National Cybersecurity Center of Excellence Mitigating IoT-Based - PowerPoint PPT Presentation

National Cybersecurity Center of Excellence Mitigating IoT-Based DDoS Build 1 Demonstration Presentation April 10, 2019

Challenge • There will be 20.4 billion connected IoT devices by 2020 (per Gartner) • As IoT devices become more common in homes and businesses, security concerns are also increasing • IoT devices represent one of the largest attack surfaces – Some have minimal security, are unprotected or are difficult to secure • DDoS attacks increased by 28% in 2017 (per Akamai) • Recently IoT devices have been exploited to launch DDoS attacks (e.g. Mirai) National Cybersecurity Center of Excellence nccoe.nist.gov 2

Typical Home/Small Business Network (Without MUD) National Cybersecurity Center of Excellence nccoe.nist.gov 3

Attacker Manufacturer Server Internet Home/Small Business

Typical Home/Small Business Network (With MUD) National Cybersecurity Center of Excellence nccoe.nist.gov 14

Attacker Manufacturer Server Internet Home/Small Business

Architecture Overview National Cybersecurity Center of Excellence nccoe.nist.gov 20

Logical Architecture Home or Small Business Network (3a) HTTPS get URL (MUD file) (4a) HTTPS get URL (Signature file) One Device MUD MUD Manager File Server (3b) MUD file (5a) Device (2b) MUD (4b) Signature file traffic filters URL FreeRadius (5b) Device (2a) MUD URL traffic filters Router or Switch (1) MUD (6) IP URL in Address DHCP transaction Update Protocol Update Server Devices National Cybersecurity Center of Excellence nccoe.nist.gov 21

Demonstration National Cybersecurity Center of Excellence nccoe.nist.gov 22

Step 1: Connect Device Home or Small Business Network Router or Switch (1) MUD URL in DHCP transaction Devices National Cybersecurity Center of Excellence nccoe.nist.gov 23

Step 1: Connect Device Router or 1. No session on interface Switch Devices 2. Connect MUD enabled IoT Device Devices Router or 3. Interface state changed to up Switch National Cybersecurity Center of Excellence nccoe.nist.gov 24

Step 2a/2b: Send MUD URL to MUD Manager Home or Small Business Network One Device MUD Manager (2b) MUD URL FreeRadius (2a) MUD URL Router or Switch (1) MUD URL in DHCP transaction Devices National Cybersecurity Center of Excellence nccoe.nist.gov 25

Step 2a/2b: Send MUD URL to MUD Manager FreeRadius 1. FreeRadius service receives and passes MUD URL National Cybersecurity Center of Excellence nccoe.nist.gov 26

Step 2b: Send MUD URL to MUD Manager 2. MUD Manager receives MUD enabled IoT Device MUD information from FreeRadius Service Manager National Cybersecurity Center of Excellence nccoe.nist.gov 27

Step 3/4: Get MUD and Signature File Home or Small Business Network (3a) HTTPS get URL (MUD file) (4a) HTTPS get URL (Signature file) One Device MUD MUD Manager File Server (3b) MUD file (2b) MUD (4b) Signature file URL FreeRadius (2a) MUD URL Router or Switch (1) MUD URL in DHCP transaction Devices National Cybersecurity Center of Excellence nccoe.nist.gov 28

Step 3/4: Send MUD URL to MUD Manager MUD 1. MUD Manager receives message Manager MUD 2. Get MUD and Signature file Manager MUD 3. Verify MUD file Manager National Cybersecurity Center of Excellence nccoe.nist.gov 29

Step 5a: Send Device Traffic Filters Home or Small Business Network (3a) HTTPS get URL (MUD file) (4a) HTTPS get URL (Signature file) One Device MUD MUD Manager File Server (3b) MUD file (5a) Device (2b) MUD (4b) Signature file traffic filters URL FreeRadius (2a) MUD URL Router or Switch (1) MUD URL in DHCP transaction Devices National Cybersecurity Center of Excellence nccoe.nist.gov 30

Step 5a: Send Device Traffic Filters MUD 1. MUD File parsed and translated to ACL (rules) Manager MUD 2. MUD Manager sends ACL Manager National Cybersecurity Center of Excellence nccoe.nist.gov 31

