Michael Oehler

This is Hard We are an equal opportunity intrusion detector. –Alerts occur irrespective of the mission impact. We are still incident focused –We respond to today’s worm, virus, botNet And not on the (big) structured threat.

This is Easy (Well, these are hard too) Extrapolate security into Real Time Systems –Absolutely necessary but not sufficient for the criticality of these systems. Security Services (CIA, APAIN, ICAA, …) –and the Classical/corresponding security matrix –Availability and Integrity Defense in Depth Protect, Detect, Respond, & Restore People, Processes, & Technology 8 Disciplines of Information Assurance Continued…

Security Domains for RT Sys System Evaluation, accreditation, and certification Vulnerability Assessments: –Risk = Threat  Vulnerability  Value - Counter Measures Battle Damage Assessments Recovery, restoration, Continuity Operations Code Validation, Security Engineering, formal methods, security fault analysis Physical Security for PCS and SCADA Emanation and caustic resilience Communications Security and secure management Attack sensing and warning, IDS, IPS Fault tolerance and graceful failures Interconnectivity policies & Interdependency models

The end Classical Security Quotations “There is no security through obscurity.” Myth: ostriches do not bury their heads in the sand! If I own your machine and you patch it, I still own your machine. –Corollary: A popped box patched is popped Hard and crunchy on the outside soft and chewy on the inside. –Don’t let this be the design philosophy driving your design. – Defense in Depth! “Security is a process, not a product.” –Bruce Schneier