Cyber Security Trends and Challenges

Slides:

Advertisements

Similar presentations

Authentication: the problem that will not go away Prof. Ravi Sandhu Chief Scientist Protecting Online Identity.

Advertisements

1 Trust Evidence in Heterogeneous Environments: Towards a Research Agenda Ravi Sandhu Executive Director and Endowed Professor May 2010

INSTITUTE FOR CYBER SECURITY 1 Application-Centric Security: How to Get There Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber.

1 Trust Evidence in Heterogeneous Environments: Towards a Research Agenda Ravi Sandhu Executive Director and Endowed Professor May 2010

Institute for Cyber Security (ICS) Prof. Ravi Sandhu Executive Director and Lutcher Brown Endowed Chair

Sandhus Laws of Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security University of Texas at San Antonio Chief.

1 The Challenge of Data and Application Security and Privacy (DASPY): Are We Up to It? Ravi Sandhu Executive Director and Endowed Professor February 21,

Institute for Cyber Security ASCAA Principles for Next- Generation Role-Based Access Control Ravi Sandhu Executive Director & Endowed Professor Institute.

1 Laws of Cyber Security Ravi Sandhu Executive Director and Endowed Professor September 2010

1 New Trends and Challenges in Computer Network Security Ravi Sandhu Executive Director and Endowed Professor September 2010

© Ravi Sandhu Introduction to Information Security Ravi Sandhu.

1 Cyber Security Research: A Personal Perspective Prof. Ravi Sandhu Executive Director and Endowed Chair January 18, 2013

1 The Challenge of Data and Application Security and Privacy (DASPY): Are We Up to It? Ravi Sandhu Executive Director and Endowed Professor February 21,

1 Grand Challenges in Data Usage Control Prof. Ravi Sandhu Executive Director and Endowed Chair

1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.

Future of Access Control: Attributes, Automation, Adaptation

1 Security and Trust Convergence: Attributes, Relations and Provenance Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown.

1 Plenary Panel on Cloud Security and Privacy: What is new and What needs to be done? Ravi Sandhu Executive Director and Endowed Professor December 2010.

INSTITUTE FOR CYBER SECURITY 1 Cyber Security: Past, Present and Future Prof. Ravi Sandhu Executive Director and Endowed Chair Institute for Cyber Security.

1 Institute for Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Chair February 4, 2015

1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.

1 Challenges of Cyber Security Education at the Graduate Level Ravi Sandhu Executive Director and Endowed Professor Nov. 9, 2012

1 Big Data Applications in Cloud and Cyber Security Prof. Ravi Sandhu Executive Director and Endowed Professor UTSA COB Symposium on Big Data, Big Challenges.

1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair.

1 Cloud Computing and Security Prof. Ravi Sandhu Executive Director and Endowed Chair April 19, © Ravi Sandhu.

1 Attribute-Based Access Control Models and Beyond Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber.

1 Panel on Data Usage Management: Technology or Regulation? Prof. Ravi Sandhu Executive Director and Endowed Chair DUMA 2013 May 23, 2013

1 Cyber Security A Personal Perspective Prof. Ravi Sandhu Executive Director and Endowed Chair January 15, 2016

1 Security and Privacy in Human-Centric Computing and Big Data Management Prof. Ravi Sandhu Executive Director and Endowed Chair CODASPY 2013 February.

1 Open Discussion PSOSM 2012 Prof. Ravi Sandhu Executive Director and Endowed Chair © Ravi Sandhu.

1 Challenges of Cyber Security Education at the Graduate Level Ravi Sandhu Executive Director and Endowed Professor July 27, 2011

1 Understanding Which New Threats Operators Can Expect To Face Within The Next Two To Five Years To Improve The On- Going Management Of Security Systems.

1 Secure Cloud Computing: A Research Perspective Prof. Ravi Sandhu Executive Director and Endowed Chair Texas Fresh Air Big Data and Data Analytics Conference.

INSTITUTE FOR CYBER SECURITY 1 Purpose-Centric Secure Information Sharing Ravi Sandhu Executive Director and Endowed Professor Institute for Cyber Security.

Executive Director and Endowed Chair

What can Technologists learn from the History of the Internet?

Security and Privacy in the Networked World

An Access Control Perspective on the Science of Security

Institute for Cyber Security (ICS) & Center for Security and Privacy Enhanced Cloud Computing (C-SPECC) Ravi Sandhu Executive Director Professor of.

UTSA's New Center Center for Security and Privacy Enhanced Cloud Computing (C-SPECC) Ravi Sandhu Executive Director of ICS and C-SPECC Professor.

Introduction to Cyber Security

Introduction and Basic Concepts

Institute for Cyber Security: Research Vision

Attribute-Based Access Control: Insights and Challenges

Protecting Online Identity™

Cyber Security Research: Applied and Basic Combined*

On the Value of Access Control Models

Challenge-Response Authentication

Cyber Security Research: Applied and Basic Combined*

Institute for Cyber Security: Research Vision

Security and Privacy in the Age of the Internet of Things:

Intersection of Data, Policy and Privacy

UTSA Cyber Security Ecosystem

Attribute-Based Access Control: Insights and Challenges

Cyber Security and Privacy: An Optimist’s Perspective

Big Data and Privacy Panel Prof. Ravi Sandhu

Executive Director and Endowed Chair

World-Leading Research with Real-World Impact!

World-Leading Research with Real-World Impact!

