Application of CYBEX (Cybersecurity Information
Description: Application of CYBEX (Cybersecurity Information Exchange) techniques to future networks Tony Rutkowski Yaana Technologies Georgia Tech Q.417 Rapporteur SG17 Tutorial Geneva 15 Dec 2010 V1.1 CYBEX Basics The new cybersecurity paradigm know
Related Topics
Download Presentation
"Application of CYBEX (Cybersecurity Information" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. Application of CYBEX (Cybersecurity Information Exchange) techniques to future networks Tony Rutkowski
Yaana Technologies
Georgia Tech
Q.4/17 Rapporteur SG17 Tutorial
Geneva
15 Dec 2010
V1.1<br>
slide2. CYBEX Basics The new cybersecurity paradigm
know your weaknesses
minimize the vulnerabilities
know your attacks
share the heuristics within trust communities
CYBEX – techniques for the new paradigm
Weakness, vulnerability and state
Event, incident, and heuristics
Information exchange policy
Identification, discovery, and query
Identity assurance
Exchange protocols
X.1500 culminates a broadly supported 2-year effort
Consists of a non-prescriptive, extensible, complementary “collection of tools” that can be used as needed 2<br>
slide3. Today’s Reality “security by design” is not a reasonable objective today, as the code/systems are too complex, distributed, autonomous and constantly changing
Common global protocol platforms for the trusted exchange of information are essential
A distributed, “security management” network plane that supports autonomy is emerging
Single “national centres” for this purpose are not feasible and would represent a massive vulnerability 3<br>
slide4. CYBEX Facilitates a Global Cybersecurity Model 4 CYBEX
Information Exchange
Techniques Deny resources Stored event data availability Identity Management Forensics & heuristics analysis Provide data for analysis Encryption/ VPNs esp. for signalling Resilient infrastructure Routing & resource constraints Network/ application state & integrity Real-time data availability Measures for protection Measures for threat detection Blacklists & whitelists Vulnerability notices Measures for threat response Provide basis for additional actions Patch development Provide basis for actions Reputation sanctions Provide awareness of vulnerabilities and remedies<br>
slide5. The CYBEX Model 5 Cybersecurity Information use
(out of scope) structuring cybersecurity information for exchange purposes
identifying and discovering cybersecurity information and entities
establishment of trust and policy agreement between exchanging entities
requesting and responding with cybersecurity information
assuring the integrity of the cybersecurity information exchange Cybersecurity
Entities Cybersecurity
Entities Cybersecurity Information acquisition
(out of scope)<br>
slide6. Exchange Policies Exchange Weakness, Vulnerability/State Exchange Event/Incident/Heuristics Exchange CYBEX Technique Clusters: Structured Information Event Expressions Malicious Behavior Malware Patterns Incident and Attack Patterns Knowledge Base Weaknesses Vulnerabilities and Exposures Platforms State Assessment Results Security State Measurement Configuration Checklists Terms and conditions<br>
slide7. Exchange Protocol CYBEX Technique Clusters: Utilities Identity Assurance Authentication Assurance
Methods Authentication Assurance Levels Identification, Discovery, Query Common Namespaces Discovery enabling mechanisms Request and distribution mechanisms Interaction Security Transport Security Trusted Platforms Trusted Network Connect<br>
slide8. Today’s Use Cases Your computer
Patch Tuesday
Open Windows Update
X.1500 Appendices
NICT CYBEX Ontology
Japan’s JVN
USA Federal Desktop Core Configuration/ US Government Configuration Baseline 8<br>
slide9. Significant adoption rate SG17 December 2010 Geneva Cybersecurity Workshop Session 5.1
Robert A. Martin of MITRE described the essentials for Vendor Neutral Security Measurement & Management with Standards
Ian Bryant of the EU NEISAS Project described the challenges in sharing security information for infrastructure protection
Takeshi Takahashi of NICT described an ontological approach for cybersecurity information haring, especially for Cloud Computing
Thomas Millar of the US-CERT presented an operational model of CIRT processes for improved collaboration and capability development
Luc Dandurand of NATO described his organizations new initiative for cyber defence data exchange and collaboration infrastructure (CDXI)
Damir Rajnovic of FIRST described the structure and mechanisms of the principal global organization of cybersecurity incident centers
IETF October 2010 Beijing Meeting
CYBEX conceptualized as a security management layer 9<br>
slide10. Toward Network Security Planes: Security Automation Schemas Everywhere 10 SCAP Security Automation Tools<br>
slide11. What about Future Networks/NGNs? A potential implementation of a CYBEX reference model for NGNs is depicted in the following diagrams
SCAP should be ubiquitous in the models
This approach is adapted from a similar approach already being taken for NGN Identity Management
NGN providers would play a substantial CYBEX framework-support function with understood assurance levels among themselves and all network devices and capabilities within their domain
Under this approach, CYBEX techniques would be adapted as necessary through the use of extensions and reflected in a new extensible Y-series Recommendation
ETSI TISPAN is already working on a similar model 11<br>
slide12. CYBEX applied to Future Network Strata 12 Management Plane Control Plane NGN Transport Stratum User Plane Management Plane Control Plane NGN Service Stratum User Plane Figure 2/Y.2011 Scope of CYBEX<br>
slide13. CYBEX applied to Future Network Functions 13 Figure 3/Y.2011<br>
