1. Four Generations of Security Devices Putting IDS in Context
Arun Sood
Prof Computer Science
Director International Cyber Center

2. All Rights Reserved - SCIT Labs Confidential and Proprietary
Four Generations of Security Products
4th Generation
Resilience Restoration Recovery
3rd Generation
Intrusion Tolerance Survivability
Situational Awareness
Hardening of OS
2nd Generation
Firewall
IDS
VPN
DLP
Perimeter Defense
1st Generation
Trusted Computing
Access Control List
Cryptography
All Rights Reserved - SCIT Labs Confidential and Proprietary

3. All Rights Reserved - SCIT Labs Confidential and Proprietary
Cyber Threat Observations
Intrusions are inevitable
Intruders stay in systems for days, weeks, months
Current servers are “sitting ducks
SCIT Focus
All Rights Reserved - SCIT Labs Confidential and Proprietary

4. All Rights Reserved - SCIT Labs Confidential and Proprietary
Cyber Kill Chain
Another way to think through the issues, is to look at the Kill Chain. Lockheed Martin CIRT identified the sequential chain of events that are required to successfully complete its targeted mission. The events are divided into 3 broad categories:
Pre-compromise
Compromise
Post-compromise
The prevention and detection systems focus on pre-compromise -
Reconnaissance – Attacker research
Weaponization – Attacker creates malware to fit the situation
Delivery – Launch a phishing or similar attack
In the Compromise stage, the attacker malware exploits the vulnerability and the malware operations are launched.
In the Post Compromise stage, Attacker controls the system and can now make lateral moves to exploit additional systems in the network
As the malware gets embedded in the system the risk increases, potential for damage increase and cost to remediate increases. Hence the goal of SCIT technology is to make the malware ineffective.
All Rights Reserved - SCIT Labs Confidential and Proprietary

5. All Rights Reserved - SCIT Labs Confidential and Proprietary
Integrated Mitigation Framework
GET IN STAY IN ACT
All Rights Reserved - SCIT Labs Confidential and Proprietary

6. Reduce Cost of Security – Increase the Adversary Expense
High
Adversary Cost/expense
Low
Low
High
Level of adversary access/privilege
“Impact”

7. What About Cloud? Public, private and hybrid cloud
Is cloud more secure than data center?
Where is the data located?
What about the cyber security implications?
Build your own cloud
Cloud may get more security with fewer people