Dept. of Homeland Security Science & Technology Directorate Homeland

Dept. of Homeland Security Science & Technology Directorate Homeland Security: Cyber Security R&D Initiatives ACM CCS Alexandria, VA November 8, 2005 Douglas Maughan, Ph.D. Program Manager, HSARPA [email protected] 202-254-6145 / 202-360-3170

General DHS Organization (prior to 7/13/05) Secretary (Chertoff) & Deputy Secretary (Jackson) Management (Hale) Border & Transportation Security (Beardsworth, act.) Emergency Preparedness & Emergency Response (Paulison, act.) Coast Guard Secret Service Citizenship & Immigration & Ombuds Civil Rights and Civil Liberties Legislative Affairs General Counsel Inspector General State & Local Coordination Private Sector Coordination International Affairs National Capital Region Coordination Counter-narcotics Small and Disadvantaged Business Privacy Officer Chief of Staff Information Analysis & Infrastructure Protection (Stephan, act.) Science & Technology (McQueary) 8 November 2005 2

Organization Chart (proposed end state) EXECUTIVE SECRETARY SECRETARY DEPUTY SECRETARY UNDER SECRETARY FOR MANAGEMENT UNDER SECRETARY FOR SCIENCE & TECHNOLOGY UNDER SECRETARY FOR POLICY ASSISTANT SECRETARY OFFICE OF INTELLIGENCE & ANALYSIS FEDERAL LAW ENFORCEMENT TRAINING CENTER DIRECTOR TRANSPORTATION SECURITY ADMINISTRATION DOMESTIC NUCLEAR DETECTION OFFICE COMMISSIONER CUSTOMS & BORDER PROTECTION SCREENING COORDINATION OFFICE CHIEF OF STAFF MILITARY LIAISON UNDER SECRETARY FOR PREPAREDNESS GENERAL COUNSEL A/S CONGRESSIONAL & INTERGOVERNMENTAL AFFAIRS ASSISTANT SECRETARY PUBLIC AFFAIRS INSPECTOR GENERAL DIRECTOR OF OPERATIONS COORDINATION DIRECTOR OF COUNTER NARCOTICS OMBUDSMAN CITIIZENSHIP & IMMIGRATION SERVICES CHIEF PRIVACY OFFICER DIRECTOR CIVIL RIGHTS/CIVIL LIBERTIES LABOR RELATIONS BOARD DIRECTOR US SECRET SERVICE DIRECTOR CITIZENSHIP & IMMIGRATION SERVICES COMMISSIONER IMMIGRATION & CUSTOMS ENFORCEMENT DIRECTOR FEMA COMMANDANT US COAST GUARD 8 November 2005 3

Department of Homeland Security Organization Chart—Preparedness (proposed end state) UNDER SECRETARY FOR PREPAREDNESS CHIEF MEDICAL OFFICER ASSISTANT SECRETARY FOR GRANTS AND TRAINING ASSISTANT SECRETARY FOR INFRASTRUCTURE PROTECTION NATIONAL CAPITAL REGION DIRECTOR FIRE ADMINISTRATION ASSISTANT SECRETARY FOR CYBER & TELECOMMUNICATIONS 8 November 2005 4

Science and Technology (S&T) Mission Conduct, stimulate, and enable research, development, test, evaluation and timely transition of homeland security capabilities to federal, state and local operational end-users. 8 November 2005 5

S&T Organization Chart Under Secretary for Science & Technology (McQueary) Office of Plans Programs and Requirements (Evans, act.) Homeland Security Advanced Research Projects Agency (Kubricky, act.) Office of Research and Development (McCarthy) Office of Systems Engineering & Development (Kubricky) 8 November 2005 6

Execution Science and Technology Directorate Office of Research and Development Homeland Security Advanced Research Projects Agency Systems Engineering & Development Centers Fellowships Scholarships Stewardship of an enduring capability Innovation, Adaptation, & Revolution Development Engineering, Production, & Deployment 8 November 2005 7

Crosscutting Portfolio Areas Chemical Biological Radiological Nuclear High Explosives Cyber Security Critical Infrastructure Protection (CIP) USSS 8 November 2005 8

Legacy of HSARPA Name How is it different from DARPA? Differences 85-90% of funds for identified DHS requirements 10-15% of funds for revolutionary research Breakthroughs, New technologies and systems These percentages likely to change over time, but we need to meet today’s requirements 8 November 2005 9

