Introduction to National Critical Infrastructure Cyber Security: Background and Perspectives


Published on

Given at SOURCE Boston 2013, this presentation is one of the only places you will find the conceptual and policy underpinnings of U.S. national cyber security and critical infrastructure protection efforts and information about the recent White House Cyber Executive Order

Published in: News & Politics
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • Cyber ….why is cyber so visible? News, failures, money (congress!), sexy, responsibilitiesToday going to focus on gov involvement what it’s good for (or not), offer some advice, etc…can extrapolate to media and self and etc6. What are some simple things to know ahead of time that I might not already?There are laws, mandates, and programs on the books now and have been for years.  This includes strategic planning, incident response, information sharing, and engagement.major players in industry have been actively engaged in the dialogue so far – even if you haven't nec been aware of it. There have been certain cultural, process, political, perception, legal, and conceptual barriers to progress despite existing work and engagement.  The Executive Order attempts to rectify these barriers while keeping in tact most of the fundamental structures already in place.I'm not here to teach, rather to frame…or to lens…the topic in a way that improves dialogue at the second half of this talk and when we leave here. …thereby enhancing our ability to work together on this collective problemSo, first we need to talk a bit about what the government interest is. Keep in mind, some of this will seem obvious, but sometimes primary colors are the best to start with
  • So, that said, the primary colors here start with identifying what is being (or should be) protectedFor these purposes, I think in terms of: Customers (or citizens, but they're customers of the gov), Individual Businesses, National Infrastructure, Government infrastructure, and National Cohesion.Customers: Soft & Hard interests (economic/free speech vs safety/mobility..etc)Individual Businesses: There are also collective interests, but here Im calling out individual sets of prioritiesGov Infrastructure: Sort of a peer in this case to individual businessesNational Cohesion: The ability for the nation to function. This includes stable and safe markets, the ability to conduct business, freedom of mobility, manufacturing, water supply, coordinated responses to threats, etc
  • So, that said, the primary colors here start with identifying what is being (or should be) protectedFor these purposes, I think in terms of: Customers (or citizens, but theyre customers of the gov), Individual Businesses, National Infrastructure, Government infrastructure, and National Cohesion.Customers: Soft & Hard interests (economic/free speech vs safety/mobility..etc)Individual Businesses: There are also collective interests, but here Im calling out individual sets of prioritiesGov Infrastructure: Sort of a peer in this case to individual businessesNational Cohesion: The ability for the nation to function. This includes stable and safe markets, the ability to conduct business, freedom of mobility, manufacturing, water supply, coordinated responses to threats, etc
  • Generally…and I know this is a ROUGH generalization, responsibilities for security break out something like this:The military protects national sovereignty DHS protects national cohesionFBI protects customers and business through a prosecute/convict missionState & Local government organizations (and Natl Guard) focus on providing geographically related supportIn all cases, contestable threat vectors (ie “geography”) define when where & how these groups operate.
  • But then we add cyber.
  • Even though we’re talking responsibilities, not code, still need a protocol stack because…Stick figure diagramSo let’s move beyond primary color type stuff (and I know I havent been using only primary colors in the deck, everything is always a shade of something else 
  • Sneak Peak at Risk Rainbows
  • Basic risk lifecycle…mention this is official….but will get to it
  • Two-tier risk lifecycle diagram
  • Basic 5-tier diagram (series will be after nipp, partnership, etc)…at the end “ok, now we’ve got some reference space…lets look at old guiding policies to critical infrastructure, then we’ll talk updates…then we’ll look at what you might have heard…and then we can move into discussion/advice…comments…etc
  • Basic 5-tier diagram (series will be after nipp, partnership, etc)…at the end “ok, now we’ve got some reference space…lets look at old guiding policies to critical infrastructure, then we’ll talk updates…then we’ll look at what you might have heard…and then we can move into discussion/advice…comments…etc
  • DHS shall protect crit infrastructure, (explain the interest here…assurance of protection would be a better word…this is DHS…so they're on the hook for COHESION here, not your businesses…protecting individual points not their mission, but the ability of US to operate. In other words, they need to assure certain consequences don’t occur – whether you do it or they do it…and consequences are nationally catastrophic (hard or soft)
  • identify prioritize, report: Formal Risk Mgt Lifecycle…resp for getting sectors to implement…and SSP/SAR
  • There shall be sectors
  • There shall be agencies supporting sector specific stuff: interesting because other regulation from some agencies and other agency-specific (non DHS mechanisms). More in a bit
  • identify prioritize, report: Formal Risk Mgt Lifecycle…resp for getting sectors to implement…and SSP/SAR
  • Will use partnership: Regulation vsformal pub/priv partnership …incentives…why you don’t hear a lot of this dialogue. Partnerships been going on for a long time, but not for public discourse – protects industry (not classified tho)
  • identify prioritize, report: Formal Risk Mgt Lifecycle…resp for getting sectors to implement…and SSP/SAR
  • Info about ops orgsOther Players: Ops/Intel/TechSec: NCCIC, ICS-CERT, CISCP (and subsequent slide-single)…Exercises (Cyberstorm, NLE),
  • A note about info sharing (from grid lined paper)
  • Our joint SSA/Industry strategy used this model (when I was a fed): Raise awareness, in order to gain participation in pub/priv partnerships, to develop the context, for improving ops & sharing (DHS, industry, whoever), in a sustainable wayBut not every SSA is the same, and this was only philosophical guidance
  • 1. What is the Executive Order and why was it issued?This is a two prong answer. First, obviously it was absolutely a political goad to congress to write legislation and to poke at the Republicans. However, more importantly, it is also potentially a very valuable order that was seriously thought through and that will be used.Think of it like a mother (the White House) telling kids (DHS, SSA’s) to “clean up the house”.  Based on existing house rules (overarching critical infrastructure directives/laws), she expects it will be done and goes off to handle other things.She comes back to find out that the kids of swept once or twice then went on to xbox, pushed stuff under the bed, or made more of a mess of the toy box trying to clean it than it was before.Mom comes back and says “Ok, I left you to your own devices, here are the specific ways – again within the larger context of house rules – you are going to clean up. In the case of cyber security, the White House has said: You – DHS and SSAs and everyone else – are going to remove barriers to information sharing, work with our customers (industry) to build some coherent approach to solving the problem to our satisfaction  – some standard way of organizing the whole mess, and you’re each (especially you SSA’s!) are going to create explicit privacy and civil rights protections or else you fail.
