Transcript Possible International Workshops On Critical Cyber Policy

A Strategy for Cyber Defense Strategy
John C. Mallery ([email protected])
Computer Science & Artificial Intelligence Laboratory
Massachusetts Institute of Technology
7/16/2015 3:01:06 PM
Presentation at the 2010 Workshop on Cyber Security and Global Affairs & Security
Confabulation IV, Zurich, July 7-9, 2010.
Message

Decompose the cyber elephant!


Make prioritized architectural moves to disrupt
attacker business models



Increase the work factor for attackers
Lower the work factor for defenders
Plan defensive campaigns across life cycles of
attack and defense



Identify attacker business models
Disrupt the attacker business model at choke points
Channel the attacker to more defensible attack
surfaces
Seize the initiative



John C. Mallery
Change the game to the advantage of defense
Change the incentive structures -> virtuous cycles
Align security and mission incentives
2
MIT CSAIL
Threat Actors And Capabilities
Threat Actors
Motive
Targets
Means
Resources
Political
Military, intelligence, infrastructure,
espionage, reconnaissance,
influence operations
Intelligence, military,
broad private sector
Fully mobilized, multispectrum
Nation States
During Peace Time
Political
Espionage, reconnaissance,
influence operations
Intelligence, military,
leverages criminal
enterprises or black
markets
High, multi-spectrum,
variable skill sets
below major cyber
powers
Terrorists,
Insurgents
Political
Infrastructure, extortion
Leverage black markets?
Limited, low expertise
Political Activists
or Parties
Political
Political outcomes
Outsourcing?
Limited, low expertise
Black Markets For
Cyber Crime
Financia
l
Tools, exploits, platforms,
data, expertise, planning
Mobilizes cyber crime
networks
Reconnaissance,
planning, diverse
expertise
Professional, low end
multi-spectrum,
leverage of black
markets
Leverages black markets
Low, mostly reliant on
black markets
Outsourcing to criminal
enterprises?
Sectoral expertise,
funding, organization
Nation States
During War Time
Criminal
Enterprises
Financia
l
Small Scale
Criminals
Financia
l
Rogue Enterprises
Financia
l
John C. Mallery
Hijacked resources, fraud, theft, IP
theft, illicit content, scams, crime for
hire
IP theft, influence on sectoral
issues
3
MIT CSAIL
Integration of Technical and Economic Perspectives
Security Economics analyzes incentives and risks
Value Monetization
Political Return
Threat
Actors
Attack
Vectors
Value at
Risk
Security Engineering defends and attributes
John C. Mallery
4
MIT CSAIL
Asymmetries of
Cyber Attack and Defense
Mode
Initiative
Attacker
Chooses the best place, time and
means of attack
Defender
Must defend everywhere, all
the time, against any attack
Organized around attack
-> Good
Organized around product ->
Poor
Small group -> high
Non-scalable -> low
Situational
Awareness
High
After-market bolt-on
-> Low
Software Control
High
Depends on supply chain ->
Low
Decision cycle
Fast
Many stake holders
-> Slow
High (apparent)
Low
Low, narrow
High, broad but diffuse
Architectural Control
Low
High, but slow
Legal/LE Systems
Low
High, but slow
Communications
Coordination
Agility
Knowledge
John C. Mallery
5
MIT CSAIL
Laws of Information Assurance

Centralization Risk: Concentration of value attracts better
resourced attackers whenever the attacker work factor does not
increase faster than the value at risk.





Corollary: Attackers can gain economies of scale through common
mode vulnerability (low diversity)
Corollary: Multiplexing functionality on the same platform aggregates
the individual threat models
Markowitz’s Law: A minimal complexity system has fewer attack
surfaces.

Corollary: Eliminate unnecessary functionality

Corollary: Move attack points to where they can be best defended.
Gosler’s Law: Architectural change displaces preferred attack
points.
Architectural Leverage: Effective security can be achieved
through synergistic architectural moves targeting attacker work
factors

John C. Mallery
Success is achieved by raising attacker work factor across attack
surfaces beyond the resources available to the attacker, or worthy of
the target.
6
MIT CSAIL
Defensive Complexity Analysis

Meta-metric for security focuses on difficulty of tasks an attacker
or defender must perform




Work factor is the difficulty of executing tasks
Analogous to computational difficulty in crypto
Extends beyond the technical designs to domain embeddings
Dimensions of work factors

Resources
 Computational complexity
 Cost
 Expertise and Knowledge

Planning, execution and information management
 Cognitive difficulty (non-linear planning)
 Learning difficulty
 Organizational effectiveness/dysfunction