HSARPA Funding HSARPA funding is allocated from Appropriated line items SCIENCE AND TECHNOLOGY DIRECTORATE FY05-06 Budget Execution Distribution Dollars M FY 2005 Portfolio Appropriation Biodefense/Bio Countermeasures 362.7 Chemical Countermeasures 53.0 Conventional Missions 50.1 Counter-MANPADS 61.0 Critical Infrastructure Protection 27.0 Cyber Security 18.0 Emerging Threats 10.8 High Explosives/Explosives Countermeasures 19.7 National Biodefense Analysis & Countermeasures Ctr (NBACC) 35.0 Office of Interoperability and Compatibility 21.0 Radiological and Nuclear (DNDO) 122.6 Radiological and Nuclear Countermeasures Rapid Prototyping 76.0 Research and Development Consolidation Safety Act 10.0 Standards 39.7 Threat and Vulnerability Testing and Assessment 65.8 University Programs/Fellowships 70.0 Grand Total 1,042.3 FY 2006 Tentative 380.0 95.0 80.0 110.0 40.8 16.7 8.0 44.0 26.5 318.0 19.1 35.0 99.9 7.0 35.0 43.0 63.0 1,421.0 Delta 17.4 42.0 29.9 49.0 13.8 -1.3 -2.8 24.3 -35.0 5.5 195.4 19.1 -41.0 99.9 -3.0 -4.7 -22.8 -7.0 378.7 8 November 2005 10

Cyber Security R&D Portfolio: Scope We focus on threats and issues that warrant national-level concern Asymmetric capabilities make cyberspace an appealing battleground for our adversaries Cyberspace presents an avenue to exploit weaknesses in our critical infrastructures The most significant cyber threats are very different from “script-kiddies” or virus writers Terrorism Organized crime Economic espionage 8 November 2005 11

R&D Execution Model Customers * NCSD * NCS * USSS * National Documents Other Sectors e.g., Banking & Finance Critical Critical Infrastructure Infrastructure Providers Providers Post R&D Outreach – Venture Community & Industry Prioritized Requirements Experiments and Exercises R&D Coordination – Government & Industry Customers Pre R&D CIP Sector Roadmaps R&D Workshops DNSSEC Cyber Security Assessment Solicitation Preparation Rapid Prototyping BAAs Supporting Programs DETER PREDICT SPRI Emerging Threats External (e.g., I3P) SBIRs 8 November 2005 12

R&D Execution Model Customers * NCSD * NCS * USSS * National Documents Other Sectors e.g., Banking & Finance Critical Critical Infrastructure Infrastructure Providers Providers Post R&D Outreach – Venture Community & Industry Prioritized Requirements Experiments and Exercises R&D Coordination – Government & Industry Customers Pre R&D CIP Sector Roadmaps R&D Workshops DNSSEC Cyber Security Assessment Solicitation Preparation Rapid Prototyping BAAs Supporting Programs DETER PREDICT SPRI Emerging Threats External (e.g., I3P) SBIRs 8 November 2005 13

Rapid Technology Application Program (RTAP) Similar to the existing Technical Support Working Group (TSWG) approach Requirements Generation Panel Identify general technology needs Reduce collection of general needs Explore issues and draft Statement of Requirements (SoR) Write an SoR for each technology need in detail suitable for prototype procurement 8 November 2005 14

Cyber Security RTAP Topics #1 BOTNET Detection and Mitigation Tool Customer: #2 Exercise Scenario Modeling Tool Customer: #3 IAIP/NCSD IAIP/NCSD DHS Secure Wireless Access Prototype Customer: S&T OCIO Pre-solicitation at http://www.hsarpabaa.com 8 November 2005 15

HSARPA Cyber Security Broad Agency Announcement (BAA 04-17) A critical area of focus for DHS is the development and deployment of technologies to protect the nation’s cyber infrastructure including the Internet and other critical infrastructures that depend on computer systems for their mission. The goals of the Cyber Security Research and Development (CSRD) program are: To perform research and development (R&D) aimed at improving the security of existing deployed technologies and to ensure the security of new emerging systems; To develop new and enhanced technologies for the detection of, prevention of, and response to cyber attacks on the nation’s critical information infrastructure. To facilitate the transfer of these technologies into the national infrastructure as a matter of urgency. http://www.hsarpabaa.com 8 November 2005 16

