1. 1 The Science, Engineering, and Business of Cyber Security Prof. Ravi Sandhu Executive Director, Institute for Cyber Security Lutcher Brown Endowed Chair in Cyber Security University of Texas at San Antonio ACM CCS Keynote November 6, 2013 ravi.sandhu@utsa.edu, www.profsandhu.com, www.ics.utsa.edu © Ravi Sandhu World-Leading Research with Real-World Impact! Institute for Cyber Security

2. © Ravi Sandhu 2 World-Leading Research with Real-World Impact! Cyber Security Status MicroSecurity  Not too bad  About as good as it is going to get  Criminals can only defraud so many  Big government/big business are real threats MacroSecurity  New arena for researchers  Highly asymmetric, includes offense, clandestine  Dual goals: strong offense, strong defense  Cyber should be controllable Nuclear, chemical, biological have been “controlled”

3.  ≈ 2010 US Department of Defense epiphanies  A new domain akin to land, sea, air and space  Have and use offensive cyber weapons  Malware penetrations in highly classified networks  Consumerization of cyberspace  Anytime, Anywhere, Anything  BYOD: Bring your own device  BYOC: Bring your own cyberspace?  Entanglement of cyber-physical-social space  Just starting © Ravi Sandhu 3 World-Leading Research with Real-World Impact! 21 st Century Cyberspace

4.  Enable system designers and operators to say: This system is secure  There is an infinite supply of low-hanging attacks © Ravi Sandhu 4 World-Leading Research with Real-World Impact! Cyber Security Goal Not attainable

5.  Enable system designers and operators to say: This system is secure  There is an infinite supply of low-hanging attacks  Alternate goal: This system is as secure as possible More secure is always better © Ravi Sandhu 5 World-Leading Research with Real-World Impact! Cyber Security Goal Not attainable Not appropriate

6.  Enable system designers and operators to say: This system is secure “enough”  Mass scale, rather low assurance  ATM network, On-line banking, E-commerce  One of a kind, extremely high assurance  US President’s nuclear football © Ravi Sandhu 6 World-Leading Research with Real-World Impact! Cyber Security Goal Many successful examples

7.  Enable system designers and operators to say: This system is secure “enough”  Mass scale, rather low assurance  ATM network, On-line banking, E-commerce  One of a kind, extremely high assurance  US President’s nuclear football © Ravi Sandhu 7 World-Leading Research with Real-World Impact! Cyber Security Goal Many successful examples Science EngineeringBusiness

8. © Ravi Sandhu 8 World-Leading Research with Real-World Impact! Cyber Security Ecosystem Science EngineeringBusiness Distinguishing Characteristics of Cyber/Cyber Security  Cyberspace is an entirely man-made domain  Evolves rapidly and unpredictably  Validation primarily with respect to future systems Science explains the cause of observed phenomenon

9. © Ravi Sandhu 9 World-Leading Research with Real-World Impact! Cyber Security Ecosystem Science EngineeringBusiness Distinguishing Characteristics of Cyber/Cyber Security  Cyberspace is an entirely man-made domain  Evolves rapidly and unpredictably  Validation primarily with respect to future systems Science explains the cause of observed phenomenon and enables better construction of future systems

10. © Ravi Sandhu 10 World-Leading Research with Real-World Impact! Scientific Method: Natural Sciences Hypothesis Prediction Experimentation Prediction Confirmed Prediction Falsified Hypothesis → Law Reject Hypothesis

11. © Ravi Sandhu 11 World-Leading Research with Real-World Impact! Scientific Method: Natural Sciences Hypothesis Prediction Experimentation Prediction Confirmed Prediction Falsified Hypothesis → Law Reject Hypothesis Principles

12. © Ravi Sandhu 12 World-Leading Research with Real-World Impact! Heliocentric versus Geocentric

13. © Ravi Sandhu 13 World-Leading Research with Real-World Impact! Epicycles

14. © Ravi Sandhu 14 World-Leading Research with Real-World Impact! Circles versus Ellipses

15. © Ravi Sandhu 15 World-Leading Research with Real-World Impact! Scientific Method: Cyber Sciences Hypothesis Prediction Experimentation Prediction Confirmed Prediction Falsified Hypothesis → Law Reject Hypothesis Science explains the cause of observed phenomenon and enables better construction of future systems Principles

16. © Ravi Sandhu 16 World-Leading Research with Real-World Impact! Science Quadrants Fundamental Understanding LH H L Utility EdisonPasteur Bohrjunk Donald Stokes, 1997 Pasteur’s Quadrant: Basic Science and Technological Innovation

17. © Ravi Sandhu 17 World-Leading Research with Real-World Impact! Cyber Science Quadrants Fundamental Understanding LH H L Jobs Cerf-Kahn Turingjunk Utility

18. © Ravi Sandhu 18 World-Leading Research with Real-World Impact! Cyber Security Quadrants Fundamental Understanding LH H L ?? junk Utility

19. 19 World-Leading Research with Real-World Impact! Access Control Decomposition © Ravi Sandhu Policy Specification Policy Enforcement Policy Administration

20. 20 World-Leading Research with Real-World Impact! Access Control Decomposition © Ravi Sandhu Policy Specification Policy Reality Policy Enforcement Policy Administration

21. © Ravi Sandhu 21 World-Leading Research with Real-World Impact! Access Control Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ????

22. © Ravi Sandhu 22 World-Leading Research with Real-World Impact! Access Control Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? RBAC can be configured to do MAC or DAC

23. © Ravi Sandhu 23 World-Leading Research with Real-World Impact! Access Control Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? Fixed Policy Flexible Policy

24. © Ravi Sandhu 24 World-Leading Research with Real-World Impact! Access Control Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? Human Driven Automated Adaptive

25. © Ravi Sandhu 25 World-Leading Research with Real-World Impact! Access Control Discretionary Access Control (DAC), 1970 Mandatory Access Control (MAC), 1970 Role Based Access Control (RBAC), 1995 Attribute Based Access Control (ABAC), ???? Messy or Chaotic?

26. 26 World-Leading Research with Real-World Impact! ABAC Model Structure © Ravi Sandhu Policy Configuration Points

27. Usage Control Model (UCON) © Ravi Sandhu27 unified model integrating authorization obligation conditions and incorporating continuity of decisions mutability of attributes

28.  © Ravi Sandhu 28 World-Leading Research with Real-World Impact! Risk Adaptive Access Control (RAdAC)

29. © Ravi Sandhu 29 World-Leading Research with Real-World Impact! The RBAC Story RBAC96 paper Proposed Standard Adopted

30. © Ravi Sandhu 30 World-Leading Research with Real-World Impact! ABAC Status RBAC96 paper Proposed Standard Adopted ABAC still in pre/early phase 199x?2013

31.  Cyber technologies and systems trends will drive pervasive adoption of ABAC  ABAC deployment is going to be messy but need not be chaotic  Researchers can facilitate ABAC adoption and reduce chaos by developing  Models  Theories  Systems © Ravi Sandhu 31 World-Leading Research with Real-World Impact! Access Control Prognosis