SECURITY MODULE - Iranian Nuclear Attack PowerPoint Presentation, PPT - DocSlides

Approach to Secure IP Platforms

Clarence Pape

March 12, 2011

Challenge

Aircraft Platforms are incredibly complex

Systems and networks degrade in quality and security over time

Controlled point testing does not replicate real-world scenariosNo room/budget for carrying emergency SMEsShift in systems and networks to IP-based = changes in quality + security?Agile test system that is configurable to meet high demandsModular software approach to reduce weight and increase capabilitiesLeverage expert COTS tools with mission-focused workflowsGenerate actionable data in real timeCollect detailed data for SME trend analysis

Solution

Stuxnet Worm

Iranian Nuclear Attack

Infected over 45,000 machines

Waited for the right conditionsTargeted highly specific electronically controlled systemsIP Addresses in IranPresence of key technologies that indicate the system is installed in a vulnerable power plantForces the industrial process to self-destruct

Overview of the Solution

ID Optimize

Advanced Policy Engine

Leverages the power of COTS toolsProvides a customized interface that can be designed to represent the exact data necessaryDetailed logs are created for analysis and policy updates

The power of enterprise-class tools, without the cost of SMEs.

ID Optimize -> DISA Air Mobility Test Suite

ID Optimize is a COTS tool developed by ID

DISA saw the potential

Custom workflows based on agency and missionAbility to be run by non-IT professionalsAbility to provide simple summaries for users and after-action reportsAbility to return highly granular data for trend analysis

What is IDOptimize

A flexible development framework that combines multiple COTS products for easy to use, integrated testing and reporting

Flexible – Integrate with COTS, GOTS or custom built systems

Modules designed for specific purposes = low training + high success rateModules shared across different platformsAutomation - Reduces human error - Increases productivity - Run more tests and test often - Compare results with previous test runs and platform baselines quicklySystematic testing leads to predictable and repeatable results

ANALOG MODULE

Comm Testing

Comm Test Module

Collect subjective

data and objective meta-data variables about tone quality and encryption success for end to end network segment mapping Systematically generate 3-10 tones at different human audible pitches Record the generated tones 250KH Provide actionable feedbackBenefits

Focused on the end user quality

True end-to-end system quality test, "through the demark”

Track over 50 different variables for quality control as a workflow

Plug and play

After action reports

Centralized database with full 250kHz data capture

Logistical data integration

REPORTING MODULE

Reporting

All information can be uploaded to central Control Centers and Reporting Engines instantly or in a batch process

The IDOptimize Test Suite Reporting Engine can also be used for mash-ups and deep dive analysis

Client-side mash-up technologies preserves user authentication through to primary databasesReports can include local information, as well as global information

Calls by GEP geo-coded and graphed by Altitude– success/failure

FOUO

Calls by GEP geo-coded and graphed by CCSD – success/failure

FOUO

Calls by GEP geo-coded and graphed by weather – success/failure

FOUO

SECURITY MODULE

Data Feeds

Policies

Summary Reports

Data Scanning

Network Status Indicator

Data Scanning

Data Feeds

Policies

Summary Reports

Network Status Indicator

IP Type Casting

Core Systems – Mission critical systems that are permanently attached to the plane for years at a time. These controls should have very tight policies.

Crew – Mission support systems that are carried on the plane for the mission. A wider variety of configurations may be acceptable here.

Guest – These systems may be of widely varying levels of civilian, commercial, or military security and may be removed from the network in cases where they can not be remediated due to lack of control/timing constraints.Other – This is a general designation open to interpretation based on the requirements of particular work flows.

Proposed Scan Policies 4 Degrees of Control

IAVA

Violations

Risk Level

3-6

Risk Level

0-3

Risk Level

6-9

FDCC

Violations

Cat III

Cat II

Cat

I

Summary

Avoid SME Costs (IP Security, Signals Analysts, etc)

Security of IP Networks in disconnected/semi-connected state

Communication quality shift and drift over timeSystematic approach to root cause analysisIncrease use of software and virtualizationAgile solutions approach is quickly extendable to meet demandsSoftware DevelopmentAcquisitionRelevant data integrationCentralized dataMash-ups maintain security