BAA Technical Topic Areas (TTAs) System Security Engineering Vulnerability Prevention Tools and techniques for better software development Vulnerability Discovery and Remediation Cyber Security Assessment Tools and techniques for analyzing software to detect security vulnerabilities Develop methods and tools for assessing the cyber security of information systems Security of Operational Systems Security and Trustworthiness for Critical Infrastructure Protection 1) Automated security vulnerability assessments for CI systems 2) Improvements in system robustness of critical infrastructure systems 3) Configuration and security policy management tools 4) Cross-platform and/or cross network attack correlation and aggregation 8 November 2005 17

BAA TTAs (continued) Security of Operational Systems Wireless Security Security tools/products for today’s networks Solutions and standards for next generation networks Investigative Network and Prevention Technologies Attack Forensics Tools and techniques for attack traceback Technologies to Defend against Identity Theft R&D of tools and techniques for defending against identity theft and other financial systems attacks, e.g., phishing 8 November 2005 18

BAA Program / Proposal Structure NOTE: Deployment Phase Test, Evaluation, and Pilot deployment in DHS “customer” environments Type I (New Technologies) – Funding NTE 36 months Type II (Prototype Technologies) – Funding NTE 24 months New technologies with an applied research phase, a development phase, and a deployment phase (optional) More mature prototype technologies with a development phase and a deployment phase (optional) Type III (Mature Technologies) – Funding NTE 12 months Mature technology with a deployment phase only. 8 November 2005 19

BAA 04-17 Proposal Summary TTA-1 TTA-2 TTA-3 TTA-4 TTA-5 TTA-6 TTA-7 TOTAL 36 Months 24 Months 12 Months Type I Type II Type III TOTAL Received Funded Received Funded Received Funded Received Funded 8 0 6 1 3 0 17 1 10 2 8 2 1 0 19 4 3 0 6 1 0 0 9 1 14 1 23 2 2 1 39 4 9 2 7 0 2 0 18 2 4 1 6 1 0 0 10 2 8 1 10 2 0 0 18 3 56 7 66 9 8 1 130 17 http://www.hsarpabaa.com/; Solicitation Awards; BAA04-17 Awards 8 November 2005 20

Small Business Innovative Research (SBIRs) http://www.hsarpasbir.com CROSS-DOMAIN ATTACK CORRELATION TECHNOLOGIES (SB04.2-001) Objective: Develop a system to efficiently correlate information from multiple intrusion detection systems (IDSes) about “stealthy” sources and targets of attacks in a distributed fashion across multiple environments. REAL-TIME MALICIOUS CODE IDENTIFICATION (SB04.2-002) Objective: Develop technologies to detect anomalous network payloads destined for any service or port in a target machine in order to prevent the spread of destructive code through networks and applications. These technologies should focus on detecting “zero day attacks”, the first appearance of malicious code for which no known defense has been constructed. 8 November 2005 21

SBIR FY05.2 Submission Hardware-assisted System Security Monitoring OBJECTIVE: This topic seeks technologies that provide a hardware-assist for the monitoring of system security. It is expected that the resulting solutions would be some type of inexpensive coprocessor board that would work with existing hardware and software, resulting in a system with much higher assurance than currently available. By putting the monitoring capability in hardware it is much more difficult for an attacker to disable this part of the system because the board is isolated from potential remote attackers and would require physical access to compromise the hardware-assist board, thus, providing the owner/user technology that can monitor the security health of the system in near real-time. This will ensure that even when the machine is on, but the user is not using the machine, the system will be monitored and can even be "shut down" so unknown communications is not sent while the user's away. The hardware-assist system should have the capability to collect and store information for forensic purposes and the system should also have capability to report security related events to a central monitoring station. Solicitation at http://www.hsarpasbir.com 8 November 2005 22

R&D Execution Model Customers * NCSD * NCS * USSS * National Documents Other Sectors e.g., Banking & Finance Critical Critical Infrastructure Infrastructure Providers Providers Post R&D Outreach – Venture Community & Industry Prioritized Requirements Experiments and Exercises R&D Coordination – Government & Industry Customers Pre R&D CIP Sector Roadmaps R&D Workshops DNSSEC Cyber Security Assessment Solicitation Preparation Rapid Prototyping BAAs Supporting Programs DETER PREDICT SPRI Emerging Threats External (e.g., I3P) SBIRs 8 November 2005 23

