Michael Oehler This is Hard We are an

Michael Oehler

This is Hard • We are an equal opportunity intrusion detector. – Alerts occur irrespective of the mission impact. • We are still incident focused – We respond to today’s worm, virus, bot. Net And not on the (big) structured threat.

This is Easy (Well, these are hard too) • Extrapolate security into Real Time Systems – Absolutely necessary but not sufficient for the criticality of these systems. • Security Services (CIA, APAIN, ICAA, …) – and the Classical/corresponding security matrix – Availability and Integrity • • Defense in Depth Protect, Detect, Respond, & Restore People, Processes, & Technology 8 Disciplines of Information Assurance Continued…

Security Domains for RT Sys • System Evaluation, accreditation, and certification • Vulnerability Assessments: – Risk = Threat Vulnerability Value - Counter Measures • Battle Damage Assessments • Recovery, restoration, Continuity Operations • Code Validation, Security Engineering, formal methods, security fault analysis • Physical Security for PCS and SCADA • Emanation and caustic resilience • Communications Security and secure management • Attack sensing and warning, IDS, IPS • Fault tolerance and graceful failures • Interconnectivity policies & Interdependency models

The end Classical Security Quotations • “Security is a process, not a product. ” – Bruce Schneier • Hard and crunchy on the outside soft and chewy on the inside. – Don’t let this be the design philosophy driving your design. – • “There is no security through obscurity. ” Defense in Depth! • If I own your machine and you patch it, I still own your machine. – Corollary: A popped box patched is popped Myth: ostriches do not bury their heads in the sand!