  • Sec. 4.  Cybersecurity Information Sharing. a) The US Government will pass more (unclassified) information than they already are, and from more sources, to the private sector faster so that they (industry) can better protect themselves. b) More about the rapid dissemination of these reports, but now mentions the ability to disseminate limited classified reports c)The government will enhance a new program (previously announced) to provide classified threat and technical information to qualified critical infrastructure companies (including commercial service providers who work with critical infrastructure) d) The intel community will speed up processing of security clearances for private sector companies with critical infrastructure e)Since actually becoming a fed is hard, and because not everyone wants to, there are initiatives going on – and which the EO directs to be hurried/expanded – to allow private citizen subject matter experts to come under temporary serviceSec. 5.  Privacy and Civil Liberties Protections.a) Agencies already have privacy/civil liberty offices and procedures in place. They must make sure any action they take in regard to the EO is done using those offices and procedures. b) DHS must make formally sure on a recurring bases that 5a) is indeed happening c) When DHS reports on this, it will consult with OMB (to provide another layer of oversight) d)Private entity information will be protected by the most protective interpretation of the lawSec. 6.  Consultative Process The government will engage with private sector stakeholders on all aspects of the EO and will utilize mechanisms that already exist and are currently being used to collaborate with industry on cyber security and critical infrastructure – particularly those outlined in HSPD-7 and DHS’s National Infrastructure Protection Plan Sec. 7.  Baseline Framework to Reduce Cyber Risk to Critical Infrastructure.a) NIST will lead the development of a framework to reduce risks to critical infrastructure from cyber systems.  The framework speaks to the process of reducing risk.  The framework is intended to make sure business efforts, policy efforts, and technical efforts are aligned and working together.  The framework will incorporate existing standards and best practices as much as possible (clarification: NIST has said here that they mean interoperability/common frame of reference type standards, not performance or measurability focused standards. Ie, the intent of the standards is to help everyone work together.)b) The framework is *process focused* and intended to deal with the fact that this is the real world; it’s goal is to work collectively to figure out the best ways to reduce risk – the process is the focus, not the results. “The journey is the destination”.  The framework will include ways to measure how well organizations are participating in the process.c) The framework will explicitly include ways to protect business interests and civil libertiesd1) This process will be as inclusive as possible. Government required to show up to the table and government required to engage industry as much as industry is willing to participate.d2) The government will provide outcome goals for the framework based on critical determinations made in section 9 (the intricacies of this are a bit out of scope of this review. Suffice it to say that there is already existing work here being done and existing processes already in use that will most likely be used to fulfill this requirement.). This is assigned to the heads of relevant agencies, which means its a performance criteria for those individuals, which means it will get done.e) a preliminary version of the framework will be done in 240 days, final in a yearf) The process of engagement and validity of approaches will be reviewed regularly for appropriateness in addressing cyber securitySec. 8.  Voluntary Critical Infrastructure Cybersecurity Program.a) There will be a program (outreach & engagement?) to encourage private sector adopting the framework processb) The agencies already on the hook for industry engagement for critical infrastructure (sector specific agencies – SSAs – under HSPD-7 and the National Infrastructure Protection Plan – NIPP) will use their existing mechanisms (like CIPAC) to reach out to industry on a sector by sector basis and address sector specific risks and concernsc)The Sector Specific Agencies will let the president know annually how this is all going – is industry participating or no?d)the government will try and create additional value for industry to participatee) The government will try and figure out how – or if it even makes sense – for the government to adjust its procurement and contracts to use/fit in with the frameworkSec. 9.  Identification of Critical Infrastructure at Greatest Risk.a) Within 150 days, DHS will determine, based on potential national consequences from a cyber attack, what infrastructure is critical.  This speaks to a consultative process (as described in section 6) that the government will use to identify what the framework and the rest of the Order is aimed at. I’ve been working within one industry for some time using a version of the process that will be used here. The process uses business-function driven risk analysis to determine priorities: Critical Functions->Value Chain->Supporting Cyber Infrastructure->Program level vulnerabilities->Scenarios to be protected against. Ish.b) The sector specific agencies will, in line with their existing role, provide DHS with enough information to make these determinations. The EO assigned this to the heads of the sector specific agencies, in particular, and so it is a performance criteria for them. This tends to mean it will get done.c) Owners and operators of critical infrastructure will be confidentially notified of their status as critical infrastructure and there will be a mechanism for them to ask to be reconsideredSec. 