Four Generations of Security Devices Putting IDS in Context Arun Sood Prof Computer Science Director International Cyber Center

All Rights Reserved - SCIT Labs Confidential and Proprietary Four Generations of Security Products 4th Generation Resilience Restoration Recovery 3rd Generation Intrusion Tolerance Survivability Situational Awareness Hardening of OS 2nd Generation Firewall IDS VPN DLP Perimeter Defense 1st Generation Trusted Computing Access Control List Cryptography All Rights Reserved - SCIT Labs Confidential and Proprietary

All Rights Reserved - SCIT Labs Confidential and Proprietary Cyber Threat Observations Intrusions are inevitable Intruders stay in systems for days, weeks, months Current servers are “sitting ducks SCIT Focus All Rights Reserved - SCIT Labs Confidential and Proprietary

All Rights Reserved - SCIT Labs Confidential and Proprietary Cyber Kill Chain Another way to think through the issues, is to look at the Kill Chain. Lockheed Martin CIRT identified the sequential chain of events that are required to successfully complete its targeted mission. The events are divided into 3 broad categories: Pre-compromise Compromise Post-compromise The prevention and detection systems focus on pre-compromise - Reconnaissance – Attacker research Weaponization – Attacker creates malware to fit the situation Delivery – Launch a phishing or similar attack In the Compromise stage, the attacker malware exploits the vulnerability and the malware operations are launched. In the Post Compromise stage, Attacker controls the system and can now make lateral moves to exploit additional systems in the network As the malware gets embedded in the system the risk increases, potential for damage increase and cost to remediate increases. Hence the goal of SCIT technology is to make the malware ineffective. All Rights Reserved - SCIT Labs Confidential and Proprietary

All Rights Reserved - SCIT Labs Confidential and Proprietary Integrated Mitigation Framework GET IN STAY IN ACT All Rights Reserved - SCIT Labs Confidential and Proprietary

Reduce Cost of Security – Increase the Adversary Expense High Adversary Cost/expense Low Low High Level of adversary access/privilege “Impact”

What About Cloud? Public, private and hybrid cloud Is cloud more secure than data center? Where is the data located? What about the cyber security implications? Build your own cloud Cloud may get more security with fewer people