Institute for Cyber Security Overview

Challenge-Response Authentication

ASCAA Principles for Next-Generation Role-Based Access Control

Institute for Cyber Security

Cyber Security Research: A Personal Perspective

Cyber Security Research: Applied and Basic Combined*

World-Leading Research with Real-World Impact!

Access Control Evolution and Prospects

Cyber Security R&D: A Personal Perspective

World-Leading Research with Real-World Impact!

Access Control Evolution and Prospects

Presentation transcript:

Cyber Security Trends and Challenges Ravi Sandhu Executive Director Professor of Computer Science Lutcher Brown Chair in Cyber Security Financial Executives International San Antonio Chapter March 19, 2019 ravi.sandhu@utsa.edu www.profsandhu.com www.ics.utsa.edu © Ravi Sandhu World-Leading Research with Real-World Impact!

ICS Mission and History Sustained excellence in leading edge research 2012-2017 Graduated to a self-sustaining operation 2007-2012 Founded by start-up funding from State of Texas 2017-2022 Major expansion by winning NSF C-SPECC grant In collaboration with: College of Engineering College of Business College of Education Open Cloud Institute Cyber Center for Security & Analytics National Security Collaboration Center Partnership with 4 NISD High Schools: Harlan, Woodson, Taft, Business Careers Established world class laboratories for: Secure cloud computing & Malware research © Ravi Sandhu World-Leading Research with Real-World Impact!

Cyber Security Perspective © Ravi Sandhu World-Leading Research with Real-World Impact!

Cyber Security in a Nutshell “My dear, here we must run as fast as we can, just to stay in place. And if you wish to go anywhere you must run twice as fast as that.” ― Lewis Carroll, Alice in Wonderland © Ravi Sandhu World-Leading Research with Real-World Impact!

Cyber Security in a Nutshell “My dear, here we must run as fast as we can, just to stay in place. And if you wish to go anywhere you must run twice as fast as that.” ― Lewis Carroll, Alice in Wonderland © Ravi Sandhu World-Leading Research with Real-World Impact!

Natural vs Cyber Science Elephant Problem Cyber-Elephant Problem Applied vs Foundational Science: Cyber-elephants require applied and foundational combined Present vs Future Focus: Rapidly evolving cyber-elephants require future focus © Ravi Sandhu World-Leading Research with Real-World Impact!

World-Leading Research with Real-World Impact! Success Stories The ATM (Automatic Teller Machine) system is secure enough global in scope US President’s nuclear football © Ravi Sandhu World-Leading Research with Real-World Impact!

World-Leading Research with Real-World Impact! Security Objectives INTEGRITY modification AVAILABILITY access CONFIDENTIALITY disclosure © Ravi Sandhu World-Leading Research with Real-World Impact!

Covers privacy and intellectual property protection Security Objectives USAGE purpose Covers privacy and intellectual property protection INTEGRITY modification AVAILABILITY access CONFIDENTIALITY disclosure © Ravi Sandhu World-Leading Research with Real-World Impact!

World-Leading Research with Real-World Impact! What can Security Technologists learn from the History of the Internet? © Ravi Sandhu World-Leading Research with Real-World Impact!

World-Leading Research with Real-World Impact! Internet Protocols TCP RFC 793 Sept. 1981 IPv4 RFC 791 Sept. 1981 © Ravi Sandhu World-Leading Research with Real-World Impact!

The TCP/IP Lesson Agility = Good enough for now + Agility trumps perfection Not quite the same as Good enough trumps perfect Agility = Good enough for now + Future-proof for uncertain future © Ravi Sandhu World-Leading Research with Real-World Impact!

World-Leading Research with Real-World Impact! IP Spoofing Story ALLOW GOOD GUYS IN KEEP BAD GUYS OUT IP Spoofing predicted in Bell Labs report ≈ 1985 Unencrypted Telnet with passwords in clear 1st Generation firewalls deployed ≈ 1992 IP Spoofing attacks proliferate in the wild ≈ 1993 Virtual Private Networks emerge ≈ late 1990’s Vulnerability shifts to the client PC Network Admission Control ≈ 2000’s Persists as a Distributed Denial of Service mechanism Most of these fixes have not changed or extended IPv4 © Ravi Sandhu World-Leading Research with Real-World Impact!

Laws and Principles of Cyber Security © Ravi Sandhu World-Leading Research with Real-World Impact!

World-Leading Research with Real-World Impact! Laws of Attackers Attackers exist You will be attacked Attackers have sharply escalating incentive Money, terrorism, war, espionage, sabotage, … Attackers are lazy (follow path of least resistance) Attacks will escalate BUT no faster than necessary Attackers are innovative (and stealthy) Eventually all feasible attacks will manifest Attackers are copycats Known attacks will proliferate widely Attackers have asymmetrical advantage Need one point of failure © Ravi Sandhu World-Leading Research with Real-World Impact!

Beware of “silver bullets” Principles of Defense Prepare for tomorrow’s attacks, not just yesterday’s Good defenders strive to stay ahead of the curve, bad defenders forever lag Take care of tomorrow’s attacks before next year’s attacks Researchers will and should pursue defense against attacks that will manifest far in the future BUT these solutions will deploy only as attacks catch up Use future-proof barriers Defenders need a roadmap and need to make adjustments It’s all about trade-offs Security, Convenience, Cost Beware of “silver bullets” © Ravi Sandhu World-Leading Research with Real-World Impact!