10. Adoption of Framework (Read: Potential Regulation)a) Agencies who can currently regulate will look at any new information provided by the preliminary framework and determine if the way they are currently handling regulation is sufficient based on framework identified risks (my note here: TSA has, in the past, declined to regulate because industry was actively participating already. This directive does not make future regulation a given).b)If current regulation isn’t sufficient, regulatory agencies will propose actions.c)within two years, agencies will work with owners and operators to determine if any new regulation is ineffective or excessively burdensome and will make recommendations for relief/changesd) DHS will help out any agencies who don’t have the technical cyber qualifications to do this effectivelye) Regulatory agencies that aren’t sector specific agencies should consult with everyone and get on board, tooSec. 11. Definitions (Speaks for itself. Read these without translation)(a) “Agency” means any authorityof the United States that is an “agency” under 44 U.S.C.3502(1), other than those considered to be independentregulatory agencies, as defined in 44 U.S.C. 3502(5).(b) “Critical Infrastructure Partnership Advisory Council”means the council established by DHS under 6 U.S.C. 451 tofacilitate effective interaction and coordination of criticalinfrastructure protection activities among the FederalGovernment; the private sector; and State, local, territorial,and tribal governments.(c) “Fair Information Practice Principles” means the eightprinciples set forth in Appendix A of the National Strategy forTrusted Identities in Cyberspace.(d) “Independent regulatory agency” has the meaning giventhe term in 44 U.S.C. 3502(5).(e) “Sector Coordinating Council” means a private sectorcoordinating council composed of representatives of owners andoperators within a particular sector of critical infrastructureestablished by the National Infrastructure Protection Plan orany successor.(f) “Sector-Specific Agency” has the meaning given theterm in Presidential Policy Directive-21 of February 12, 2013(Critical Infrastructure Security and Resilience), or anysuccessor.
  • 3. Could this in any way infringe on individual freedoms if misinterpreted?The short answer is “not any more than before”. DHS messaging is that privacy and liberty assurance is one of the three primary focuses of the EO. The Executive Order relies on existing government privacy and civil liberties mechanisms and embeds them throughout the order. Whether or not you think those mechanisms were sufficient is one question, but the EO doesn’t make them worse or better.10. What guarantee do we have to transparency in any of this?Workshops kick off in April.  NIST has questions to industry on its website and will be reaching out further (more proactively than “on the website”) in the near future. If you read my earlier NIST post, you’ll see transparency and participation are core, not tangential, tenets here and are one of the things that will (or is intended to at least) distinguish this from past efforts. Further, if you have been on any of the DHS calls with industry, every single conversation revolves around getting more and better industry involvement. They are very serious about it.  Finally, in my own work with some of this (which is tangentially related), transparency and engagement have been priorities I’ve seen.11. Indeed it’s written with the basis that Government will continue to be the determining data librarian for cyber threats.Over and Over and Over industry tells gov “we need better threat info”.  Most of EO not dealing with the framework is written to that end – it primarily deals with pushing data TO the private sector because they have requested it. However, post-order messaging has (correctly) been: Look, we don’t have a classified pot of information at the end of the rainbow that’s going to save the day. Industry, you guys know about yourselves way more than we do – or you should.  If you don’t share, that’s fine, but we can’t help you unless you help us to do it.I don’t like the disproportionate focus on Information Sharing. I think it’s a waste of time, but we collectively have created this stupid beast. I might be a red herring, but it’s our collective red herring.This deserves a longer treatment than a couple of sentences, so come see me talk about it at SOURCE Boston12. Why is the Cyber EO so obtuse? And while the PPD adds context – it’s clear that we require more (and more) clarityMuch of the obtuseness is because a) some is to be defined later by b) federal agencies who will get very clear direction from those in the WH charged with implementing the EO within the context of c) existing language on the books and in response to d) specific beefs from industry and dialogue failures in the past. What most people lack is the appropriate context from which to interpret it, since most people are not critical infrastructure owners and operators or feds who have been engaged in the discussion. Much of the insight I'm trying to provide here isn’t direct experience with the EO itself, but the cultural language which has developed in the civilian space on the topic of critical infrastructure protection over the past several years.  It’s not understood well outside of Washington, but those it is speaking to understand it.  This is a huge problem and one I’ll try to address in Boston13. Is this more of the government telling private sector they’re coming?Gov’t is already there: HSPD-7, NIPP, SSA’s, CIPAC, CSCSWG, CNCI, NCCIC, foobar.   Regulatory capability already there: TSA, DOE(NERC CIP), etc. This EO speaks to and sorts out this *existing* stuff in one prong and tries to sort out information sharing barriers in another prong (barriers which, right or wrong – mostly wrong – industry has cited over and over and over as the reason their cyber sucks)14. Why do we have any faith that Government has the agility and consistency to get it right this time?We don’t. but, the way the framework components are laid out, we have an interesting opportunity to force it to work by the order’s focus on creating real consensus business-driven requirements. In particular, I believe cyber security is a quality assurance problem over unbounded time driven from business priorities and is almost 100% a human-centric problem.  