SystemAware Cyber Security Architecture Rick A. Jones October, - PowerPoint PPT Presentation

System‐Aware Cyber Security Architecture Rick A. Jones October, 2011

Research Topic DescripAon • System‐Aware Cyber Security Architecture – Addresses supply chain and insider threats – Embedded into the system to be protected – Includes physical systems as well as informaAon systems • Requires system engineering support tools for evaluaAng architectures factors • To facilitate reusability requires establishment of candidate Design PaMern Templates and iniAaAon of a design library – Security Design – System Impact Analyses ASRR 10/11 October 2011 2

IncorporaAng Recognized Security FuncAons into an Integrated System‐Aware Security SoluAon • Fault‐Tolerance – Diverse ImplementaAons of Common FuncAons – Data ConAnuity Checking via VoAng • Cyber Security – Moving Target with Diversity • Physical ConfiguraAon Hopping • Virtual ConfiguraAon Hopping – Adversary‐SensiAve System ReconstrucAon • AutomaAc Control Systems – Data ConAnuity Checking via State EsAmaAon – System IdenAficaAon • TacAcal Forensics ASRR 10/11 October 2011 3

System‐Aware Security Architecture Internal Controls Inputs Outputs System to be Protected Internal Measurements System-Aware Security Sub-System ASRR 10/11 October 2011 4

System‐Aware Cyber Security Subsystem System-Aware Security Sub- System Measurements Measurement Analysis Security System to be Control Protected Decisions Hopping & Restoral System Control Control Signaling ASRR 10/11 October 2011 5

System‐Aware Security Analysis Mission-Risk Ranked System Functions Number of hopped (1) functions Selected (2) set for (3) hopping (4) … (N) System Latency Rate of Delay in hopping compromise detection Mission Risk System Latency ASRR 10/11 October 2011 6

System‐Aware Security for Facility Defense ASRR 10/11 October 2011 7

Facility Defense System to be Secured • We consider a facility defense system consisAng of: – Streaming sensors conAnuously monitoring discrete areas – Streaming Servers distribuAng sensor data, received over a wired network, to mobile users over a wireless broadcast network – Mobile users receiving alerts and streaming data regarding potenAal problems ASRR 10/11 October 2011 8

IllustraAve Architectural Diagram for Candidate Facility Defense System for System‐Aware Security 9

PotenAal Cyber AMacks • Replay aMacks masking malicious acAvity iniAated through – Sensor system – Streaming servers – User devices • DoS aMacks addressed through redundancy – Sensor system – Streaming servers – OperaAonal procedures and redundancy regarding user devices ASRR 10/11 October 2011 10

System‐Aware SoluAon for Securing the Facility Defense System • Replay aMack defense – Diversely Redundant Streaming Sensors, with VoAng (Data ConAnuity Checking) – Diversely Redundant, Virtually Hopped Streaming Servers – Diverse User Devices, with RotaAng User Surveillance Assignments and Device Use – Mobile User based Data ConAnuity Checking • DoS defense – Redundancy at the Sensor and Streaming server levels – Streaming servers / User feed back loops to enable redistribuAon of data and job responsibiliAes ASRR 10/11 October 2011 11

IllustraAve System‐Aware SoluAon Architecture 12

Observable Regions / User Fidelity Impacts of 3 Stream ConAnuous VoAng 100 90 80 Max Possible # of Observable Regions 70 60 50 No VoAng/Single Stream ConAnuous 3 Stream VoAng 40 30 20 10 0 100 150 200 250 500 Stream Fidelity (Kbps) 13

Observable Regions / User Fidelity Impacts of 3 Stream ConAnuous VoAng 100 90 80 Max Possible # of Observable Regions 70 60 Loss in User PresentaAon Fidelity 50 No VoAng/Single Stream ConAnuous 3 Stream VoAng 40 30 20 10 0 100 150 200 250 500 Stream Fidelity (Kbps) 14

Observable Regions / User Fidelity Impacts of 3 Stream ConAnuous VoAng 100 90 80 Max Possible # of Observable Regions 70 ReducAon in Maximum Observable Regions 60 50 No VoAng/Single Stream ConAnuous 3 Stream VoAng 40 30 20 10 0 100 150 200 250 500 Stream Fidelity (Kbps) 15

Duty Cycle VoAng for Increasing the Possible Number of Observable Regions Concept – Use of Ame division for voAng permits an increase • in the number of possible surveillance points User compares streams concurrently received from mulAple – diversely redundant servers to discover disconAnuiAes 3 parameters can be uAlized to govern voAng – Number of Observed Regions • Deemed acceptable VoAng Interval for data conAnuity checking • across all regions Streaming period Ame alloMed for conAnuity checking (VoAng • Time), which can be less than the VoAng Interval Given the VoAng Time can be a subset of the VoAng Interval, – the use of Ame division can be uAlized to manage informaAon distribuAon over the broadcast network, interleaving mulAple streams for voAng users with single streams for other users who are not voAng ASRR 10/11 October 2011 16

