Seacurity Hacking for Defense 2017

SeaCurity
Week 0
Problem: “USTRANSCOM lacks
criteria to evaluate the
prevention and resilience to
cyber-attacks of infrast...

The Team
Roi Chobadi Peter L. Higgins Darren Hau
Mentor Mentor
Benji Nguyen
Public Policy
Health Analytics
2017
Valerie Ha...

Interview Breakdown
97 Interviewees

-Identify possible
vulnerabilities and analyze
the outcomes of these risks
if they are carried through.
-Create protocol f...

-Identify possible
vulnerabilities and analyze
the outcomes of these risks
if they are carried through.
-Create protocol f...

Initial Thoughts (Week 0-1)
This problem space is enormous...

Initial Thoughts (Week 0-1)
It seems like a lot of research has been done already in
cybersecurity!
DHS
Coast
Guard
NIST

Initial Thoughts (Week 0-1)
TRANSCOM lacks a clear understanding of the
consequences of cyber attacks.
-D R Kenerley (TCJ6)

Initial MVP (Week 0-1)
Identification of
critical points
Map of port
facility

Initial Thoughts (Week 0-1)
There is already an existing visualization tool : DAGGER
-D R Kenerley (TCJ6)

Initial Thoughts (Week 0-1)
Commercial partners must also be a primary beneficiary
- Industry Mentors, TRANSCOM, Coast Gua...

Primary:
Commercial Port
Manager
Commercial Shipping
Lines Managers
Secondary:
TCCC/SDDC officers
SeaCurity: Week 1 Missio...

Let’s Focus on Commercial Partners (Week 2-3)

MVP II (Week 0-1)
Bug Bounty Platform

It Already Exists?! (Week 2-3)
Red Team/Bug Bounty Platform
Visualization tool
DAGGER

Data Sharing Problem (Week 2-3)
Ports are reluctant to share sensitive info about their
systems…
Herbert Lin (Hoover Insti...

Visiting the Port of Oakland (Week 4-5)

Visiting the Port of Oakland (Week 4-5)
Cranes
Cargo Mgmt System
Scanning System

Primary:
Secondary:
SeaCurity: Week 3 Mission Model Canvas
-Identify “Critical
Infrastructure” (defining it as
infrastruct...

Isolating the Pain Point (Week 4-5)
Week 0 Week 1 Week 2 Week 3 Week 4 Week 5
MVP
Idea
Standards?
Visualization?
Bounty pl...

Isolating the Pain Point (Week 4-5)
Week 0 Week 1 Week 2 Week 3 Week 4 Week 5
MVP
Idea
Standards?
Visualization?
Bounty pl...

What frameworks are used now?(Week 4-5)
NIST

What frameworks are used now?(Week 4-5)
NIST
Big companies
Small
Businesses
Federal
Agencies
Private
Organizations

SeaCurity

Isolating the Pain Point (Week 4-5)
No port-specific framework baseline.

Isolating the Pain Point (Week 4-5)
Back to Square One!

Isolating the Pain Point (Week 4-5)
Finding a proxy...

MVP III (Week 4-5)
System Low Risk Medium Risk High Risk
Cargo
Management
System
● Software running on
antiquated operatin...

A New Path (Week 6-Present)
For TRANSCOM, mission criticality level crucial for framework
to be utilized.
-Elizabeth Durha...

Mission Criticality (Week 6-Present)
System Low Critical Medium Critical High Critical
Cargo
Management
System
● Communica...

Mission Criticality (Week 6-Present)
Risk LevelMission Critical Level
Risk Alleviation
Guidelines
Score

A New Path (Week 6-Present)
Teaching Team: How will our framework be used?

A New Path (Week 6-Present)
USTRANSCOM
TCCC-X
TCJ6
TCJ3
SDDC
Port Authorities

A New Path (Week 6-Present)
“We would like real-time data if possible”
D R Kenerley (TCJ6), Cheryl Hepp (TCJ6)

Breakthrough : MPS-ISAO

Breakthrough : MPS-ISAO
MPS-ISAO TRANSCOM
Commercial Port
Authorities
Data
Framework
Data

Breakthrough : MPS-ISAO
MPS-ISAO TRANSCOMSeaCurity
Commercial Port
Authorities
Data
Framework
Data

Primary:
Secondary:
SeaCurity Current: Mission Model Canvas
-Identify “Critical
Infrastructure” (defining it as
infrastruc...

Final MVP (Week 4-5)

Mission Achievement
Beneficiary Mission Achievement
TRANSCOM Improved understanding of cyber readiness at the national lev...

Internal Readiness Level & Next Steps
1. Refine and submit our framework
with a report detailing our findings
1. Foster pa...

Acknowledgements
Thank you to the teaching staff, our sponsor at
USTRANSCOM, Col. Leard, our mentors Roi Chobadi
and Peter...

Appendix

Cost Flow Diagram
Initial Refinement by MSEs: $200? Initial Refinement by MSEs: $200?
TRANSCOM MSP-ISAO
Approval Process: ...

Financial/Operations Timeline
1 month
1 month
1 month
1 month
1 month
1-2 weeks
2-3 months
2-3 months
Indefinitely
SME-? S...

Minimum Viable Product: Framework
Risk Level
Mission Critical Level
(TRANSCOM only)
Risk Alleviation
Guidelines
Score

Path for Integration...
Integrate framework into existing SDDC pipeline

Path for Integration...
Maritime and Port Security Information Sharing and
Analysis Organization (MPS-ISAO)

Procurement Process: Framework
TCCC-x within TRANSCOM requests framework
Approval from TCJ6
Division
Approval from TCJ3
Di...

Path for Integration...
● Currently MPS-ISAO does not have a partnership established
to share information with USTRANSCOM,...