There might be space here for that conceptual shift to occur.  More on that later, possibly in Boston15. Should the Cyber EO have been so broad? Look at the “Designated Critical Infrastructure Sectors and Sector-Specific Agencies” list in the PPD.Don’t forget that the PPD is based on years old definitions and, more importantly, is an all-hazards list primarily focused on physical attacks. In large enough scale, most things are critical in the terms of the broader discussion.The trick is, for cyber, determining what within those spaces is critical. It’s a different functional discussion – as this is all laid out – than which sectors are critical. That’s handled in a process – a version of which I’ve been facilitating at a sector level for the past year – that is designed to base decisions on business driven threat scenarios.  It’s not perfect, but it’s a huge improvement from past methodologies.16. If and only if (IFF) the Cyber EO was really meant to get action to answer these questions – then it should not have been issued so broadly, so politically charged, and otherwise tied to SOTU the way it was.Agree. It’s over-politicized – but that gets into questions of its effectiveness and clarity in the current political and cultural environment, and that’s out of scope here.17. Why not leverage the bodies of work existing up-front?Because the process of engagement in finding and applying those existing bodies of work is the key element of this part of the EO, not the outcomes themselves. It’s an attempt to build in continuous flexibility and applicability in changing environments and compared to differing and dynamic priorities.  Think “it’s not the destination but the journey” here and add on “and the requirement to iterate through multiple journeys as a lifestyle”. The mechanism NIST and the collective gov builds to continuously engage industry in the development and adaptation of the framework are where our real opportunities to make this valuable come in – but we need to work together coherently. More in this in Boston.Also see this document from NIST: What makes this a compelling DHS issue instead of economic development, science, or other component of Government?Because the EO can only really address already existing legislatively assigned authorities. This EO is a goad for further legislation, and that might change the agency assigned responsibilities. That said, I actually agree this should be a DHS issue – no other agency has the type of broader mission required to effectively coordinate cybersecurity in the broad terms it requires – NSA would be one of the worst choices, since their core mandates are, in many cases, only of use in terms of focused support.  Think correlation with physical and geographically dispersed response and coordination.  The FBI, similarly, would be a terrible choice since their mandate is “prosecute and convict”.19. What about regulation of industry?There are a number of agencies who *already have* regulatory authority over private sector critical cyber infrastructure – some have used it, some haven’t. The EO asks that they use the new processes in the EO to reevaluate whether they should regulate and how if they don’t now and the effectiveness of any regulation if it’s already in place. Every two years, the government is required to check with industry to make sure any regulation is a) effective and b) not too burdensome.  In my opinion (based on work with some of the processes which will be used),  this is much less likely to result in additional regulation than is suspected. (This is because the processes attempt to be more empirical and data-informed than the more speculative and subjective attempts in the past.)20. Why haven’t I heard about any of this and why does it not resonate with me?So much of this has been driven by lobbyists and industry associations….unfortunate in many cases…but almost impossible to get substantive input from more fair representation.  The reasoning behind this is something I’ll cover in Boston and it’s something we need to culturally change together – and we can.
  • 4. What will the “Framework” described be? Based on comments from NIST: The framework will includewhatever will achieve effective cyber: processes, technologies, architectures, concepts, specifications, etc.  It is intended to be layered and include broad principles, common practices, and sector specific realities.The role of NIST is to support the industry development of the framework.  The government will depend on the actions of the private sector after sharing, up front, performance goals. NIST is being engaged because it has experience gathering lots and lots of input, but this will NOT be a typical NIST thing.The aim of the framework approach is to enhance adaptability, with cost and impact to economics of business being an integrated explicit part of the conversation.Additional benefit is that, by increasing interoperability of requirements, concepts, expectations, etc, baseline security can be driven to market/products (my comment: which has been a vendor/industry complaint often voiced)Moreover, a goal of the EO – both in context of information sharing and the framework – is harmonization of efforts (this was repeated extensively and resonated with my experience in the dialogue) – particularly nby the federal government (which, again, has been a substantial private industry complaint).5. Standards? What is meant by standards? That sounds scary!Not as much as you’d think. Based on comments from NIST: Generally, common basis of comparison…some are performance…but some are norms to promote collective collaborative action. These latter are developed by industry and what the EO is referring to. In other words, the Framework of Standards is meant less to be comparative and more to allow everyone and everything to be working together.  (Jack’s note: I’ve said for years there should be a Chinese menu of options selectable by environment and risk, this looks like it might be going down that path).