IllustraAve System‐Aware SoluAon Architecture with Duty Cycle VoAng 17

IllustraAve System‐Aware SoluAon Architecture with Duty Cycle VoAng 18

IllustraAve System‐Aware SoluAon Architecture with Duty Cycle VoAng 19

Duty Cycle VoAng for Increasing the Possible Number of Observable Regions User 1 Time User 2 Time User 3 Time Wireless Network Time Column Heights = Data / Time Interval 20

Observable Regions / User Fidelity Impacts of 3 Stream ConAnuous VoAng 100 90 80 Max Possible # of Observable Regions 70 60 No VoAng/Single Stream 50 ConAnuous 3 Stream VoAng 40 Duty Cycle VoAng 30 20 10 0 100 150 200 250 500 Stream Fidelity (Kbps) 21

AddiAonal Collateral System Impacts • Common Cause Failures are reduced • MTBF increases in relaAonship to the individual diverse component reliabiliAes • Development cost increases based on the cost to develop voAng and duty cycle management components, as well as to resolve lower level technical issues that may arise – SynchronizaAon needs – Sohware integraAon – Performance impact measurements and enhancement needs (e.g. CPU uAlizaAon, memory, and energy usage) • One Ame and life cycle cost increase in relaAonship to the increased complexity 22

Scoring Framework 23

Need: Methodology for EvaluaAng AlternaAve Security SoluAons for a ParAcular System • A methodology is required in order to clarify reasoning and prioriAzaAons regarding unavoidable cyber security vagaries: – RelaAonships between soluAons and adversarial responses – MulAdimensional contribuAons of individual security services to complex aMributes, such as deterrence • Scores can be derived in many different forms – Single scalar value where bigger is beMer – 2 scalar values: (1) security value added, (2) system‐level disvalues – MulA‐objecAve component scores providing more transparency ASRR 10/11 October 2011 24

Metrics • AMack phase‐based security value factors: – Pre‐AMack (Deterrence) – Trans‐AMack (Defense) – Post‐AMack (RestoraAon) • Would include collateral system impact metrics for the security architecture: • Performance • Reliability, Safety • Complexity, Costs ASRR 10/11 October 2011 25

System‐Aware Security System Scoring Matrix RelaDve Value k 1 k 2 k 3 k 4 k 5 k 6 k j Weights Value Deterrence Real Restor‐ Collateral Implemen‐ Life Other Factors Time aDon System taDon Cost Cycle Defense Impacts Cost Security Services Diversity s 11 s 12 s 1j (s 1 ) Hopping s 21 s 22 s 2j (s 2 ) Data s 31 s 32 s 3j ConAnuity Checking (s 3 ) TacAcal s 41 s 42 s 4j Forensics (s 4 ) ASRR 10/11 October 2011 26 Other (s i ) s i1 s i2 s ij

System‐Aware Security System Scoring Matrix RelaDve Value k 1 k 2 k 3 k 4 k 5 k 6 k j Weights Value Deterrence Real Restor‐ Collateral Implemen‐ Life Other Factors Time aDon System taDon Cost Cycle Defense Impacts Cost Security Services Diversity s 11 s 12 s 1j p (s 1 ) k 1 ∑ = j Hopping s 21 s 22 s 2j j 1 = (s 2 ) s ij = Assurance Level of the ith service as Data s 31 s 32 s 3j ConAnuity related to the jth value factor Checking (s 3 ) s ij = QuanAzed Assurance Level = 0…M TacAcal s 41 s 42 s 4j p n Security k j s ∑∑ = Forensics ij Score (s 4 ) j 1 i 1 = = ASRR 10/11 October 2011 Max Possible Score = n x M 27 Other (s i ) s i1 s i2 s ij

Example Facility Defense Scoring Matrix RelaDve K 1 =0.30 K 2 = 0.20 k 3 =0.10 K 4 = 0.20 K 5 = 0.05 K 6 = 0.15 Value Weights Value Deterrence Real Restor‐ Collateral Implemen‐ Life Factors Time aDon System taDon Cost Cycle Defense Impacts Cost Security Services Diversity 4 3 4 4 2 2 (s 1 ) Hopping 3 4 3 1 2 3 (s 2 ) Data 2 4 3 1 4 3 ConAnuity Checking (s 3 ) TacAcal 3 0 4 5 4 2 Forensics (s 4 ) Strongest Area is RestoraAon 28 Max Possible Score = 20 Facility Defense Score = 11.5 Weakest Area is Life Cycle Cost

On Going ExploraAon • A pracAcal methodology for determining Assurance Level Values • Methodology for addressing uncertainty in assigning Assurance Level Values • Methodology for uAlizing RelaAve Value Weights • Tradeoffs between scoring simplicity and transparency of results ASRR 10/11 October 2011 29