slide14. CYBEX applied to Future Network Models toward a NGN/FN security plane 14 CYBEX Exchange on NNI Interfaces Service Control Transport Stratum Application Support NGN Provider A End User Functions Management Functions CYEX Functions CYBEX Functions CYBEX Functions CYBEX Service Control Transport Stratum Application Support NGN Provider B End User Functions Management Functions Cybex Functions CYBEX Functions CYBEX Functions CYBEX CYBEX Exchange on UNI Interfaces CYBEX Exchange on UNI Interfaces<br>
Yaana Technologies
Georgia Tech
Q.4/17 Rapporteur SG17 Tutorial
Geneva
15 Dec 2010
V1.1<br>
slide2. CYBEX Basics The new cybersecurity paradigm
know your weaknesses
minimize the vulnerabilities
know your attacks
share the heuristics within trust communities
CYBEX – techniques for the new paradigm
Weakness, vulnerability and state
Event, incident, and heuristics
Information exchange policy
Identification, discovery, and query
Identity assurance
Exchange protocols
X.1500 culminates a broadly supported 2-year effort
Consists of a non-prescriptive, extensible, complementary “collection of tools” that can be used as needed 2<br>
slide3. Today’s Reality “security by design” is not a reasonable objective today, as the code/systems are too complex, distributed, autonomous and constantly changing
Common global protocol platforms for the trusted exchange of information are essential
A distributed, “security management” network plane that supports autonomy is emerging
Single “national centres” for this purpose are not feasible and would represent a massive vulnerability 3<br>
slide4. CYBEX Facilitates a Global Cybersecurity Model 4 CYBEX
Information Exchange
Techniques Deny resources Stored event data availability Identity Management Forensics & heuristics analysis Provide data for analysis Encryption/ VPNs esp. for signalling Resilient infrastructure Routing & resource constraints Network/ application state & integrity Real-time data availability Measures for protection Measures for threat detection Blacklists & whitelists Vulnerability notices Measures for threat response Provide basis for additional actions Patch development Provide basis for actions Reputation sanctions Provide awareness of vulnerabilities and remedies<br>
slide5. The CYBEX Model 5 Cybersecurity Information use
(out of scope) structuring cybersecurity information for exchange purposes
identifying and discovering cybersecurity information and entities
establishment of trust and policy agreement between exchanging entities
requesting and responding with cybersecurity information
assuring the integrity of the cybersecurity information exchange Cybersecurity
Entities Cybersecurity
Entities Cybersecurity Information acquisition
(out of scope)<br>
slide6. Exchange Policies Exchange Weakness, Vulnerability/State Exchange Event/Incident/Heuristics Exchange CYBEX Technique Clusters: Structured Information Event Expressions Malicious Behavior Malware Patterns Incident and Attack Patterns Knowledge Base Weaknesses Vulnerabilities and Exposures Platforms State Assessment Results Security State Measurement Configuration Checklists Terms and conditions<br>
slide7. Exchange Protocol CYBEX Technique Clusters: Utilities Identity Assurance Authentication Assurance
Methods Authentication Assurance Levels Identification, Discovery, Query Common Namespaces Discovery enabling mechanisms Request and distribution mechanisms Interaction Security Transport Security Trusted Platforms Trusted Network Connect<br>
slide8. Today’s Use Cases Your computer
Patch Tuesday
Open Windows Update
X.1500 Appendices
NICT CYBEX Ontology
Japan’s JVN
USA Federal Desktop Core Configuration/ US Government Configuration Baseline 8<br>
slide9. Significant adoption rate SG17 December 2010 Geneva Cybersecurity Workshop Session 5.1
Robert A. Martin of MITRE described the essentials for Vendor Neutral Security Measurement & Management with Standards
Ian Bryant of the EU NEISAS Project described the challenges in sharing security information for infrastructure protection
Takeshi Takahashi of NICT described an ontological approach for cybersecurity information haring, especially for Cloud Computing
Thomas Millar of the US-CERT presented an operational model of CIRT processes for improved collaboration and capability development
Luc Dandurand of NATO described his organizations new initiative for cyber defence data exchange and collaboration infrastructure (CDXI)
Damir Rajnovic of FIRST described the structure and mechanisms of the principal global organization of cybersecurity incident centers
IETF October 2010 Beijing Meeting
CYBEX conceptualized as a security management layer 9<br>
slide10. Toward Network Security Planes: Security Automation Schemas Everywhere 10 SCAP Security Automation Tools<br>
slide11. What about Future Networks/NGNs? A potential implementation of a CYBEX reference model for NGNs is depicted in the following diagrams
SCAP should be ubiquitous in the models
This approach is adapted from a similar approach already being taken for NGN Identity Management
NGN providers would play a substantial CYBEX framework-support function with understood assurance levels among themselves and all network devices and capabilities within their domain
Under this approach, CYBEX techniques would be adapted as necessary through the use of extensions and reflected in a new extensible Y-series Recommendation
ETSI TISPAN is already working on a similar model 11<br>
slide12. CYBEX applied to Future Network Strata 12 Management Plane Control Plane NGN Transport Stratum User Plane Management Plane Control Plane NGN Service Stratum User Plane Figure 2/Y.2011 Scope of CYBEX<br>
slide13. CYBEX applied to Future Network Functions 13 Figure 3/Y.2011<br>
slide14. CYBEX applied to Future Network Models toward a NGN/FN security plane 14 CYBEX Exchange on NNI Interfaces Service Control Transport Stratum Application Support NGN Provider A End User Functions Management Functions CYEX Functions CYBEX Functions CYBEX Functions CYBEX Service Control Transport Stratum Application Support NGN Provider B End User Functions Management Functions Cybex Functions CYBEX Functions CYBEX Functions CYBEX CYBEX Exchange on UNI Interfaces CYBEX Exchange on UNI Interfaces<br>