Path for Integration...
Key Partnership Opportunity

Activities Gantt Chart
1 month
1 month
1 month
1 month
1 month
1-2 weeks
2-3 months
2-3 months
Indefinitely

Resources, Partners, Activities
Customer Discovery Outreach Review and Approval Integration Implementation
USTRANSCOM
Seap...

Minimum Viable Product: TRANSCOM
Framework
Risk Level
Mission Critical Level
Risk Alleviation
Guidelines
Score

Minimum Viable Product: ISAO/Commercial
Framework
Risk Level
Risk Alleviation
Guidelines
Score

Minimum Viable Product: Vulnerability Level
Low Risk
Medium Risk
High Risk
● Generally well-established practices
● Follow...

Things We Learned/Other Feedback
Cargo Management System
Terminal Operating System

Minimum Viable Product: Mission Critical Level
C3
C2
C1
● Minor slowdown
● Capabilities can be easily achieved through
alt...

Minimum Viable Product: Systems, Mission
System Low Critical Medium Critical High Critical
Cargo
Management
System
● Commu...

Old Minimum Viable Product: Systems, Risk
System Low Risk Medium Risk High Risk
Terminal
Operating
System
Crane
Scanning
S...

Old Minimum Viable Product: Systems, Risk
System Low Risk Medium Risk High Risk
Terminal
Operating
System
Crane
Scanning
S...

Minimum Viable Product: Systems, Risk
Capability Score
Cyber Hygiene
Automation Level
Network Connectivity
Access Control
...

Minimum Viable Product: Systems, Risk
Software
Support
Low Risk Medium Risk High Risk
Software Updates Software updates of...

Minimum Viable Product: Systems, Risk
Considerations
● Is the system is native to the port environment (running on port
co...

Next Steps
1. Talk to both a terminal operating system provider like NAVIS
and a terminal operator at a port to map out at...

Primary:
Secondary:
SeaCurity: Mission Model Canvas
-Identify “Critical
Infrastructure” (defining it as
infrastructure tha...

Deployment Timeline
1 week 2 weeks 2-3 weeks
Framework
Integration
6 months - 1 year (?)

Awareness
Interest
Consideration
Adoption
Keep
Referrals
Cross-sell
Up-Sell
Un-Bundle
Get Keep Grow
● Awareness: Problem s...

Awareness
Interest
Consideration
Adoption
Keep
Referrals
Cross-sell
Up-Sell
Un-Bundle
Get Keep Grow
● Regular customer che...

Awareness
Interest
Consideration
Adoption
Keep
Referrals
Cross-sell
Up-Sell
Un-Bundle
Get Keep Grow
● Grow
○ Begin with mi...

Supporters, Saboteurs
Supporters
○ Port Security Officer
○ Coast Guard representative: Brian Griffiths
Advocates
○ USTRANS...

This Week: TCCC-X Assessment Flow
TCCC-X Officer
TCCC
(General Darren W. McDew)
Wants to be able to assess
ports’ cyber ca...

This Week: Ground Assessment Workflow
Mission
Assurance Officer
SDDC Officer
Commercial Port
Security Officer
SDDC Contrac...

This Week: Policy Assessment Workflow
Coast Guard
Strategic Ports
Program Manager
(MARAD)
TCJ6 Officer
= Requested by TCCC...

TCJ6 Officer: Archetype
● 30-60 years
● Mix of civilian and military
background
● Cyber/Security domain experts
● Concerne...

TCJ6 Officers: Value Proposition Canvas
Products
& Services
Seaport Security
Visualization
-Application offers easy-to-
di...

ISAO Official: Archetype
● 20-40 years
● Civilian background
● Maritime domain expertise
● Concerned with adoption of
info...

ISAO Official: Value Proposition Canvas
Products
& Services
Seaport Security
Visualization
-Framework provides
detailed, p...

SDDC Engineer: Archetype
● 30-50 years
● Civilian background
● Views role as performing “on
ground” checks based on
concer...

SDDC Engineer: Value Proposition Canvas
-Database of common
systems in place and
corresponding vulnerabilities
= better ba...

Landlord Port Security Officer: Archetype
● 30-50 years
● Civilian background, may have
industry security experience
● Con...

Landlord Port Security Officer: Value Proposition Canvas
-Visualization and Database
of known common system
vulnerabilitie...

Coast Guard Security Officer: Archetype
● 30-40 years
● Civilian background
● Domain expert for security
measures at speci...

Coast Guard Security Officer: Value Proposition Canvas
Products
& Services
Seaport Security
Visualization
-Focuses on “big...

Mission Assurance Officer: Archetype
● 30-50 years
● Civilian background
● Views role as synchronizer of
analysts and cont...

-“Big Picture” visualization
allows for baseline platform for
discussion between commercial
and military organizations
-In...

TCCC-X Officers: Archetype
● 20-30 years
● Military background
● May lack maritime domain
expertise due to different milit...

TCCC-X Officers: Value Proposition Canvas
Products
& Services
Seaport Security
Visualization
-Application identifies
vulne...

Mission Achievement
Beneficiary Mission Achievement
TCJ6 Having enough understanding cyber-resiliency status of ports at a...

List of Critical Infrastructure
Critical Infrastructure Vulnerabilities D Category
Breakwater gates -
Port Channel Blockag...

Procurement Process: Third-Party Partnerships
Company creates/has idea for possible solution
Approach TTILO (Transportatio...

Procurement Process: Within TRANSCOM
Division within TRANSCOM requests capability/tool
Product made fully available to TRA...

Third Party
Subscription
Platform
2 weeks 3 weeks 1 month 6 months3 months

You are reading a preview.

Activate your 30 day free trial to continue reading.

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

Top clipped slide

1 of 93 Ad

1 of 93 Ad