  • Bring it all together with several slides using 5 tiered model
  • Introduction to National Critical Infrastructure Cyber Security: Background and Perspectives

    1. 1. Cyber MomentumUnderstanding & Leveraging theNational Cyber Security Policy DebateJack Whitsitt | | @sintixerr | http://sintixerr.wordpress.comVice President of REDACTED at Energysec |
    2. 2. About me…• Broad Background– Lived in a little hacker compound as a kid– Started with Open Source development (Rubicon03)– MSSP:IDS, Data Viz, Anomaly Detection Designer– Enterprise Security Architecture– ICS-CERT (INL)– Fed with Nationally-scoped cyber responsibilities• Now– Non-profit Community Builder & Facilitator– Focus on Electric Sector
    3. 3. Why this talk?• Deluge of Debates and Discussion– Media Hype, Political Wedge, Money Fountain, Actual Problem– No Culturally Accepted Vision• Today’s Keynote: Geer/Thieme/Corman• Laws & Mandates on Books, but poorly understood– Have you ever tried to READ any of it?– Even the people doing it don’t always get it• Serious Barriers– Grab bag of security ideas, no structure– Players not always informed of “State of Play”– Different culture groups (“Product Developers” – Kim)• Opportunity– To cause more problems or…to stop losing– Will be lost without wide engagement and forward motion• Not a History Lesson: Google for details– Meant to frame – or lens – a more productive dialogue
    4. 4. Why should you care?• It could be fun– You get to learn a new problem space– National Cyber Security is only distantly andtangentially related to “computer security” as youknow it– Doesn’t mean hacking isn’t involved– It just means you have to think bigger• This will effect you– Not explicitly: Culturally & Scope Creep– “National Security State” (Geer/Thieme)
    5. 5. First Some ObviousnessBut it’s leading somewhere…
    6. 6. Obviousness: Customers• Citizens• Individual Businesses• Industries• National Infrastructure• Government infrastructure• National CohesionOverlap.
    7. 7. Obviousness: CTVs• Contestable Threat Vectors (CTV):– Provide defendable space between “badguys” and targets– Imply that there is a space that is *not* thetarget that must be traversed beforehand– “Domains” is used too often IMO• Historically…– Earth– Air– Water– Space (for some value of historically)
    8. 8. Obviousness: ResponsibilitiesGovernment “Security”apparatus responsibilitiesheavily influenced bygeography• The military protects nationalsovereignty outside the U.S.• DHS protects national cohesion;operates on U.S. as a whole• FBI specific aspects of internal U.S.interests• State & Local governmentorganizations
    9. 9. Obviousness: Along Came A Cyber• “Cyberspace” comes along; screws things up– Cyber Assets: Targets AND part of a CTV– “Customers of Protection” now own a CTV– Geographic Protection Schemes break– Opaque by Default• But can have consequences in other CTVs– So we can’t ignore old physical policymechanisms– “National Guard” example• “Critical Infrastructure” here but can be usedwith a lens to provide other views
    10. 10. Object Oriented PolicymakingCreating a Lens
    11. 11. Cybersecurity has natural parenthetical ScopesEVIL GOOD!I want to stealhazardousmaterials!Ok, we’ll attack TrafficLight Controls andmake trucks stop!Metasploit tothe rescue!Boss BobCyber Planning BobHacker BobI want to keepmaking $123 a day!Let’s make sure ITenables $123/dayCEO JimIT Architect JimIDS to the Rescue!Security Jim“Technology”
    12. 12. “Object Oriented Policy Making”• Failure to scope cyber topics appropriately– Wrong parentheticals• Grab Bag Problem– Good ideas scattered everywhere – neither relatednor consistently relatable• Cyber security as a practice domain can betreated like a large algorithm• A simple protocol stack will help us get the rightview into that algorithm• If we don’t have a common view, we our codewon’t execute
    13. 13. Maybe too detailed? Start smaller.