DHS / NSF Cyber Security Testbed “Justification and Requirements for a National DDOS Defense Technology Evaluation Facility”, July 2002 We still lack large-scale deployment of security technology sufficient to protect our vital infrastructures Recent investment in research on cyber security technologies by government agencies (NSF, DARPA, armed services) and industry. One important reason is the lack of an experimental infrastructure and rigorous scientific methodologies for developing and testing next-generation defensive cyber security technology The goal is to create, operate, and support a researcher-andvendor-neutral experimental infrastructure that is open to a wide community of users and produce scientifically rigorous testing frameworks and methodologies to support the development and demonstration of next-generation cyber defense technologies 8 November 2005 24

DETER Testbed Architecture Cyber Defense Experiments run on Virtual Internet UCB Internet Internet Internet USC-ISI 3 major sites; over 200 nodes GOAL: By end of FY07 to have 1000 nodes distributed at possibly up to 6 sites DETER Testbed Schematic User Sparta Control DB Ethernet Bridge with Firewall 'Gatekeeper' User files 'Boss' Server ‘User’ Server Web/DB/SNMP, switch mgmt User Acct & Data logging Node Serial Line Server Control Network VLAN Power Serial Line Server N @100bT Control ports PC PC PC Power 160Controller N x 4 @1000bT Data ports Programmable Patch Panel (VLAN switch) 8 November 2005 25

A Protected REpository for Defense of Infrastructure against Cyber Threats PREDICT Program Objective “To advance the state of the research and commercial development (of network security ‘products’) we need to produce datasets for information security testing and evaluation of maturing networking technologies.” Rationale / Background / Historical: Researchers with insufficient access to data unable to adequately test their research prototypes Government technology decision-makers with no data to evaluate competing “products” End Goal: Improve the quality of defensive cyber security technologies 8 November 2005 26

Industry Workshop 2004 Begin the dialogue between HSARPA and industry as it pertains to the cyber security research agenda Discuss existing data collection activities and how they could be leveraged to accomplish the goals of this program Discuss data sharing issues (e.g., technical, legal, policy, privacy) that limit opportunities today and develop a plan for navigating forward Develop a process by which “data” can be “regularly” collected and shared with the network security research community ATTENDEES AOL UUNET Verio XO Comms Akamai Arbor Networks System Detection Cisco PCH Symantec USC-ISI Univ. of WA CERT/CC LBNL Internet2 CAIDA Merit Networks Citigroup PREDICT participant PREDICT participant PREDICT participant PREDICT participant PREDICT participant PREDICT participant PREDICT participant PREDICT participant 8 November 2005 27

Data Collection Activities Classes of data that are interesting, people want collected, and seem reasonable to collect Netflow Packet traces – headers and full packet (context dependent) Critical infrastructure – BGP and DNS data Topology data IDS / firewall logs Performance data Network management data (i.e., SNMP) VoIP (1400 IP-phone network) Blackhole Monitor traffic 8 November 2005 28

PREDICT Information https://www.predict.org Recent Workshop http://www.hsarpacyber.com/public/PREDICT/ 8 November 2005 29

Internet Infrastructure Security Motivation The National Strategy to Secure Cyberspace (2003) recognized the DNS as a critical weakness NSSC called for the Department of Homeland Security to coordinate public-private partnerships to encourage the adoption of improved security protocols, such as DNS The security and continued functioning of the Internet will be greatly influenced by the success or failure of implementing more secure and more robust BGP and DNS. The Nation has a vital interest in ensuring that this work proceeds. The government should play a role when private efforts break down due to a need for coordination or a lack of proper incentives. 8 November 2005 30

Domain Name System Security (DNSSEC) Program DNSSEC Program Objective “Carry forward to completion the recommendation from the National Strategy to Secure Cyberspace by engaging industry, government, and academia to enable all DNS-related traffic on the Internet to be DNSSEC compliant” Rationale / Background / Historical: DNS is a critical component of the Internet infrastructure and was not designed for security DNS vulnerabilities have been identified for over a decade and we are addressing these vulnerabilities End Goal: Greatly increase the security of the Internet (as critical infrastructure) by securing the DNS through the use of crypto signatures 8 November 2005 31

The Domain Name System DNS database maps: Name to IP address www.dhs.gov 206.18.104.198 And many other mappings (mail servers, IPv6, reverse ) Data organized as tree structure: Each zone is authoritative for its own data Root edu isi nge mil darpa ru usmc mil alpha Minimal coordination between zone operators 8 November 2005 32

