1. From “Groundhog Day” to “Independence Day”
Scripting your Cyberdefense Movie
Tony Sager
Senior VP & Chief Evangelist
June 2017

2. Seismic Shifts Communications Security  “Cyber”
Technology  Information, Operations
Government monopoly  user/market driven
“Control Model” of security  Risk model
National Security  economic/social Risk

3. A Few Cybersecurity Lessons
Integrated Action: Knowing about vulnerabilities doesn’t get them fixed
Integrated Purpose: The Bad Guy doesn’t perform magic
Integrated Capability: There’s a large but limited number of defensive choices
Integrated Understanding: Cybersecurity => Information Management
Cybersecurity is more like Groundhog Day than Independence Day TS

4. A Cyberdefense OODA Loop
(“patch Tuesday”)
OBSERVE
Track security bulletins, advisories
ORIENT
Assess applicability, operational issues, risk
DECIDE
Prioritize remediation
ACT
Rollout, Monitor, Manage “breakage”
A classic military way to think of the dynamic nature of Defense. Origins in airplane dogfights.
Every step is about gathering, make sense of information, taking action, the repeat.
Here’s the Loop we live every month.
Guess who else lives in this loop?

5. (and the role of Threat Intelligence, Analytics)
“Dueling OODAs”
(and the role of Threat Intelligence, Analytics)
There are many loops, often connected
“farther in space, earlier in time”
The Bad Guy’s loop is an opportunity
OBSERVE
ORIENT
DECIDE
ACT
OBSERVE
ORIENT
DECIDE
ACT
OBSERVE
ORIENT
DECIDE
ACT
OBSERVE
ORIENT
DECIDE
ACT
OBSERVE
ORIENT
DECIDE
ACT
But there’s a lot going on. You can improve patching, but the Bad Guy has inherent advantages. And he doesn't’t much care about irritating your users. Regression testing.
SO the key is to think about either degrading the Bad Guy’s information loop; or about moving the fight to a loop where you have better advantage.
No details here, but think of things like Lockheed-Martin Kill Chain, MITRE ATT&ACK Model, Mandiant APT1, etc. all as attempts to get a handle on this thinking. O D A

6. An Effective Cyberdefense “info machine” should be…
based on a model of Attacks, Attackers, and defensive choices
and focused on categories, types, patterns, templates, etc.
driven by data
managed within an open, standards-based framework
account for “community risk”, but be tailorable
repeatable, dynamic, feedback-driven
demonstrable, negotiable for Real People

7. Groundhog’s Day Moments
January 2008
Comprehensive National Cybersecurity Initiative (CNCI)
March 2011
Enabling Distributed Security in Cyberspace: Building a Healthy and Resilient Cyber Ecosystem with Automated Collective Action
February 2014
The Fog of More: A Cyber Security Community Challenge
Today
Integrated Cyber – These same ideas applied in today’s cyber environment

8. The CIS Community Attack Model Process
Basis for mapping from multiple Attack Summaries
What are the problems we all face?
Support the evolution of CIS Critical Security Controls
Establishes the foundation, allows for tailoring
An effective baseline for use of Threat Intelligence
Consistent and open mapping to Defensive Action
Able to work with “closed systems” (e.g, classified data)
Operate an ongoing refresh cycle
is the model still good? Priority within the model?

9. CIS Security Best Practice Automation Workflow

10. The CIS Critical Security ControlsRR

11. Website: www.cisecurity.org
Twitter: @CISecurity
Facebook: Center for Internet Security
LinkedIn Groups:
Center for Internet Security
20 Critical Security Controls