    14. 14. Simple Risk Management LifecycleScoping is not defined.This is a mistake, even at a high level.(Yes, this is/was in use nationally  )
    15. 15. More helpful: Linked LifecyclesRisks FROM Systems (Cyber)Risks TO Systems (Cyber)
    16. 16. Risks From Cyber / Risks To Cyber• “Risks from”• Business & Non-Cyber• Long view• Evaluated regularly• Frames “Risks to” and makesactionable• “Risks to”• Technical & Implementation• Dynamic, Rapidly Changing• Should be reevaluated often• Context provided by “Risks From”• Linked Lifecycles allow alignment ofstrategy and tactics while de-conflictingperspectives• Allows strategy to influence ground actionand, where pertinent, vice versaHelpful to understand government’s activity(Even if they don’t always)
    17. 17. A Cyber ManagementProtocol Stack• All layers depend on the ones aboveand below for success• Provides common terms• Structures & Enables discussion• Allows narrow focus in problemareas• Highlights completeness• Will use this later
    18. 18. A Cyber ManagementProtocol Stack• National Security Assurance– Assure Nation will continue; Diplomacy;Military• Business Environment– Define Common Business Outcome Goals forCyber security; Describe Environment;Create Common Lexicon• Capability Management– Evaluate capabilities against organizationalgoals; prioritize resources and investments;adjust capabilities in response to ops data• Control Management– Evaluate conceptual application of bestpractices, standards,• Operations & Testing– Compare conceptual control placement toactual configurations and threats
    19. 19. Now that we have a lens…National Underpinnings of CriticalInfrastructure and Key Resources(CIKR) Protection
    20. 20. Primary Documents: HSPD-7/NIPP• “Homeland Security Presidential Directive-7”– Bush. Builds on earlier directive from Clinton– Assigns Critical Infrastructure Protection to DHS• National Infrastructure Protection Plan (NIPP)– DHS Plan for Implementation of HSPD-7• “All” Critical Infrastructure, not just Cyber– Most of the people traditionally involved are *not* cyber– This isn’t entirely wrong, but causes public disconnect• They do require cyber-specific actions from DHS– Confusing. One of the reasons for the EO••
    21. 21. HSPD-7 Policy Statement“It is the policy of the United States to enhance the protection of ourNations critical infrastructure and key resources against terrorist actsthat could:• Cause catastrophic health effects or mass casualties comparable tothose from the use of a weapon of mass destruction;• Impair Federal departments and agencies abilities to performessential missions, or to ensure the publics health and safety;• Undermine State and local government capacities to maintain orderand to deliver minimum essential public services;• Damage the private sectors capability to ensure the orderlyfunctioning of the economy and delivery of essential services;• Have a negative effect on the economy through the cascadingdisruption of other critical infrastructure and key resources; or• Undermine the publics morale and confidence in our nationaleconomic and political institutions.”
    22. 22. HSPD-7 Policy StatementRealSpeak Summary:The U.S. will protect the infrastructure supportingNational Cohesion” in Partnership with IndustryExperience says:• “Protect” doesn’t have to be active• “Protect” really means “Assure Security”• “Assurance” starts with measuring and only continuesto protecting *if* the measurements fail• Industry: Hint. Hint. Hint.
    23. 23. Primary HSPD-7/NIPP Goals• Identify Critical Infrastructure• Prioritize Infrastructure• Protect• Report on Progress• This means: Create specific plans to, in voluntarycooperation with industry, implement the NIPPRisk Management Lifecycle and report annually
    24. 24. Dividing Ownership• US Government (HSPD-7/NIPP) splits Critical Infrastructureresponsibilities into 16 “Sectors”• Each “Sector” is assigned a “Sector Specific Agency” (“SSA”)• Assignments are done at a a Department level– Some departments assign SSA responsibilities to sub-organizations (e.g. DHS assigning Transportation to TSA)Chemical: DHS Financial Services: TreasuryCommercial Facilities: DHS Food and Agriculture:Agg/HHSCommunications: DHS Government Facilities: DHS/GSACritical Manufacturing: DHS Healthcare and Public Health: HHSDams: DHS Information Technology: DHSDefense Industrial Base: DOD Nuclear: DHSEmergency Services: DHS Transportation Systems: TSA/DOTEnergy: DOE Water and Wastewater Systems: EPA
    25. 25. Sector Specific Agency ResponsibilitiesEncourage organizations with information to share with those who need itand encourage development of sector information sharing programs andmechanismsPromote education, training, and awareness within the sector incoordination with other government and private sector partnersIdentify, prioritize, coordinate federal CCIP activities in sectorAppraise congress of sectors current status and progress in reducing riskand implementing the NIPPIncrease integration of cyber security efforts with other all hazardsprotection and response programsDevelop and implement sector risk management program and frameworkand use to determine risk priorities of sector and coordinate riskassessment and management programsSupport Ad-Hoc DHS data callsPromote cyber awareness of owners and operators and program levelguidance for CIKR protectionThe DHS “Infrastructure Protection” (IP) organization is responsible forcoordinating all of the sectors and assuring the NIPP is beingimplemented. (This can and has been problematic)
    26. 26. “Public/Private Partnership”• Formal Term, Formal Constructs– Used in many contexts• Foundation of Critical Infrastructure Protection inthe US• “Voluntary”, “Public”– (Limited? Trust issues)• Alternative is/has been Regulation• “Weight of Government Burnout” problems• This is important
    27. 27. HSPD-7/NIPP Partnership Model•The primary organizational structure for coordinating criticalinfrastructure efforts and activities.•Facilitates integration of all partners into planning & ops activities•Ensure a collaborative approach to critical infrastructure protection.•The SCCs and corresponding GCCs work in tandem to create acoordinated national framework for Critical Infrastructure protection andresiliency within and across sectors.