DNS Attacks Attacks via and against the DNS infrastructure are increasing Attacks are becoming costly and difficult to remedy Consumer confidence in Internet accuracy is decreasing Financial/large enterprises are seeing a significant increase in online attacks for fraudulent purposes Hijacking (virtual theft of domain names) http://www.icann.org/announcements/hijacking-report-12jul05.pdf Phishing (look-alike fraudulent emails and web sites) Pharming (phishing combined with DNS attacks) Other attacks include DNS name mismatches or browser tricks aimed at careless users 8 November 2005 33

DNSSEC – What it provides Provides an approach so DNS users can: Approach integrates with existing server infrastructure and user clients DNSSEC awareness by application Validate that data they receive came from the correct originator, i.e., Source Authenticity Validate that data they receive is the data the originator put into the DNS, i.e., Data Integrity Results of DNSSEC validation functions provided to applications Applications can take different actions based on DNSSEC validation results, e.g. won’t connect to www.bankofamerica.com without good validation but will connect to www.cnn.com without it. Examples: Web browsers Email servers and clients 8 November 2005 34

DNSSEC Initiative Activities Roadmap published in February 2005 Multiple workshops held world-wide DNSSEC testbed developed by http://www.dnssec-deployment.org/roadmap.php http://www-x.antd.nist.gov/dnssec/ Involvement with numerous deployment pilots Working with Civilian government (.gov) to develop policy and technical guidance for secure DNS operations and beginning deployment activities at all levels. Working with the operators of the “.us” and “.mil” zones towards DNSSEC deployment and compliance 8 November 2005 35

DNSSEC Design / Use Secure DNS Guidance Documents NIST 800 Series Documents for operators and policy/decision makers. Define the problem space Outline BCP for securing current DNS operations Guidelines for deployment and use of DNSSEC Series of outreach efforts Announcement from: http://csrc.nist.gov/publications/drafts.html August 11, 2005: Draft NIST Special Publication 800-81, Secure Domain Name System (DNS) Deployment Guide Request for Comments closed Sept. 29th, 2005 8 November 2005 36

Secure Protocols for the Routing Infrastructure (SPRI) BGP is the routing protocol that connects ISPs and subscriber networks together to form the Internet BGP does not forward subscriber traffic, but it determines the paths subscriber traffic follows The BGP architecture makes it highly vulnerable to human errors and malicious attacks against Links between routers The routers themselves Management stations that control routers Work with industry to develop solutions for our current routing security problems and future technologies 8 November 2005 37

SPRI Activities To Date Formation of government and industry “steering committee” DHS, DOD, DOCommerce, NIST, ICANN, IETF Held first industry requirements workshop; March 15-16, 2005 in WDC Held second workshop on operational security; May 18-19, 2005 in Seattle in conjunction with NANOG. Held third workshop on registry operations; Sept. 1314, 2005 in WDC; Outputs submitted at recent ARIN mtg 8 November 2005 38

Cyber Security Assessment Activities Cyber Economics Study Dept. of Treasury – “Key Business Processes in the event of a Crisis” Study 8 November 2005 39

Economic Analysis of Cyber Security and Private-Sector Investment Decisions The objective of the study is to investigate Internet stakeholders’ investment decisions for bolstering the security of their information technology (IT) networks. To achieve the study objectives, RTI will review existing studies to assess the economics of cyber security, conduct a series of interviews within eight industry sectors to assess companies’ investment decisions related to securing their IT networks, and identify potential areas for government involvement and/or support for the deployment and adoption of existing cyber security technologies. DHS/Cyber Security IMPACT DHS is interested in economic decisions that may lead to inadequate investment in cyber security measures. Better information on the costs and benefits of security technologies and adverse events will help inform private investment decisions. Understanding the public goods nature of Internet security may inform government’s involvement in cyber security. SCHEDULE Months from Award Tasks 1 2 3 4 5 k Task 1: Convene Project Meeting k 6 7 8 9 k Task 2: Review Existing Economic Cybersecurity Studies and Methodology Task 3: Interview Targeted Industries M F Task 4: Enhance Approaches to Model the Economic Impacts of Cybersecurity Task 5: Develop Industry Business Cases Task 6: Identify Potential Motivation for and Types of Government Involvement LEGEND k Project Meetings M Draft Questionnaire F G Draft Report Interim Deliverable G O O Final Report 8 November 2005 40