Risk
 Uncertainty
 Culture

Make technical or policy moves that cumulatively


John C. Mallery
Impose hard problems on attackers
Facilitate coordinated defense
7
MIT CSAIL
High Leverage Solutions:
Eliminate Whole Classes Of Vulnerability By Design
Fixing security vulnerabilities at their source retires
an entire attack surface, and its consequences.
Tree Descent Is Exponential
Leverage means fixing the cause rather than the
symptoms.
Failure to fix the cause results in multiplicative
vulnerabilities and multiplicative impacts on
defender work factors.
Example: Runtime type checking and array
bounds checking eliminates 99% of penetration
exploits on COTS operating systems. – Source:
Alexander Sotirov (Solved in the 1970s – use it!)
Example: Lack of separation in COTs operating
systems means one Trojan in the supply chain can
subvert downstream products and systems. (See
separation kernels)
John C. Mallery
8
Example: Ubiquitous input validation
eliminates code injection attacks
(e.g., SQL injection) (see CLIM)
MIT CSAIL
Cyber Security Leverage is highest at
base of IT Innovation Hierarchy
No
4
3
2
1
Scope
“Edge
innovation,”
leverage of IT
infrastructures
Examples
• Social networking
• Use of cloud computing
• Digital organizations
• Application software
• Personal computing, global Interweb
• Large-scale E-commerce frameworks
• E- financial & payment systems
Large-scale IT
• DoD Global Information Grid
infrastructures • Global network infrastructure
• IT capital goods industry
Agility
Flexible,
adaptive
within
frameworks
Commerce
framing
ecosystems
Technology
base
• Commodity computing technologies
• High performance routers
• Global Internet protocols & structure
• Commodity ICs & storage
Low external
flexibility due
to constraints
of other levels
Disruptive
foundational
technologies
• Crypto, computer/network security
• Packet-switched networking
• Fiber Optics, quantum communication
• Computer architecture, PL/OS models
• Transistor, VLSI, quantum computing?
Intellectually
Difficult
9
Mainstream
Slow, large
investments,
incremental
change
Core
technologies
supporting IT
infrastructure
John C. Mallery
Type
Scientific
basis
MIT CSAIL
Attack/Defense Work Factors at
Every Stage In System Life Cycles
Evolving Technology Landscape
Requirements
Design
Implementation
Accreditation
Integration
Manufacturing
Shipping
Deployment
Operation
Training
Maintenance
Evolution
John C. Mallery
 The attacker can choose to attack
the weakest surface at the most
inopportune time for the defender.
 The sophisticated attacker can
deploy multi-spectrum techniques in a
well-resourced coordinated plan.
 The sophisticated attacker can
attack anywhere along the supply
chain.
 The defender must protect all
attack surfaces at all times, including
those in the supply chain
10
MIT CSAIL
Attacker Work Factors at Every Stage in
the Offensive Life Cycle (days)
Mode
Action
Research
Target
Conceptualize
Probe
Map networks, apps, files, info
Plan
Camouflage
Penetrate,
Develop Persistence
& Collect
Penetrate
Camouflage
Execute
Exfiltrate
Obfuscate
John C. Mallery
Analysis
Data Mine
Disseminate
& Act
Integrate
Analyze
Distribute
11
MIT CSAIL
Defender Work Factors at Every Stage
in The Defensive Life Cycle (years)
Mode
Model
Action
Anticipate
Attack
Attack Sensing, Warning and
Response (ASW&R)
Identify Threat
Sense, Warn, Respond
Diagnose
Adapt/remediate
Design Mitigation
Regenerate
Investigate
Develop
Develop & Deploy
John C. Mallery
Deploy Maintenance Or
Upgrade
12
MIT CSAIL
Today’s COTs: Even Partial Solutions
Can Impact The Attacker Work Factor

Microsoft introduced a series of partial moves
against penetration over past 10 years




Yet, the impact on the attacker work factor
increased the time to develop an exploit from 3
days in the late 1990s to 3 weeks in 2010



Penetration is when the attacker gets his first
function to run before he escalates privilege
None of MS counter measures are fully effective
Some break existing code and are not turned on
Assumes exploit development (but not packaging)
must be done by a single person
Source: Alexander Sotirov, February, 2010
Still not outside the 4 week patch cycle?
John C. Mallery
13
MIT CSAIL
Medium-term (3-5 yrs):
Enhancing Power Grid Security

Create secure SCADA cyber infrastructure based on:



Minimal complexity hosts with high assurance
Minimal connectivity overlay networks
Approach


Separation: Build on existing platforms like separation kernels
Safety: Use safe programming languages


Correctness: Verify critical code, including compiler
Input Checking: Use comprehensive syntactic input
validation
 Type checking & buffer bounds checking
 Example: CLIM presentation system

Model Checking: Build semantic model to validate input
 Massoud Amin (U. Minn.) claims that 60% of parameter input sets
could be checked for safety




Resilience: Build in via strong adaptive capacity
Redundancy: Use physically redundant networking with out of
band control
Adapt approach to other critical infrastructures
WF Impact: Major, state of the art security, push the
attacks into the supply chain and insiders
John C. Mallery
14
MIT CSAIL
Mid-term (3-5 yrs): Prophylactic
Networking Strategy (HTTP and SMTP)

Eliminate exploitable vulnerabilities from the network
application stack so as to deny botnets and bad actors a
vector through which to subvert COTs OSes.








