1. Security as Risk Management
If perfect security is not possible, what should be done?
Manage Risk
How to assess risk?
Assess the asset
Probability of successful attack
Estimate losses
Coping with risk
Risk avoidance, compliance, mitigation, acceptance, transfer
All Rights Reserved.
12/27/2018

2. Shift Focus to Risk Management
Perfect security is impossible – focus on managing risk.
Need a systematic way to assess risk
NIST has publications that describe a process for risk assessment
NIST : Guide for Applying the Risk Management Framework to Federal Information Systems
NIST : Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
All Rights Reserved.
12/27/2018

3. Computer Security Triad: Traditional Hexad: Parker 2002
Confidentiality
Access Control
Integrity
Correctness and consistency
Availability
Constancy and timely access
Hexad: Parker 2002
Possession or Control
Leave credit card at a restaurant by mistake
Authenticity
Claim / assignment of authorship: signature on paper
Utility
Lost decryption key would reduce the usefulness of the data
All Rights Reserved.
12/27/2018

4. Cyber Defense Stages Prevention Detection Location Isolation
Information
Sharing
Breach Reporting
Restoration
Firewall
Detect
Prevention
Detection
Location
Isolation
Breach reporting and notification
Forensics
Remediation
Recovery
All Rights Reserved.
12/27/2018

5. NIST Publication
All Rights Reserved.
12/27/2018

6. NIST Framework Core Structure
Framework for Improving Critical Infrastructure Cybersecurity, V1.0, NIST, Feb 2014
All Rights Reserved.
12/27/2018

7. NIST
All Rights Reserved.
12/27/2018

8. NIST (462 pages)
All Rights Reserved.
12/27/2018

9. NIST
All Rights Reserved.
12/27/2018

10. ENISA Threat Landscape 2014
All Rights Reserved.
12/27/2018

11. ENISA Threat Landscape 2014
All Rights Reserved.
12/27/2018

12. Mapping Attacks to Cyber Kill Chain
Stage
Web based Attack
Denial of Service
Malicious Code: Worms, Trojans
Phishing
Insider Threat
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control
Actions on Objectives
ENISA Threat Landscape 2014
All Rights Reserved.
12/27/2018

13. Attack Steps: Get In, Stay In, Act
IPS, IDS, Firewall, DLP, ACL
All Rights Reserved.
12/27/2018

14. Four Generations of Security
4th Generation
Resilience Restoration Recovery
3rd Generation
Intrusion Tolerance Survivability
Situational Awareness
Hardening of OS
2nd Generation
Firewall
IDS
VPN
DLP
Perimeter Defense
1st Generation
Trusted Computing
Access Control List
Cryptography
All Rights Reserved.
12/27/2018

15. Next Gen DevOps Includes Security
DevOps facilitates
experimentation and rapid changes
SCIT reduces the exposure time of the active sprint
Dev
Ops
SCIT Security Layer Controls Exposure Time of Each Sprint
All Rights Reserved.
12/27/2018

16. SCIT Secures DevOps SCIT Constantly Restores Servers To Uncontaminated
State
All Rights Reserved.
12/27/2018