Cyberdefense and security policy – concepts and considerations for government policy 1 Cyberdefense and security policy Concepts and considerations for government policy Zoltán Précsényi Government Affairs Manager

Issue statement Cyberdefense and security policy – concepts and considerations for government policy 2

Agenda Cyberdefense and security policy – concepts and considerations for government policy 3 The threat landscape 1 Attack types 2 Cyberdefence, cybersecurity, cyberintelligence 3 Emerging challenges 4 Recommendations 5

Cyberdefense and security policy – concepts and considerations for government policy 4 The Threat Landscape

2010 Trends Cyberdefense and security policy – concepts and considerations for government policy 5 Social Networking + social engineering = compromise Attack Kits get a caffeine boost Targeted Attacks continued to evolve Hide and Seek (zero-day vulnerabilities and rootkits) Mobile Threats increase

2010 in numbers 286M+ threats +93% web-based attacks identities exposed per breach +42% mobile vulnerabilities 6253 new vulnerabilities 14 new zero day vulnerabilities 1M+ bots in Rustock $0.07 to $100 per stolen credit card Cyberdefense and security policy – concepts and considerations for government policy 6

7 Attack types

Sources 8 Organized crime Well meaning insiders Malicious insiders Extremists Cyberdefense and security policy – concepts and considerations for government policy

TargetMethodToolsImpact Infrastructure DDoS (e.g. Estonia)BotnetsService disruption Control compromise (e.g. stuxnet) Specific malware exploiting zero day vulnerabilities, compromised credentials... Infrastructure failure Information Targeted attack Advanced persistent threats, leading to data breach, identity theft, loss of control… Tailored attack Customised malware using attack toolkits, social engineering... Phishing, data theft Botnets, toolkits, social engineering, keystroke loggers... Identity and data breach Targets and methods Cyberdefense and security policy – concepts and considerations for government policy 9 Any combinations of the above are possible. And likely.

Cyberdefense and security policy – concepts and considerations for government policy 10 Cyberdefense Cybersecurity Cyberintelligence

CybersecurityCyberdefense Object:Systems relevant to you……systems relevant to national security. Awareness:Understand threats to your business……and threats to national security. Action:Protect against threats you see……and figure out what you don’t see. Reaction:Block the attack that hits you……and take counter-measures. Resilience:Foresee disaster recovery……but also ensure maximum continuity. In short:Secure your perimeter……and build in-depth security. Focus on:People, processes, technology From cybersecurity to cyberdefense Cyberdefense and security policy – concepts and considerations for government policy 11

Cyberintelligence: What is the Internet used for? Communication: – Propaganda, instructions, information exchange – Diversion / disinformation / psychological operations Cybercrime and related finances: – Turning stolen data and attack capabilities into profits – Laundering money Intelligence – OSINT operations, social engineering Attack – Web-based attacks against information, organisations, infrastructure The Internet can also be used in support of other forms of attack. Cyberdefense and security policy – concepts and considerations for government policy 12

Cyberintelligence: needs and challenges Needs: – Design: Engineering skills – Deploy: Infrastructure for advanced monitoring – Leverage: Strong analytical capabilities, including human intelligence skills Challenges: – Fundamental rights: How intrusive can you be? – Confidentiality, encryption: How effective can you be? – Mass of information: Can you tell the wheat from the chaff? – Attribution: Can you tell who you’re up against? Can you really? Cyberdefense and security policy – concepts and considerations for government policy 13

Symantec™ Global Intelligence Network Identifies more threats, takes action faster & prevents impact Information Protection Preemptive Security Alerts Threat Triggered Actions Global Scope and Scale Worldwide Coverage 24x7 Event Logging Rapid Detection Attack Activity 240,000 sensors 200+ countries Malware Intelligence 133M client, server, gateways monitored Global coverage Vulnerabilities 40,000+ vulnerabilities 14,000 vendors 105,000 technologies Spam/Phishing 5M decoy accounts 8B+ messages/day 1B+ web requests/day Austin, TX Mountain View, CA Culver City, CA San Francisco, CA Taipei, Taiwan Tokyo, Japan Dublin, Ireland Calgary, Alberta Chengdu, China Chennai, India Pune, India 14 Cyberdefense and security policy – concepts and considerations for government policy

15 Emerging challenges

TechnologyStrengthsWeaknesses Cloud Enhanced overall security capabilities: Detection Protection Backup and recovery Blurred individual security perimeter: Loss of control over certain assets Increased interdependencies New single points of failure Virtualisation Flexibility and efficiency: More resilient infrastructure Better use of hardware Enhanced interoperability Segregated tasks run on shared assets: Physical proximity between isolated virtual environments Higher exposure to more vulnerabilities Mobile Well, mobility: Access to data anytime, anywhere Federated identity management Better convergence between different communication channels Well, again, mobility: Lower security awareness and culture Cross-exposure of federated identities to vulnerabilities in one of them Increased risk of data loss through device loss Next generation computing technologies Cyberdefense and security policy – concepts and considerations for government policy 16

Mobile Threats Most malware for mobiles are Trojans posing as legitimate apps Mobiles will be targeted more when used for financial transactions Cyberdefense and security policy – concepts and considerations for government policy vulnerabilities vulnerabilities % increase

Cyberdefense and security policy – concepts and considerations for government policy 18 Recommendations

Cyberdefense and security policy – concepts and considerations for government policy 19 Design security already into the earliest concept. 10 View cybersecurity as a national security stake. Security: in depth, mobile, adjustable, dynamic. Security can no longer go without intelligence. Monitor, correlate data, respond accordingly. Assess actual threat levels, prioritise accordingly. Focus on people, processes and technology. Operationalise public private partnerships in CIIP. Ensure that cybersecurity is adequately resourced. Allocate clear responsibility for cybersecurity

Thank you! SYMANTEC PROPRIETARY/CONFIDENTIAL – INTERNAL USE ONLY Copyright © 2010 Symantec Corporation. All rights reserved. Thank you! Cyberdefense and security policy – concepts and considerations for government policy 20 Zoltán Précsényi