Prototyping of a Business Process Model (A Computer Simulation) of the Finance Sector DESCRIPTION / OBJECTIVES / METHODS - - - DHS/Cyber Security IMPACT This project addresses the requirement for a man-in-the loop simulation that emulates sector-wide disruptions and their operational (business) impact. Sector-level simulation of impacts resulting from cyber and physical disruptions of business processes and transactions between critical entities in the Finance Sector will provide government and industry stakeholders and users with unique insight of operational risks, single points of failure, and mitigation strategies. Potential users include risk managers responsible for the operational health of the sector; also enterprise risk managers “Proof of Concept” activities are designed to assess initial technical and operational feasibility, including scoping and development of a concept of operations, before stakeholders invest substantial resources in full-scale development. Various private and public-sector stakeholders have determined the immediate operational need for this capability; it meets several gaps defined by the Treasury Department and sector-level coordinating councils. The research involves 4 phases: Engage SMEs to help define the logical and physical extent of the sector at a high level; Determine an appropriate subset of sector transactions to model as a proof of concept; Use rapid prototyping to define simulation requirements; Report on technical and operational feasibility BUDGET & SCHEDULE TASK Proof of Concept (Feasibility) FY0 5 FY06 FY07 Phase 1 Requirements Definition Phase 1 Simulation Design Phase 1 Implementation, Integration, Testing, and Roll-out 8 November 2005 41

Rapid Prototyping – Authoritative SSL Auditing PROJECT DESCRIPTION / OVERVIEW Client Machine Client ClientMachine Machine Client ClientMachine Machine Client Application Server Machine ServerMachine Machine Server Network Switch Server Application SSL Server SSL Client Key Shield Goal: Enable organizations to audit secure communications to prove policy compliance, investigate attacks, and arbitrate disputes. Approach: Use a passive network device to record SSL traffic, sign it with a hardware security module, and open communications when necessary. Requires the cooperation of the original secure sever to keep its keys secure. Web portal restricts access to authorized personnel. Status: Alpha Aug 15, 2005; Beta planned for Dec 15, 2005 Auditing Device Recording Application Signing Application Portal Device Auditing Portal End Users: Information technology and security officers in government agencies and commercial organizations, especially those that need to comply with regulations such as HIPAA, FACTA, and Sarbanes-Oxley. BUDGET & SCHEDULE DHS/Cyber Security Impact Complete, authoritative records of electronic transactions Ensure users/organizations follow security policies Better investigate attacks and fraud over SSL All records remain confidential until specifically reviewed Very low total cost of ownership encourages adoption TASK FY05 FY06 FY07 Reqmnts. & Design Alpha System Beta System Final System 8 November 2005 42

Emerging Threats – VME-DEP Virtual Machine Environment - Detection and Escape Prevention VME use is increasing in industry and government, and is starting to be used in classified networks Goals of this project are to Gain a better understanding of where VMEs are used and for what purpose Determine how an attacker might break the security models defined by a VME Develop techniques for preventing those attacks Develop a “secured” open source VME 8 November 2005 43

Emerging Threats - NGCD Next Generation Crimeware Defenses Crimeware: Malicious software specifically designed to steal identity information and other associated financial information Goals of this project are: Gain an understanding of the nature of crimeware technologies and how to defend against their increasing sophistication Collect and analyze crimeware samples Build threat and vulnerability models based on the attack types and goals of stealing access credentials and identity information and correlated to popular computing environments Develop a “secure computing environment”: web browser (based on open-source Mozilla), secure keyboard and embedded co-processor to proactively prevent crimeware 8 November 2005 44

The Institute for Information Infrastructure Protection (I3P) The I3P is a consortium of 24 academic and not-for-profit research organizations The I3P embodies a concept developed in studies between 1998 and 2000 by PCAST, IDA, and OSTP The I3P was formed in September 2001 and funded by congressionally appropriated funds assigned to Dartmouth College DHS/S&T/HSARPA now oversees the I3P funding 17.883 M Congressional Earmark for the Institute for Security Technologies Studies (ISTS) at Dartmouth College Inherited from Office of Domestic Preparedness (ODP) during R&D consolidation activity 8 November 2005 45

