Presented by: John Fleker, HP Abstract: The cyber threat landscape is continually evolving. More and more, the critical infrastructure of our nation is at risk. Whether by nation-state actors, criminal organizations, hacktivists or any number of hackers looking to prove their skills, our safety and economic prosperity is threatened. There are four things that must be considered in order to address the evolving threats: 1- Becoming more proactive in our cyber defense efforts through intelligence 2- Better user behavior management 3- Assessing risk using meaningful metric 4- Resilience – operating through an intrusion We need to look at the threat picture differently – in a proactive way – to ensure that CEO’s and CIO/CISO’s are on the same page regarding the threat, to allow those leaders to make better resourcing decisions and to be better prepared to mitigate adversaries when they arrive at the security perimeter. We need to integrate a wider set of intelligence into our thinking. This is critical to taking a more proactive stance in defending your networks. Combined with what you know of your own network, cyber intelligence strategically helps make solid resource planning decisions and functionally, helps your network operators better defend, mitigate and operate through cyber intrusions. The Operational Levels of Cyber Intelligence paper by the Intelligence and National Security Alliance details a better way of using intelligence. www.insaonline.org/i/d/a/Resources/CyberIntel_WP.aspx Additionally, we must increase info sharing across the board. Executive Order 13636 - Improving Critical Infrastructure Cybersecurity is leading critical infrastructure that direction.

1. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.
9thAnnual EnergySec
September 19, 2013 Denver
John Felker
Director, Cyber and Intelligence Strategy
Hewlett-Packard Enterprise Services
Dynamic Cyber Defense

2. © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.2
Potential industrial control intrusion or error?

3. © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.3
Key cyber consideration points
• Cyber threat landscape is continually evolving
• Critical infrastructure of our nation is at risk
• Nation-state actors, criminal organizations, hacktivists or script-kiddie hackers
• Nations safety and economic prosperity is threatened
• Four things to consider to address the evolving threats:
• Be more proactive in our cyber defense efforts through intelligence
• Better user behavior management
• Assessing risk using meaningful metrics
• Resilience – operating through an intrusion

4. © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.4
• View the threat picture differently – PROACTIVELY
• Ensure CEO’s and CIO/CISO’s understand threat the same way
• Allow those leaders to make better resourcing decisions
• Better preparation to mitigate adversaries at the security perimeter
• Integrate a wider set of intelligence into our cybersecurity thinking
• Critical to taking a more proactive stance
• Strategically - own network & open source cyber intelligence = better resource planning decisions
• Functionally - network operators can better defend, mitigate and operate through cyber intrusions
• Operational Levels of Cyber Intelligence paper - Intelligence and National
Security Alliance – helps define cyber intelligence
www.insaonline.org/i/d/a/Resources/CyberIntel_WP.aspx
Additional key cyber consideration points

5. © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.5
• MUST increase info sharing across the board –
• Executive Order 13636 - Improving Critical Infrastructure Cybersecurity
is leading critical infrastructure that direction.
• User behavior management policies and training only minimally
effective
• User base is one of the most vulnerable portals to intrusions
• poor user behavior can be prevented or at least improved
• regular, effective (“sticky”) interaction with users improves user behavior
• potentially makes your user base part of the security solution
Additional key cyber consideration points

6. © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.6
• A common understanding of risk and appropriate risk metrics is
vital
• Must understand/apply risk...it's more than just patches,
vulnerability etc.
• Must understand threats outside the network – capability, access &
opportunity
• Common metrics measure internal network hygiene efforts but
don’t address the value of the mission or intellectual property
• Risk metrics need to make sense to leadership...
• what's the business risk, not just the cost or network risk?
• what are the business operations metrics, in cost and in network exposure?
• how do changes in cybersecurity posture impact?
Additional key cyber consideration points

7. © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.7
• All systems need to be able to operate through an intrusion
• broad-based intelligence can help, but…
• understanding your network
• ensuring that “mission” operators and network operators are on the same page
• exercising both sets of people and systems against intrusions is the best way
to be resilient
• Smart grid resilience efforts provide a good model for IT supporting
the business to think about
Additional key cyber consideration points

8. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.
Questions?
Please contact:
John Felker
john.felker@hp.com
703.736.4040