    28. 28. Sector Coordinating Councils (SCC’s)• The principal entities for CIKR owners and operators within asector to coordinate with the government• Include a broad base of owners, operators, associations, andother entities• Principal private sector policy coordination and planningentities• Participate in planning efforts related to reporting for theNIPP• For information sharing and response, often rely on ISACs andother non-SSA entities• Problem: This is probably the first time you’re hearing this(also: industry vs citizens)
    29. 29. Government Coordinating Councils (GCC’s)• The government counterpart for each SCC to enableinteragency and cross-jurisdictional coordination within asector• Includes representatives from various levels of government(Federal, State, local, or tribal) as appropriate• Co-chaired by a representative from the designated SSA andDHS IP (This causes some issues)• Coordinates with and supports the efforts of the SCC to plan,implement, and execute the Nation’s CIKR protection mission.• Provides interagency strategic communications, discussion,and coordination at the sector level• Participates in NIPP planning efforts
    30. 30. What is “CIPAC”?• DHS Construct: Critical Infrastructure Partnership Advisory Council• Provides a legal framework for SCC and GCC members to engage in jointCIKR protection-related activities• Operational mechanism of National Infrastructure Protection Plan (NIPP)• Provides membership to agencies across all levels of government and theprivate sector, including membership representing almost 50 percent ofthe Gross National Product of the United States.• Allows members of Sector Coordinating Councils (SCC) and GovernmentCoordinating Councils (GCC) to engage in cross-Sector, cross-governmentcoordination.• Key activities of the CIPAC include information sharing, national planning,and program implementation
    31. 31. CIPAC: Good & Bad• Good– No FACA, Not owned by government– Managed Engagement– **Must** Have SCC co-chair• Bad– Control issues (SSA’s don’t always like it)– Trust Issues (Northwest Rail story)
    32. 32. CIPAC Examples• Industrial Control Systems Joint WorkingGroup (ICSJWG)• Cross Sector Cyber Security Working Group(CSCSWG)• Transportation Systems Sector CybersecurityWorking Group (TSSCWG)
    33. 33. What about “real” cyber?• NCCIC• ICS-CERT• CISCP• NLE/Cyberstorm• US-CERT• ISACs
    34. 34. Aside: Government “Information Sharing”• “Incident Response” organizations are often regardedas “Information Sharing” ones– Must not forget distinction– Missions may conflict and impact sharing• FBI, Military, and the Intel Community also havepotentially conflicting missions• No Pot of Gold at the end of the Classification Rainbow• Information often classified due to sources and means,not content• Actionable REQUIRES bi-directional sharing
    35. 35. HSPD-7 & NIPP EnvironmentPublic/PrivatePartnershipResource CoordinationSector Coordinating Councils (Industry)Government Coordinating Councils Government Cyber-Specific OperationsCIPACCRADA/PCIIFed toFed
    36. 36. New Policies• Cyber Executive Order:– Aimed at Gov, Not You: Mom reigning in kids– Cyber was already supposed to have been being handled (aswe’ve seen)– Attempts to rectify these barriers while keeping in tact most ofthe fundamental structures already in place.– Heavy focus on “Harmonizing Cyber Efforts”  Awesome• Presidential Policy Directive (PPD-21)– Not Cyber specific – update to HSPD-7– Important• CISPA– Very narrowly focused on information sharing• Others. Let’s discuss?
    37. 37. PPD-21Three strategic imperatives shall drive the Federal approach to strengthencritical infrastructure security and resilience:1) Refine and clarify functional relationships across the Federal Government• Federal functions related to critical infrastructure security and resilienceshall be clarified• There shall be two national critical infrastructure centers operated by DHS– one for physical infrastructure and another for cyber infrastructure.2) Enable effective information exchange by identifying baseline data andsystems requirements for the Federal Government; and• Enable efficient information exchange through the identification ofrequirements for data and information formats and accessibility, systeminteroperability, and redundant systems and alternate capabilities shouldthere be a disruption in the primary systems.3) Implement an integration and analysis function to inform planning andoperations decisions regarding critical infrastructure.• Shall include the capability to collate, assess, and integrate vulnerabilityand consequence information with threat streams and hazard information
    38. 38. Whitehouse Cyber Executive OrderMain Thrusts:– Improve Information Sharing– Use business-function driven riskanalysis to determine priorities– Create a framework of standardsfor reducing risks from cybersecurity issues to criticalinfrastructure– Engage industry tothe greatest extent possible, andassure privacy and civil liberties areembedded in the entire process.White HouseDHS/SSA’s
    39. 39. Executive Order: Section Analysis1. – 3. Fluff4. Cybersecurity Information Sharing5. Privacy and Civil Liberties Protections6. Consultative Process7. Baseline Framework to Reduce Cyber Risk to CriticalInfrastructure8. Voluntary Critical Infrastructure Cybersecurity Program9. Identification of Critical Infrastructure at Greatest Risk10. Adoption of Framework (Read: Potential Regulation)
    40. 40. Executive Order: Concerns• Could this infringe on individualfreedoms?– “Not any more than before”• Do we have any guarantee oftransparency?– So far: Chaotic Good• The government wants my data?– Yes. Because they need your data tomake theirs actionable for you. Butthat’s not “the point”• Why so obtuse?– Right ideas. Poor Messaging.– Married Couple Analogy• I don’t want the government in myspace– They just need to “assure” theirmission– It is possible for industry to keepinterference to a minimum• No faith in government agility toget it right– Crickets. Real Problem. Will impactsuccess.• Should it have been so broad?– Built into the EO is a process to focus it.It’s actually at the right level• Isnt this just a political goad?– Not just. Smart people have worked on it.Useful (Possibly).• This preempts legislation orignored existing work– No• Why is this a DHS issue?– National cohesion IS DHS’s mission –cyber just a part. There is no “singularlycyber” mission. Others have other takeson cyber mission• What about regulation?– This situation might have gotten a littlebetter, more dynamic
    41. 41. Executive Order: NIST FrameworkThis is so amorphous yet so crucial,I’m mostly just going to talk to y’all about it“Framework to Achieve DHS specified Performance Goals”Industry Driven“All Inclusive”Standards vs StandardsSome VisionLost in TranslationEO Performance GoalsBalance Rails, Quality Assurance, Soylent Cyber is People!