Other Activities – Institute for Infrastructure Protection (I3P) Creation of two research plans for cyber security, one in Supervisory Control and Data Acquisition (SCADA) systems, and one in economic and policy issues Two Independent Research Advisory Boards (RABs) established to review final research plans submitted for I3P support. Two-year, 8.5 million research program to protect SCADA systems in the oil and gas industry and other critical infrastructure sectors. Led by Sandia, comprises 10 research institutions with expertise in cyber security, risk management, and infrastructure systems analysis. Kickoff meeting held April 14-15 at Sandia National Laboratories’ Center for SCADA Security in Albuquerque Attended by project researchers along with oil and gas experts from ChevronTexaco, Ergon Refining, Public Utility of New Mexico, and Williams Provided training on SCADA hardware, software, and typical system configurations, as well as common threats and vulnerabilities associated with these systems 8 November 2005 46

I3P Cyber Economics Project Two project goals: How to quantify the cost of cyber security and the effects of cyber attacks? How to measure the effectiveness of current security tools and policies? Three intertwined threads National perspective: Enterprise or corporate perspective: Considers the effects of degraded or destroyed infrastructure on the degree to which an enterprise can maintain its bottom line by developing and delivering products and services. Technological perspective: Views the information infrastructure as an element of national security, where cyber security incidents can disrupt, impair or destroy critical economic capabilities. Addresses those technologies that protect the infrastructure, by deterring particular threats, preventing certain classes of attacks, or mitigating the consequences of attack. Participants: RAND Corporation, University of Virginia, MIT Lincoln Laboratory, George Mason University, Dartmouth 8 November 2005 47

R&D Execution Model Customers * NCSD * NCS * USSS * National Documents Other Sectors e.g., Banking & Finance Critical Critical Infrastructure Infrastructure Providers Providers Post R&D Outreach – Venture Community & Industry Prioritized Requirements Experiments and Exercises R&D Coordination – Government & Industry Customers Pre R&D CIP Sector Roadmaps R&D Workshops DNSSEC Cyber Security Assessment Solicitation Preparation Rapid Prototyping BAAs Supporting Programs DETER PREDICT SPRI Emerging Threats External (e.g., I3P) SBIRs 8 November 2005 48

Experiments and Exercises Experiments U.S. / Canada Secure Blackberry Experiment Oil and Gas Sector CIDDAC U.S. NORTHCOM Working with DOE and industry Finance Sector PSTP-agreed upon deployment activity CWID 2005 (originally known as JWID) Exercises National Cyber Security Exercise (Cyber Storm) National Critical Infrastructure Exercise (NCIE) Exercise led by industry 8 November 2005 49

US-CAN Secure Wireless Trial Objective Technologies Test effectiveness of US/Canadian crossborder secure wireless architecture to cope with real-time communication in variety of scenarios PKI (S/MIME), Identity-based encryption, enforcement of policy and compliance Trial Activity July: U.S.-only initial four-day test period October: Four-day test period with 35 activities and with 40 participants acting out homeland security scenarios using BlackBerry devices 8 November 2005 50

LOGI2C – Linking the Oil and Gas Industry to Improve Cybersecurity LOGI2C is a 12-month technology integration and demonstration project driven by industry, supported by DHS Technical goal: Attack indications and warnings through event analysis and correlation across business and process control networks Approach: Identify new types of security sensors for process control networks Adapt a best-of-breed correlation engine to this environment Integrate in testbed and demonstrate Transfer technology to industry External Events Attack Indications and Warnings LOGI2C Correlation Engine Business Network Process Control Network 8 November 2005 51

LOGI2C Partners LOGI2C is a model for how DHS S&T and industry can work together in a publicprivate partnership to address a critical R&D need Industry contributes Requirements and operational expertise Project management Product vendor channels DHS S&T contributes Independent researchers with technical security expertise Testing facilities 8 November 2005 52

S&T and Cyber Storm Exercise Objectives: To incorporate elements of cyber defense and response technology into the exercise moving it gradually away from the “table top” format. To socialize the DETER test bed with the exercise participants and make them aware of its capability and its potential value to their respective organizations. Success criteria: Recognizing the complexity of the exercise and its key focus, S&T would consider their objective met if the DETER test bed were used in the planning of the exercise (to lend realism to scenario elements) and if one or more session can be arranged during the exercise, where the players could see the test bed in action being used to test exercise relevant problems or decisions. The session(s) should show the value of the tool and add defensive technology to the exercise. 8 November 2005 53

