the collective set of capabilities, procedures, and practices that protect our customers and the services we provide them from the full spectrum of cyber threats. Cyber Security assures the information, applications, and services our customers want are secure, accurate, reliable, and available wherever and whenever they are desired.

Increasingly difficult for systems administrators What we see every day! COTS Software with Bugs and Vulnerabilities Insecure “out-of-the-box” configurations Increasing speed of Zero-day Attacks Relentless stream of patches from Vendors Complexity, Complexity, Complexity Increasingly difficult for systems administrators and users to manage complex security solutions against ever more sophisticated attacks

“What You Expect as Normal” “What you Actually See” How AT&T Identifies Cyber Threats Correlation Across Network, Servers & Applications 2842 17 20 5 2 8 Security Analysis (Profile/Anomaly Based) Real-Time Alerts & Alarms with Severity & Likely Source Profiling Engine “What You Expect as Normal” Normalized Database of Alerts Monitoring Engine “What you Actually See” AT&T Security Professionals Correlation Engine

Security Event & Threat Analysis Portal

Our Cyber Security Tool Set – BotNet Tracking Conficker Worm April 01, 2009 This graphic shows the deliberate efforts of botnet operators to create a resilient botnet. In particular, note the yellow dots that represent control points: 2 on US west coast 2 on US east coast 2 in Europe 2 in Asia In order to disable this botnet, all of these controllers would need to be stopped nearly simultaneously. But these will be located in a variety legal jurisdictions and hosted within a variety of network service providers. Cooperation between all of the entities is very unlikely; particularly if the botnet remains relatively stealth and unknown. This one (for example) is basically unknown relative to Conficker. 15,136 visible members, 8 control servers, tracked since 7/2006 Page 6 6 6 6

Some Basic Principles – Broadband Strategy & Cyber Security Expand Security Education and Awareness Fulfill Market Needs & Demand for Cyber Security Spur Innovation and Investment Leverage Core Network Intelligence to Optimize Broadband’s Security, Reliability and Efficiency Make Managed Security an integral part of Broadband Services Simplify User Experience and Increase Security