    42. 42. Executive Order Status So far• DHS has something like 25ish deliverables to theWhite House– Insane timelines– Has formed working groups• Some internal, some public– One is “Cyber Dependent Infrastructure IdentificationWorking Group” (CDIIWG)• Responsible for Executive Order Section 9– Most of DHS’s deliverables do not *require* industryengagement• Informed by it via SSA’s and scheduled industry meetings
    43. 43. NIST Framework Status So far• NIST has to manage Industry Input intoFramework– Kick-off meeting already, 700+ attendees pluswebinar– Next one in Pittsburgh 5/29-5/31• No announced registration mechanism– Put out RFI out and received responses• All over the board• This could be better• We need better rails
    44. 44. CISPA• An executive order cannot change already legislative assignedfederal responsibilities• CISPA handles legal aspects of:– Remove legal barriers to information sharing– Addressing specific problems associated with industry cybersecurityneeding to intersect with the intelligence community.• My experience as a Fed was that barriers CISPA attempts to doaway with were ones often cited by Industry Reps as what theyneeded.• Intent legit, but details? …
    45. 45. Overheard…but wrong• Talks about “which ports are/arent open” being thetype of focus of the NIST framework• Refers interchangeably to home cyber and criticalinfrastructure;• Mistakes “compliance” standards with“interoperability”• “Obama bypassed congress & signed the CyberSecurity Executive Order. Meaning there is no privacy.We now have a dictator, boys and girls.”• “Obama passed a secret cyber order – he embargoed itfrom the press”
    46. 46. Time for a Real World ExampleUsing the Lens to create a View
    47. 47. Government Tools• CARMA: A Risk Management Approach• CRR: A Cyber Resiliency Model• CSET: A Cyber Evaluation Tool• ES-C2M2: A Maturity Model• RMP: A Risk Management Approach• NIST Cyber Framework: Standards• Executive Order: Better Cybersecurity
    48. 48. This year I had the following discussion with acritical infrastructure sector:Them: “which one of those should industry use or get involved with.”Me: “All of them”Them: “But we don’t have time, whats the best?”Me: “But they do different things!”Them: “It doesn’t look like it…”What. The. Hell.Wait! We have a protocol stack…
    49. 49. Clearly, thequestion madeno sense whenyou look at astructuredperspective –they all suitdifferent needs.The model showed thetypes of needs, howthey fit together, andprovided a commonreference for “CyberSecurity”
    50. 50. (A bit about those tools…)• CARMA– DHS Cybersecurity And Risk Management Approach– Sector-wide model of business-function and value chain driven risks– Ties business models and cyber infrastructure– No individual business details– Being used in Executive Order process to determine performance goals for NIST Framework• ES-C2M2/CRR– Electric Sector Capability Maturity Model / DHS Cybersecurity Resilience Model– Both look evaluate business maturity and progression in capability domains– Neither provides performance goals or context– Management link between strategy and execution• RMP– DOE Risk Management Process– Slots both into the risk management domain and overlaps everything• DHS CSET– DHS Control Systems Evaluation Tool: Control Catalogue Application Evaluation• Tallinn Manual– Not a gov doc – academic even if NATO – but speaks to international law
    51. 51. National Cyber Security is aboutStructured, Clear CommsClosing Thoughts
    52. 52. Leveraging Dialogue• Define the Space• Control Language (0-day example)• Manage Perception• Make Like Eminem• Treat the Government Like a Computer
    53. 53. Off the rails discussions..– Cyber war• The Earlier Rainbow Diagram Helps– Regulation• Views– Sector Progress & Reporting (Gov & Media)• Grab Bag again– NIST Framework• No algorithm (problem statement)MUST improve the quality of the dialogue
    54. 54. More Advice & Truisms1. Actors are often irrational (thanks @selenakyle)2. Guys with Guns aren’t Generals3. Cyber security is a human QA problem4. Our businesses are both targets and part of a CTV5. Winning needs more than holding a line; improve the world6. Momentum needs rails, so be clear; use a protocol stack7. Corollary: We will not accomplish anything with a multitude ofvoices. Use common model to create a common voice8. The government *must* fix a Cyber Commons Tragedy9. The government is not omniscient; dont treat it like it is10. Corollary: Resources are limited; don’t keep 911 busy11. Do you really want the gov in your ops?12. What we’re doing isn’t working. (Yet?)
    55. 55. Discussion…• Now that we have a common framing and have criticalinfrastructure policy underpinnings…– Concerns?– Questions?– Advice?– Corrections?– Derision?• Also, Discuss?– “DevOps at a National Level”– “Personal Liberty” / “Rights”THANK YOU Jack Whitsitt | | http://sintixerr.wordpress.comEnergysec |