National Critical Infrastructure Exercise (NCIE) Exercise is co-managed by BearingPoint and Yoran Associates Objectives Funded by the private sector with public/private technology demonstrations Conduct a private sector exercise Exercise threat scenarios against SCADA operations Test and evaluate organizational plans, policies, and procedures Capture performance data to evaluate Critical Infrastructure Resiliency metrics and models – U.S. comparison against other countries Primary participants: senior operations managers and corporate executives from utility/energy sector Secondary participation: industry collaboration groups, government agencies, first responders, and others identified by primary participants during planning 8 November 2005 54

Commercial Outreach Strategy Assist commercial companies in providing technology to DHS and other government agencies Assist DHS S&T-funded researchers in transferring technology to larger, established security technology companies Emerging Security Technology Forums (ESTF) DHS Mentor / Protégé program Partner with the venture capital community to transfer technology to existing portfolio companies, or to create new ventures Government Funder/Customer Established Commercial Companies DHS Researchers Commercial Customers Emerging Commercial Companies 8 November 2005 55

Emerging Security Technology Forum ESTF held April 13-14, 2005 in Arlington, VA Opportunity to introduce government representatives to smaller-sized information security technology vendors with innovative technology approaches For this ESTF vendors presented and demonstrated current and emerging information security technologies that defend against DDOS and worm attacks Next ESTF to be held in May 2006 Topic: Identity Management technologies Audience will include industry and government 8 November 2005 56

Emerging Security Technology Forum Arbor Networks CounterStorm, Inc. Cs3, Inc. CyberShield Networks, Inc. Determina, Inc. ForeScout Technologies IntruGuard Devices, Inc. Kerio Technologies netZentry, Inc. Prolexic Technologies Q1 Labs Inc. Top Layer Networks, Inc. V-Secure Technologies 8 November 2005 57

DHS Mentor/Protégé Program Objective Provide start-up emerging security companies with mentor support in sales & marketing to government Existing Mentor/Protégé programs in government are procurement oriented. New S&T Mentor/Protégé program will focus on rapidly transitioning cyber security technologies into government through existing relationships. Mentors will be large, established government contractors with cyber security experience Protégés will provide innovative cyber security technology. There are no set-aside requirements (e.g. disadvantaged, HubZone business) Selection Process The Cyber Security R&D Center will solicit government/industry technology requirements to identify gaps in the US cyber infrastructure. These requirements will guide selection of mentors. Protégés, with technology to meet infrastructure gaps, will be proposed to the mentors by the Center. 8 November 2005 58

ITTC – The DHS-SRI Identity Theft Technology Council ITTC is a revived and expanded Silicon Valley expert group originally convened by the U.S. Secret Service Experts and leaders from Government Financial and IT sectors Venture capital Academia and science ITTC works closely with The Anti-Phishing Working Group (APWG) Consultant and ITTC Coordinator: Robert Rodriguez, retired head of the Secret Service Field Office in San Francisco The ITTC was formed in April, and has four active working groups: Phishing Technology Report Data collection and sharing Future threats Development and deployment 8 November 2005 59

Tackling Cyber Security Challenges: Business Not as Usual Strong mission focus (avoid mission creep) Close coordination with other Federal agencies Outreach to communities outside of the Federal government Building public-private partnerships (the industrygovernment *dance* is a new tango) Strong emphasis on technology diffusion and technology transfer Migration paths to a more secure infrastructure Awareness of economic realities 8 November 2005 60

Summary DHS S&T is moving forward with an aggressive cyber security research agenda Working with industry to solve the cyber security problems of our current infrastructure DNSSEC, Secure Routing Working with academe and industry to improve research tools and datasets DHS/NSF Cyber Security Testbed, PREDICT Looking at future RDT&E agendas with the most impact for the nation SBIRs, BAA 04-17, RTAP 8 November 2005 61

Other Areas of Interest (were available) Cyber Situational Awareness – Indications & Warnings Insider Threat Detection & Mitigation Information Privacy Technologies Large-scale network survivability, rapid recovery and reconstitution Secure operating systems (open source) Network modeling and simulation – security policy reconfiguration impact on networks Highly scalable identity management 8 November 2005 62

Douglas Maughan, Ph.D. Program Manager, HSARPA [email protected] 202-254-6145 / 202-360-3170 8 November 2005 63