I EEE Cybersecurity I nitiative ( CybSI ) Accelerating I nnovation - PowerPoint PPT Presentation

I EEE Cybersecurity I nitiative ( CybSI ) Accelerating I nnovation in Security & Privacy Technologies Greg Shannon, IEEE CybSI Chair ( shannon at cert dot org ) Chief Scientist, CERT Division, Software Engineering Institute at Carnegie Mellon University 23 February 2015

A Challenge for Engineers http://www.dilbert.com/strips/2011-02-03/

Today’s Presentation I nitiative Goal: Accelerate innovative research, developm ent and use of efficient cyber security & privacy technologies that protect com m erce, innovation and expression

Today’s Presentation –Overview IEEE & CybSI –Center for Secure Design –try-cybsi Platform –Collaborations

Overview of I EEE and CybSI 5 10 November 2014

About I EEE( .org) 4 3 0 ,0 0 0 + 3 8 1 6 0 + Members Technical Societies Countries 1 ,3 0 0 + 3 ,5 0 0 ,0 0 0 + 1 6 0 + Annual Conferences Technical Documents Top-cited Periodicals

About I EEE: Global Standards Developer Over 9 0 0 active standards 5 0 0 + standards under developm ent Over 7 ,0 0 0 individual m em bers and 2 0 ,0 0 0 standards developers from every continent 2 0 0 + entity m em bers W orking w ith I nternational standards bodies of I SO, I EC and I TU I EEE-SA’s process is w idely respected and aligns w ith the W TO and OpenStand principles 7

Security & Privacy Conferences I n 2 0 1 5 , I EEE w ill hold over 9 0 0 conferences touching security and privacy. To note are: – International Conference on Information Systems Security and Privacy (9-11 Feb.; France) – 3 6 th Annual I EEE Sym posium on Privacy and Security ( 1 8 -2 0 May; San Jose) – IEEE Conference on Communications and Network Security (28-30 Sept.; Italy) – IEEE World Forum on Internet of Things (4-6 Nov.; Switzerland) – IEEE International Conference on Identity, Security and Behavior Analysis (23-25 March; Hong Kong) 8

Security & Privacy Publications I EEE Security and Privacy Magazine – Provides articles with both a practical and research bent by the top thinkers in the field along with case studies, tutorials, columns, and in-depth interviews and podcasts for the information security industry I EEE publishes nearly a third of the w orld’s technical literature in electrical engineering, com puter science and electronics, including the encryption dom ain. E.g.: – Performance Analysis of Data Encryption Algorithms – Comparison of Data Encryption Algorithms with the Proposed Algorithm: Wireless Security – Technical Comparison Analysis of Encryption Algorithm On Site-to-Site IPSec VPN – Impact of Wireless IEEE 802.11n Encryption on Network Performance of Operating Systems – Comparative Study of Attribute Based Encryption Techniques in Cloud Computing – Implementation of Advanced Encryption Standards-192 Bit Using Multiple Keys – A Multi-layer Evolutionary Homomorphic Encryption Approach for Privacy Preserving over Big Data 9

I EEE Security-related Standards Just a sam pling: Encryption ( I EEE P1 3 6 3 ) Fixed & Rem ovable Storage ( I EEE P1 6 1 9 , I EEE P1 6 6 7 ) Printers, copiers, etc. ( I EEE P2 6 0 0 ) Provisions of connectionless user data confidentiality by m edia access independent protocols ( I EEE 8 0 2 .1 AE) MAC security key agreem ent protocol ( P8 0 2 .1 Xbx) 10

Cybersecurity I nitiative Goal: Accelerate research, developm ent and use of efficient cyber security & privacy technologies that protect com m erce, innovation and expression.

Cybersecurity I nitiative Activities – Center for Secure Design – try-cybsi Platform – Collaborations

Steering Com m ittee Chair, Greg Shannon, CMU Jim DelGrosso, Cigital – Project Lead for Center for Secure Design – Network security and anomaly detection Jonathan Katz, U. of Maryland I EEE Fellow , Carl Landw ehr, George W ashington U. – Cryptography – Cybersecurity “building codes” Carrie Gates, Dell Research I EEE Fellow , Michael W aidner, – Empirical/ experimental methodswww.laser- Fraunhofer SI T & Darm stadt workshop.org – Security & privacy architectures Celia Merzbacher, Sem iconductor Research ( SRC.org) I EEE Fellow , Nasir Mem on, NYU – Hardware – Digital forensics Kathleen Clark-Fisher, Com puter I EEE Fellow , Jeff Jaffe, W 3 C.org Society – CEO, HTML standards and security – Initiative Director for IEEE

