Downloaded 14 times
Uploaded byDragos, Inc.
Neighborhood Keeper - Introduction
The document outlines the challenges faced by smaller communities in deploying and leveraging advanced cybersecurity technologies for operational technology (OT) and industrial control systems (ICS). It presents a roadmap to enhance energy delivery systems' cybersecurity through the deployment of commercial technology and cloud-based analytics for real-time data sharing and threat detection. Additionally, it emphasizes the importance of collaboration among energy sector participants to improve overall cybersecurity resilience and threat understanding.
More Related Content
Similar to Neighborhood Keeper - Introduction
Neighborhood Keeper - Introduction
- 1. Introduction Matt Bodman Director ofSpecial Programs NeighborhoodKeeper
- 2. The Community Challenge IssueswithEffortsBefore ManyCommunityMembersLackResources Our smallerinfrastructurecommunity memberslack resourcesforbudgetand personnelto deploy,maintain,andleverageleadingtechnologiesonthemarket. InformationSharingStruggles inOT/ICS Manyinformationsharingprogramssharedataorinformation;theyrarelyshareintelligence. Thisrequiressensitivedatato besharedbetweenentitieswith littlecurating. Effort is expended ona hopethatvaluewill beseenlater andindicatorsdonot scale. Insights into OT/ICSNetworks is Limited Cyberthreatstarget OT/ICSnetworksyet thecollectionandanalysisfrom thosenetworksis extremelylimited.It definitelydoesnotexist in thesmallerinfrastructuresiteswhere adversariescan train andprepareundetected.
- 3. Roadmap to AchieveEnergy Delivery Systems Cybersecurity Objectives Mapped Roadmap Item4.5 (Cybereventdetectiontoolsthatevolve with the dynamicthreatlandscapecommerciallyavailable) By deployingcommercial off theshelf(COTS)industrialspecifictechnology(theDragosPlatform) to theOT networklayerof the participantsand researching,developing,and deployingindustrialspecificthreatbehavioranalyticstoprovidea transposableandscalableform of intelligence-driven threatdetection. Roadmap Item 5.6 (Mature,proactiveprocessestorapidlysharethreat,vulnerabilities,andmitigation strategiesareimplementedthroughouttheenergysector) Researching,architecting,anddeployinga cloudarchitecture(analyticsframework)that will securelyinterconnecttheOT layersensorstoreceive and share,at machine-speed,insightsin theform of non-sensitiveand non-personalidentifiablemetadata Roadmap Item 1.5and 4.6 (Compellingbusinesscasedeveloperforinvestmentin energydeliverysystemssecurity) (Lessonslearnedfromcyberincidentssharedand implementedthroughoutthe energysector) Researchanddeveloppublic use-casesandinsightsfrom thisdatato showcasethevalueof thisapproachto inform defenseandresponsepractices andcreatea combinedthreatpictureacrosstheenergysectorthat isfreelyavailableto all
- 4. Other Program Participantsand Value Electricity InformationSharingand Analysis Center(E-ISAC) Advisoryfunctionthat will ensurethatwhat is beingresearchedanddevelopedwill be usefulto thelarger electric sectorcommunity.Additionally,the focuswill be on howto usetheanalyticaloutputsto enrichthe CRISPdataset.As anexample, leveragingwhen threatsin OT occurred to findthreatsin IT. IdahoNational Laboratory Advisoryfunctionthat will ensurethatwhat is beingresearchedanddevelopedwill be usefulto theDepartmentof Energy and tothe view of thenational threatlandscape.Additionally,theywill focusonhowto leveragethe insightsto enrichandenhanceCYOTE. Ameren,First Energy, and SouthernCompany Utilityparticipantsto deploythe technologyandconnect to the cloudanalyticsframework. Detectionsin theirenvironment, interviewswith their personnel,and use-casesjointlyproducedwill ensuretheapproachis soundandscalableto take to thelarger industryespeciallyco-opsand municipalities.
- 11. Expected Outputs Fromthe R&D A sustainableprogramtoilluminatethe industrialthreatlandscape Day 1 Valueto Participants TheDragos Platformwill immediatelyprovideassetidentificationandautomaticreportingto participants.Threatanalytics arealsoimmediatelyavailable.Additionally,datais storedonsiteandavailabletoanyfutureincidentresponders Low Cost ThemodifiedDragosPlatformwill beavailableat anestimated$5-10k a yearper networkapplianceprice pointfor~15k- 50kper yearperco-op/municipality. Low TouchPoint Remoteanalysisoftheanalyticaloutputswill bedoneforthe participantsandmonitoring donefor them; if anythingis ever particularlybad they’llbenotified.No needforadditionalpersonnelat participantsites. No Trust Nosensitivedataleavestheparticipants’sites.It is onlyanalyticaloutputsnopersonalidentifiableinformationinthe systemoravailableto analysts Shared Insights New threatanalyticsrun acrossthe environmentwill identifythreatsin OT/ICS networksto shareinsightsof what detectionsand playbooks(mitigations)work acrossparticipants.Thiswill besharedat machine-speedto allparticipants. Enrichment Insightswill be leveragedto enrich thenationalunderstandingof threatsaswell asprogramssuchasCRISPandCYTE. Insightscan alsobeusedto offerregulationand standardsbodiesinsightsintothe realriskso theapproachesareadapted.
- 12.