Step 5a: Send Device Traffic Filters 3. FreeRadius receives ACL from MUD Manager FreeRadius National Cybersecurity Center of Excellence nccoe.nist.gov 32

Step 5b: Send Device Traffic Filters Home or Small Business Network (3a) HTTPS get URL (MUD file) (4a) HTTPS get URL (Signature file) One Device MUD MUD Manager File Server (3b) MUD file (5a) Device (2b) MUD (4b) Signature file traffic filters URL FreeRadius (5b) Device (2a) MUD URL traffic filters Router or Switch (1) MUD URL in DHCP transaction Devices National Cybersecurity Center of Excellence nccoe.nist.gov 33

Step 5b: Send Device Traffic Filters FreeRadius 1. FreeRadius sends ACL to switch Router or 2. ACL received and configurations applied Switch National Cybersecurity Center of Excellence nccoe.nist.gov 34

Step 6: IP Address Assigned Home or Small Business Network (3a) HTTPS get URL (MUD file) (4a) HTTPS get URL (Signature file) One Device MUD MUD Manager File Server (3b) MUD file (5a) Device (2b) MUD (4b) Signature file traffic filters URL FreeRadius (5b) Device (2a) MUD URL traffic filters Router or Switch (1) MUD (6) IP URL in Address DHCP transaction Devices National Cybersecurity Center of Excellence nccoe.nist.gov 35

Step 6: IP address assigned 1. IoT Device receives IP address Devices National Cybersecurity Center of Excellence nccoe.nist.gov 36

Step 6: IP address assigned Router or 1. Show access-session Switch Router or 2. Show access-lists Switch National Cybersecurity Center of Excellence nccoe.nist.gov 37

Step 7: Test communication Home or Small Business Network (3a) HTTPS get URL (MUD file) (4a) HTTPS get URL (Signature file) One Device MUD MUD Manager File Server (3b) MUD file (5a) Device (2b) MUD (4b) Signature file traffic filters URL FreeRadius (5b) Device (2a) MUD URL traffic filters Router or Switch (1) MUD (6) IP URL in Address DHCP transaction Update Protocol Update Server Devices National Cybersecurity Center of Excellence nccoe.nist.gov 38

Step 7: Test communication 1. Test browsing to “Update Server” Devices 2. Test browsing to unapproved server Devices National Cybersecurity Center of Excellence nccoe.nist.gov 39

Next Steps Home or Small Business Network (3a) HTTPS get URL (MUD file) (4a) HTTPS get URL (Signature file) One Device MUD MUD Manager File Server (3b) MUD file (5a) Device (2b) MUD (4b) Signature file traffic filters URL FreeRadius (5b) Device (2a) MUD URL traffic filters Threat Signaling Threat Signaling Router or Server (w/ Intel Switch Provided data) (1) MUD (6) IP URL in Address DHCP transaction Update Protocol Update Server Devices National Cybersecurity Center of Excellence nccoe.nist.gov 40

Questions

National Cybersecurity Center of Excellence Mitigating IoT-Based - PowerPoint PPT Presentation

National Cybersecurity Center of Excellence Mitigating IoT-Based DDoS Build 1 Demonstration Presentation April 10, 2019 Challenge There will be 20.4 billion connected IoT devices by 2020 (per Gartner) As IoT devices become more common

National Cybersecurity Center of Excellence Increasing the deployment and use of standards-based

The NSF Cybersecurity Center of Excellence James A. Marsteller CTSC Co-PI Towards Security

National Cybersecurity Center of Excellence Multifactor Authentication for e-Commerce Project

U.S. National U.S. National Why are we talking about Cybersecurity Cybersecurity

National CyberWatch Center National Cybersecurity Student Association CyberStudents.org National

Cybersecurity A presentation to the National Association of Black Accountants Cleveland

National Cybersecurity a multi-stakeholder approach Wednesday, 11 th April 2018 By: Vincent

Center of Excellence - robotics and AI Robocoast is a center of excellence that is managed by

NCL: Facilitating Cybersecurity Experimentation as a Community Liang Zhenkai National

SHF | HCV INITIATIVE A Center of Excellence As a center of Excellence, St. Hope Foundation is