Industry knows how to implement these systems
For probably $1B, the HTTP and SMTP range of software could
be reimplemented within 2-3 years.
Some legal requirements for “network safety” would incentivize
the development and update.



Reimplement the TCP/IP and SSL stacks in a safe language.
Reimplement HTTP and SMTP servers and clients in safe languages.
Provide a competent security model and sandboxing for mobile code
(e.g., JavaScript).
Use virtualized COTS OS + app (e.g. word, multimedia code) in a
one-shot-then-reset mode to view embedded media or attachments.
Parse and rewrite any media or attachments that are returned to the
primary host environment.
Spear phishing eliminated by design (maybe spam too)
Drive-by Web site attacks eliminated by design
WF Impact: Significant, push attacker on to other penetration
vectors, make him do R&D
John C. Mallery
15
MIT CSAIL
Long-term (5-10 yrs):
Transformational Architectures

Eliminate single point failures leading to collapse of
security in:





System architectures (e.g., monolithic privileged kernel)
Crypto (e.g., secret key leakage)
ID management (e.g., insider)
Application architectures
Principles:

Bake in security
 Eliminate vulnerabilities by design
 Enforce strong fine-grained separation
 Factor components




Ground trust in multiple separate ways forcing an attack to
compromise all simultaneously
Enhance resilience through adaptive software forcing an
attacker to impair all functional variants simultaneously
Raise productivity dramatically based on semi-automatic
program synthesis using verified and composable components
WF Impact: Dramatic, over the horizon, push attacks
into the supply chain
John C. Mallery
16
MIT CSAIL
Work Factor Analysis
Can Help Guide Policy Formation

Non-technical architectures have an impact on attacker
and defender work factors

International Law: Distinguish attack rising to “armed force”
from espionage
 Separate exploitation targets from C2 architecturally to enable
clear response?

Design component sourcing so that supply chain attacks must
compromise multiple branches to succeed.
 Eliminate single point supply chain vulnerabilities
 Multiply suppliers and randomize component sourcing

Technical architectures interact with policy choices

Isolation: Separate functions across systems so that
compromise of a single system does not compromise multiple
systems
 Costs more money

Self-knowledge: Map systems to build situational awareness
of functions at risk to infer attacker goals and business model
 Layout systems so they can be used to instrument attacker objectives

Work factors can clarify leverage to help prioritize
policy moves
John C. Mallery
17
MIT CSAIL
Legal Moves:
Black Markets For Cyber Crime

Black markets provide:



A number of activities may not be illegal!




Target reconnaissance
Attack tools
Cryptographic support
Extend legal system to cover support activities for
cyber crime



Scalable cyber crime
Empower low-end state actors (over 100)
Outlaw activities without non-criminal applications
Control “dual use” activities with high criminal leverage
WF Impact: Increase work factor by raising legal risk


John C. Mallery
LE focus on high leverage supply activities
Increase scarcity & price of high leverage ingredients
18
MIT CSAIL
Legal Moves:
Separate Cyber Crime From Terrorists


Terrorist may seek cyber attack capabilities in criminal
black markets
Cyber criminals are economic actors



Make legal moves against transfer of cyber attack
data, tools or expertise to terrorist organizations



Raise response to national security level using military and
intelligence resources
Institute exceptionally severe penalties, especially for critical
infrastructure attacks
Channel activity away from terrorism


Pursue a business model
Seek to reduce risk to continuity of operations
Make the risk reward calculus uneconomic
WF Impact: Reinforce incentives against aid to
terrorists
John C. Mallery
19
MIT CSAIL
Economics: Monetizing Cyber Security
& Modernizing the IT Sector

Success:


Market forces spread reasonably high assurance throughout society and
continue to innovate (Precedent: 1990s build out of civilian Internet)
Requirements:

Ability to accurately measure and compare system security characteristics
 Predictive metrics
 Historical data series

Ability of buyers of IT to reliably understand & measure risk
 Anticipate and measure threat levels
 Estimate losses due to potential cyber attacks
 Determine commensurate levels of investment in security