Center for Secure Design 14 10 November 2014

http://cybersecurity.ieee.org/center-for-secure-design.html

Patterns in OW ASP Vulnerabilities 2004 2007 2010 2013 A1 Unvalidated Input A1 Cross Site Scripting (XSS) A1 Injection A1 Injection Broken Authentication A2 Broken Access Control A2 Injection Flaws A2 Cross-Site Scripting (XSS) A2 and Session Management Broken Authentication Broken Authentication A3 A3 Malicious File Execution A3 A3 Cross-Site Scripting (XSS) and Session Management and Session Management Insecure Direct Object Insecure Direct Object Insecure Direct Object A4 Cross Site Scripting A4 A4 A4 Reference References References Cross Site Request Cross-Site Request A5 Buffer Overflow A5 A5 A5 Security Misconfiguration Forgery (CSRF) Forgery (CSRF) Information Leakage and A6 Injection Flaws A6 A6 Security Misconfiguration A6 Sensitive Data Exposure Improper Error Handling Broken Authentication Insecure Cryptographic Missing Function Level A7 Improper Error Handling A7 A7 A7 and Session Management Storage Access Control Insecure Cryptographic Failure to Restrict URL Cross-Site Request A8 Insecure Storage A8 A8 A8 Storage Access Forgery (CSRF) Application Denial of Insufficient Transport Using Components with A9 A9 Insecure Communications A9 A9 Service Layer Protection Known Vulnerabilities A10 Insecure Configuration A10 Failure to Restrict URL A10 Unvalidated Redirects and A10 Unvalidated Redirects and Management Access Forwards Forwards

Sam e/ Sim ilar Defects For A Decade I njection Attacks Broken Authentication and Session Managem ent Cross-Site Scripting Security Misconfiguration I nsecure Direct Object References Missing Function Level Access Control

Som ething Needs To Change W e have know n about these issues for decades –Knowing != Avoiding Even w hen w e docum ent these issues, and provide standards describing w hat to do, that advice is often not follow ed

Avoiding Top Ten Security Flaw s ( 5 ) Earn or give, but never assum e, trust Use an authentication m echanism that cannot be bypassed or tam pered w ith Authorize after you authenticate Strictly separate data and control instructions, and never process control instructions received from untrusted sources Define an approach that ensures all data are explicitly validated

Avoiding Top Ten Security Flaw s ( 5 ) Use cryptography correctly I dentify sensitive data and how they should be handled Alw ays consider the users Understand how integrating external com ponents changes your attack surface Be flexible w hen considering future changes to objects and actors

Design Flaw s Results, Next Steps Avoiding the Top 1 0 Softw are Security Design Flaw s – Iván Arce, Kathleen Clark-Fisher, Neil Daswani, Jim DelGrosso, Danny Dhillon, Christoph Kern, Tadayoshi Kohno, Carl Landwehr, Gary McGraw, Brook Schoenfield, Margo Seltzer, Diomidis Spinellis, Izar Tarandach, and Jacob West – cybersecurity.ieee.org/ images/ files/ images/ pdf/ CybersecurityInitiative-online.pdf – Spanish Version in March W orkshop on Specific Dom ains – March 2 4 -2 6 – Tools for avoiding flaws – Consider specific domains: automotive, medical, smart grid, etc. – Consider Privacy

try-cybsi Platform 22 10 November 2014

Understanding Security & Privacy Technologies and Challenges W e’ve all read or heard about com plex technologies, m ethods and ideas 23

Understanding Security & Privacy Technologies and Challenges W e’ve all read or heard about com plex technologies, m ethods and ideas Have you w anted to know m ore beyond reading about it? 24

Understanding Security & Privacy Technologies and Challenges W e’ve all read or heard about com plex technologies, m ethods and ideas Have you w anted to know m ore beyond reading about it? Have you tried to use the technology? Reproduce the results? Run the dem o? 25

Understanding Security & Privacy Technologies and Challenges W e’ve all read or heard about com plex technologies, m ethods and ideas Have you w anted to know m ore beyond reading about it? Have you tried to use the technology? Reproduce the results? Run the dem o? Have you had those fail directly? Or fail to help you understand m ore? 26

try-cybsi Platform Goal: archive, curate and present: cyber security & privacy technical artifacts ( code, data, results, exploits, etc.) AND cyber security & privacy experiences of those ( exam ples, dem os, experim ents, m easurem ents, evaluations) 27

try-cybsi Platform try4 1 Dem o – Dendrite example, https: / / try.lab41.org – Uses Docker and OpenStack in a private “cloud” – In-Q-Tel funded – https: / / github.com/ Lab41/ try41 28