Presented by: Islanders Bank Cybersecurity Awareness Cybersecurity Awareness Objectives:

Internet and CyberSecurity 101 U.S. National Cybersecurity, 10/5/06 presented by: Martin Casado

Shaping the Future of Cybersecurity Education Is N.I.C.E. NATIONAL INITIATIVE FOR CYBERSECURITY

Center of Development Excellence July 2, 2018 Center of Development Excellence Todays Agenda

NATIONAL INTREPID CENTER SmithGroup | Turner Construction | National Naval Medical Center OF

Matthew Wright, PhD Director of the Center for Cybersecurity Professor of Computing Security

INTEGRATED CORRIDOR MANAGEMENT IN MARYLAND National Operation Center of Excellence (NOCoE)

National Cybersecurity Workforce Framework Benjamin Scribner Department of Homeland Security

Federal Computer Security Managers Forum Quarterly Meeting November 2, 2017 National

Being Strategic about Cybersecurity Regional Cybersecurity Forum, 29-30 Nov 2016, Grand Hotel

Cybersecurity: Threats, Prevention and Preparation Phil Bertolini Co-Director, Center for Digital

Upcoming Guide on Being Strategic about Cybersecurity BDT Efforts to Assist Member States

Using awk to analyze Bro logs Mark Krenz BroCon 2017 September 12th, 2017 Center for

Cybersecurity & the Job Market Salim Hariri, Co-Director NSF Center for Cloud and Autonomic

National Cybersecurity Center of Excellence Mitigating IoT-Based - PowerPoint PPT Presentation

National Cybersecurity Center of Excellence Mitigating IoT-Based DDoS Build 1 Demonstration Presentation April 10, 2019 Challenge There will be 20.4 billion connected IoT devices by 2020 (per Gartner) As IoT devices become more common

National Cybersecurity Center of Excellence Increasing the deployment and use of standards-based

The NSF Cybersecurity Center of Excellence James A. Marsteller CTSC Co-PI Towards Security

National Cybersecurity Center of Excellence Multifactor Authentication for e-Commerce Project

U.S. National U.S. National Why are we talking about Cybersecurity Cybersecurity

National CyberWatch Center National Cybersecurity Student Association CyberStudents.org National

Cybersecurity A presentation to the National Association of Black Accountants Cleveland

National Cybersecurity a multi-stakeholder approach Wednesday, 11 th April 2018 By: Vincent

Center of Excellence - robotics and AI Robocoast is a center of excellence that is managed by

NCL: Facilitating Cybersecurity Experimentation as a Community Liang Zhenkai National

SHF | HCV INITIATIVE A Center of Excellence As a center of Excellence, St. Hope Foundation is

Presented by: Islanders Bank Cybersecurity Awareness Cybersecurity Awareness Objectives:

Internet and CyberSecurity 101 U.S. National Cybersecurity, 10/5/06 presented by: Martin Casado

Shaping the Future of Cybersecurity Education Is N.I.C.E. NATIONAL INITIATIVE FOR CYBERSECURITY

Center of Development Excellence July 2, 2018 Center of Development Excellence Todays Agenda

NATIONAL INTREPID CENTER SmithGroup | Turner Construction | National Naval Medical Center OF

Matthew Wright, PhD Director of the Center for Cybersecurity Professor of Computing Security

INTEGRATED CORRIDOR MANAGEMENT IN MARYLAND National Operation Center of Excellence (NOCoE)

National Cybersecurity Workforce Framework Benjamin Scribner Department of Homeland Security

Federal Computer Security Managers Forum Quarterly Meeting November 2, 2017 National

Being Strategic about Cybersecurity Regional Cybersecurity Forum, 29-30 Nov 2016, Grand Hotel

Cybersecurity: Threats, Prevention and Preparation Phil Bertolini Co-Director, Center for Digital

Upcoming Guide on Being Strategic about Cybersecurity BDT Efforts to Assist Member States

Using awk to analyze Bro logs Mark Krenz BroCon 2017 September 12th, 2017 Center for

Cybersecurity &amp; the Job Market Salim Hariri, Co-Director NSF Center for Cloud and Autonomic

Cybersecurity & the Job Market Salim Hariri, Co-Director NSF Center for Cloud and Autonomic