2 OVERVIEW Cybersecurity initiative launched in July 2015 to create a trusted environment to address Cybersecurity -- Focus on the security needs of operators Phase 1 completed early 2016 Phase 2 underway

3 PHASE 1: Overview Develop Application Tools and Share Standards for Use in Complex Organizations NIST Framework Application Focus on Tools and Processes to enable effective Cybersecurity Risk Management Cybersecurity Risk Mgmt. Toolkit Emerging Threat Analysis Characterize Emerging Threats and Identify Tools to Address Them

PHASE 1: NIST Framework Application Tools 4 PHASE 1: NIST Framework Application Tools Telecom Industry Best Practices and Standards for Framework Core Elements Application in large organizations with complex supply chains Target Profile impacts as movement to SDN, NFV, Cloud Architectures occurs, etc.

PHASE 1: Emerging Threats Analysis 5 PHASE 1: Emerging Threats Analysis SDN/NFV Based Networks/End-User Controlled Networks Back-office and IT infrastructure attacks Specific IoT and M2M Threats

NIST FRAMEWORK RFI: ATIS Response 6 NIST FRAMEWORK RFI: ATIS Response RFI Purpose – NIST seeking comments on: Effectiveness of Version 1 Framework Suggestions for improvement of the Framework Options for longer-term ownership Key points of response include: Current Version 1 Framework is effective for ICT sector; should remain voluntary Standardization of measurements is discouraged -- would discourage ICT companies from enhancing use of the Framework and associated company process specific metrics Encouraged NIST to retain long-term ownership of the Framework Recommended removing profile related elements as their application is highly company specific

CYBERSECURITY PHASE 2 “Architect and Design for Security” toolkit: 7 CYBERSECURITY PHASE 2 “Architect and Design for Security” toolkit: Standards, practices and other recommendations to assist in development of secure solutions include SDN/NFV and Cloud Create an Information Sharing and Analysis Center (ISAC) Forum roadmap for ICT; survey existing ISAC fora relative to coverage of emerging threats

ARCHITECT AND DESIGN FOR SECURITY: Threat Modelling 8 ARCHITECT AND DESIGN FOR SECURITY: Threat Modelling Development processes can wait until the end of the development cycle to address security. Try to test security flaws out. At the end, we see if security requirements are satisfied. With Architectural Risk Analysis applied early in the development cycle, we begin to design security into the product. At the beginning, we intentionally aim for strong security. Did we hit anything? Aiming for the right target

9 COMMUNICATION Balance value of information dissemination with sensitivities Information management processes established Enable broader external publication and use of group’s output with selective protection of sensitive elements. Planning to target portion of Phase 2 work for external publication Maintain trusted and active environment to address cybersecurity