1 the future of cyber security prof. ravi sandhu executive director and endowed chair...
TRANSCRIPT
1
The Future of Cyber Security
Prof. Ravi SandhuExecutive Director and
Endowed Chair
www.ics.utsa.edu
© Ravi Sandhu World-Leading Research with Real-World Impact!
Institute for Cyber Security
Cyber technologies and systems have evolved Cyber security goals have evolved
Computer security Computer security + Communications security
Separate and never shall meet TO Coupled and integrated
Information assurance Mission assurance
Cyber security research/practice have not kept upThe gap is growing
© Ravi Sandhu 2World-Leading Research with Real-World Impact!
Cyber Security Status
Mission assurance = Application assurance Latest technology: Cloud Computing
Dominant issues: Cost and productivity Focus on core competence Availability Security
Latest lesson (April-May 2011): Amazon outage 100s of companies with 24-72 hours downtime Netflix unaffected
© Ravi Sandhu 3World-Leading Research with Real-World Impact!
Cyber Security Status
Old think: protect the network, protect the information, protect the content Design to isolate and protect the network in face of
system and security failuresNew think: protect the mission, protect the
application, protect the service Design to operate through system and security
failures Not possible without application context
Most important recommendation Cyber security needs to be a proactive rather than
reactive discipline
© Ravi Sandhu 4World-Leading Research with Real-World Impact!
Cyber Security Doctrine
Cyber security is all about trade-offs confidentiality integrity availablity usage privacy cost usability productivity
Application context is necessary for trade-offs
© Ravi Sandhu 5World-Leading Research with Real-World Impact!
Fundamental Premise
Productivity-Security
Cyber Security is all about tradeoffs
© Ravi Sandhu 6World-Leading Research with Real-World Impact!
Productivity Security
Let’s build itCash out the benefitsNext generation can secure it
Let’s not build itLet’s bake in super-security tomake it unusable/unaffordableLet’s sell unproven solutions
There is a middle groundWe don’t know how to predictably find it
The ATM (Automatic Teller Machine) system is secure enough global in scope
Not attainable via current cyber security science, engineering, doctrine not studied as a success story
Similar paradoxes apply to on-line banking e-commerce payments
© Ravi Sandhu 7World-Leading Research with Real-World Impact!
The ATM Paradox
Monetary loss is easier to quantify and compensate than information loss
Security principles stop loss mechanisms audit trail (including physical video) retail loss tolerance with recourse wholesale loss avoidance
Technical surprises no asymmetric cryptography no annonymity
© Ravi Sandhu 8World-Leading Research with Real-World Impact!
Why is the ATM System Secure?
Application Centric
9
PEI Models
Security and system goals(objectives/policy)
Policy models
Enforcement models
Implementation models
Necessarily informal
Specified using users, subjects, objects, admins, labels, roles, groups, etc. in an ideal setting.Security analysis (objectives, properties, etc.).Approximated policy realized using system architecture with trusted servers, protocols, etc.Enforcement level security analysis (e.g. stale information due to network latency, protocol proofs, etc.).Technologies such as Cloud Computing, Trusted Computing, etc.Implementation level security analysis (e.g. vulnerability analysis, penetration testing, etc.)Software and HardwareConcrete System
© Ravi Sandhu World-Leading Research with Real-World Impact!
PEI
MODELS
WHAT
HOW
HOW
10
Secure Information Sharing (SIS)
Goal: Share but protect Containment challenge
Client containment Ultimate assurance infeasible (e.g., the analog hole) Appropriate assurance achievable
Server containment Will typically have higher assurance than client containment
Policy challenge How to construct meaningful, usable, agile SIS policy How to develop an intertwined information and security model
© Ravi Sandhu World-Leading Research with Real-World Impact!
Secure but insecure
11
Group-Centric Secure Information Sharing Policy Models
Operational aspects Group operation semanticso Add, Join, Leave, Remove, etco Multicast group is one example
Object modelo Read-onlyo Read-Write (no versioning vs versioning)
User-subject modelo Read-only Vs read-write
Policy specification Administrative aspects
Authorization to create group, user join/leave, object add/remove, etc.
© Ravi Sandhu World-Leading Research with Real-World Impact!
Users
Objects
GroupAuthz (u,o,r)?
join leave
add remove
12
Group-Centric Secure Information Sharing Enforcement Models
© Ravi Sandhu World-Leading Research with Real-World Impact!
CC
5.2 Set Leave-TS (u) =Current Time
6.2 Update:a. Remove_TS (o) = Current Timeb. ORL = ORL U {id, Add_TS (o), Remove_TS (o)}
GAGroup Users
TRM TRM TRM…
3. Read Objects
Non-Group User
TRM1.1 Request Join{AUTH = FALSE}
1.2 Authz Join{AUTH = TRUE}
1.4 Provision Credentials
{id, Join_TS, Leave_TS, ORL,
gKey,
N}
1.3 User Join
{AUTH=TRUE},
Integrity Evidence
Object Cloud
2.1 Add Object o
2.2 Distribute o
4.1 Request
Refresh
4.2 Update
Attributes5.1
Rem
ove
Use
r (id
)
6.1
Rem
ove
Obj
ect (
o)
Obta
in O
bjec
t o
User Attributes: {id, Join-TS, Leave-TS, ORL, gKey}
Object Attributes: {id, Add-TS}
ORL: Object Revocation ListgKey: Group Key
© Ravi Sandhu 13World-Leading Research with Real-World Impact!
Trusted Computing Basic premise
Software alone cannot provide an adequate foundation for trust Old style Trusted Computing (1970 – 1990’s)
Multics system Capability-based computers Intel 432 vis a vis Intel 8086 Trust with security kernel based on military-style security labels Orange Book: eliminate trust from applications
What’s new (2000’s) Hardware and cryptography-based root of trust Trust within a platform Trust across platforms Rely on trust in applications Mitigate Trojan Horses and bugs by legal and reputational
recourse
© Ravi Sandhu 14World-Leading Research with Real-World Impact!
Trusted Computing
Basic principlesProtect cryptographic keys At rest In motion In use
Control which software can use the keys Marriage of cryptography and access control
Foundations Security Models Formal methods Cryptography
Application-Centric Secure information sharing Social computing Health care Data provenance Critical infrastructure
Technology-Centric Cloud computing Smart grid Trusted computing Mission-aware diversity
Attack-Centric Botnet and malware analysis Complex systems modeling Zero-day defense Moving target defense
© Ravi Sandhu 15World-Leading Research with Real-World Impact!
Cyber Security Research
Most cyber security thinking is microsec Most big cyber security threats are macrosec
MicrosecRetail attacks vs Targeted attacks 99% of the attacks are thwarted by basic hygiene and some
luck1% of the attacks are difficult and expensive, even
impossible, to defend or detect
Rational microsec behavior can result in highly vulnerable macrosec
© Ravi Sandhu 16World-Leading Research with Real-World Impact!
Microsec vs Macrosec
Cyber Security as a Discipline
© Ravi Sandhu 17World-Leading Research with Real-World Impact!
Computer Science
CyberSecurity
Cyber Security as a Discipline
© Ravi Sandhu 18World-Leading Research with Real-World Impact!
Computer Science
CyberSecurity
Wisdom from the past:“Generally, security is a system problem. That is, it is
rare to find that a single security mechanism or procedure is used in isolation. Instead, several different elements working together usually compose a security system to protect something.” R. Gaines and N. Shapiro 1978.
The challenge is how to develop a systems perspective on cyber security
© Ravi Sandhu 19World-Leading Research with Real-World Impact!
The Cyber Security System Challenge