Transformation of the IT technology plane for security and agility




Strongly bias work factors in favor of defender against attacker
Dramatically harden systems
Architect for adaptive resilience and rapid recovery
Radically increase productivity of secure system development, certification,
accreditation, and operation
 Align security with functionality by making it inherent and largely transparent
 Deliver faster development cycles and superior total ownership cost than current
generation COTS

Alignment of market incentives for uptake – ultimately next gen COTS
 Stratify markets according to assurance needs to provide a learning curve and
a path to scale
 Phased introduction of safety regulations, liability and meaningful cyber insurance as
industry is genuinely able to respond based on transformational technologies
 Attenuate rigidities in IT capital goods ecosystem that impede technical evolution
John C. Mallery
20
MIT CSAIL
Message

Decompose the cyber elephant!


Make prioritized architectural moves to disrupt
attacker business models



Increase the work factor for attackers
Lower the work factor for defenders
Plan defensive campaigns across life cycles of
attack and defense



Identify attacker business models
Disrupt the attacker business model at choke points
Channel the attacker to more defensible attack
surfaces
Seize the initiative



John C. Mallery
Change the game to the advantage of defense
Change the incentive structures -> virtuous cycles
Align security and mission incentives
21
MIT CSAIL
Appendix
Received Notions Of Sustainability

Developmental Economics: Growth based on resources
available in sufficient supply in the future




Green Technology: Reduced impact on environment (output)
and improved utilization of depletable resources (input)





Foreign exchange bottleneck
Environmental degradation
Sustainable development -> appropriate resource usage
Renewable resources -> sustainability
Clean energy sources to reduce CO2 emissions and climate impact
Efficient resource utilization (inputs & outputs/externalities)
Computational Sustainability: Use of computation to improve
resource utilization (e.g., Smart Grid)
Core notion is continuity of dissipative systems


John C. Mallery
Non-equilibrium thermodynamics (Prigogine) looks at how living
systems maintain themselves in the face of entropy via matter energy
exchange with their environments
Living System (autopoesis): a network of component producing
processes that recreate the network over time
23
MIT CSAIL
Cyber As A
Computational Sustainability Conundrum

Cyber refers to the embedding or integration of computation and
communication within human organizations and social systems


Human systems are understood as living systems
Dissipative structures face perpetual challenge of continuity
 Must repair internal failures of essential components
 Must adapt to changing environments
 Usually face intelligent competitors

Cyber impacts continuity


Benefits: Greater adaptive potential through better information and
computation
Challenges: Environmental change driven by cyber
 Requires internal and external adaptation

Entropy: Cyber attack/exploitation consume resources
 Direct impact of lost information or degraded operation
 Indirect cost of recovery or investment in cyber security
 Social costs of cyber pollution - export of risk, externalities

Cyber sustainability involves:




Designing for reliability to manage complexity
Adapting to changes in the environment, often cyber fueled
Resisting cyber attack and exploitation
Dialectic of computation: benefits come with vulnerabilities
John C. Mallery
24
MIT CSAIL
Focus: Cyber
Attack/Exploitation

Cyber attack/exploitation undermines organizational
autonomy



Everyday cyber impacts – death by 1000 cuts




Computers become disloyal to owners, working against them
Reduced organizational integrity impairs goal seeking
behavior and weakens adaptive capacity
Economic: Drag on GNP of cyber crime, recovery, cyber
security investment
Innovation: Loss of intellectual property, trade secrets, knowhow, plans
National security: Degraded systems, loss of classified
information
Potential existential threats via cyber



John C. Mallery
Industrial espionage: Loss of commercial or national
advantage
Economic disruption: Degradation of critical infrastructures
Cyber war: Impairment of national security functions
25
MIT CSAIL
Attacker Resources
Required for Cyber Impacts
Low Frequency
Low Frequency
Cyber War with Peers
High
I c
m t
p
a
Interdiction of Global
Communication
Major Critical
Infrastructure Attacks
Cyber Terrorism?
Interception of Global
Communication
Cyber War
Espionage
High Frequency
Industrial Espionage
Cyber Crime
Low
Most
Cyber
Data
John C. Mallery
Moderate Frequency
Low
Attacker Resources
26
High
MIT CSAIL
Strategy Decomposition

Cyber technology base

IT capital goods industry
 Computers, embedded, mobile
 Networking



Telecommunications operators
Identity management & crypto industries
Defense domains






Military & intelligence systems
Defense industrial base
Critical infrastructure
Government systems
Research infrastructure
Supply Chain
 Major enterprise
 Enterprise


Consumer
International cooperation



John C. Mallery
Allies
Trading partners
Global
27
MIT CSAIL