Stitched in a Security Fabric: Big Data Veracity NIST BGWG

Transcription

1 Stitched in a Security Fabric: Big Data Veracity NIST BGWG

2 Mark Underwood CEO Business Process Architect DHS/DOD Cybersecurity R&D CEP AI JIT Learning Business Intelligence QlikView consultant at Honda, Qualcomm Cover Big Data public companies for OTR Global

3

4

5 What provenance do you see?

6 Peel the Onion Exchangeable image file (EXIF) data Geolocation Image feature extraction

7 Big Data GRC and Forensics Premise: Complete logging, audit and forensics for a Big Data system could be Bigger (along some V dimension) than the system itself. Provenance may have temporal contexts If consideration of these possible needs was not made at design time.

8 Providential w/o Providence

9 Air France 447

10 Airbus A330 Cockpit

11 Alt 1 Alternate law 1 (ALT1) mode combines a Normal Law lateral mode with the load factor, bank angle protections retained. High angle of attack protection may be lost and low energy (level flight stall) protection is lost. High speed and high angle of attack protections enter alternative law mode. ALT1 may be entered if there are faults in the horizontal stabilizer, an elevator, yaw damper actuation, slat or flap sensor, or a single air data reference fault. Wikipedia Imai, S., Klockowski, R., Varela, C. A., Dec Self Healing spatiotemporal data streams using error signatures. In: Computational Science and Engineering (CSE), 2013 IEEE 16th International Conference on. pp URL

12 You be the pilot You encounter turbulence Alt 1 is engaged by avionics software Some readings look wrong Some readings look right What does your training say?

13 Software Behavior? What should software do?

14 Real time analytics

15 AeroPerú Flight 603

16 Android Wear Body sensing networks

17 Metadata to the Rescue?

18 Old School Lessons Know your data Garbage in Garbage Out Missing data can mean lots of things: Lost measurement Trigger to obtain similar data from another source Not applicable Data profiling Machine learning of data Failure analysis No direct access to data w/o mediation Link to ontologies / Linked Data Application Design

19 What goes unreported?

20 New School Lessons Data never dies. This is new! Cascading failure is not all that unusual Superstorm Sandy: No power for 10 days at Power Telecommunications Fuel (Supply Chain interruptions) Panic (Consumption spikes, hoarding) Systems Big Data Included are Systems + People 9/11 Connect the Dots under duress? Metadata could be as large as the Big Data Provenance failure can have many causes! Pessimism

21 Smarter Attacks on Smart Grids?

22 Big Data Attack Surface: Big Every end point Every application Data in any storage mechanism Any component component interface Compromised penetrations could be more difficult to localize Pen testing is unwieldy maybe impossible for some settings Resilience testing for Big Data for some applications may have no precedent e.g., testing for specific types of failure Attack concealment may be facilitated by lack of temporal metadata e.g., release management

23 Copy the Whole Instance Recreation of some data may require a copy of the code, data and instrumentation that created the data. Recalibrate what calibration means in Big Data systems Security & Privacy test points need to be design features Forward and backward provenance flow Needs for app development environments may overlap Needed for forensics

24 PII Portals Citizens and patients will demand accountability for the privacy data even if they have technically agreed to give it up Tolerance for incorrect PII data will be lower than for credit reporting Firms may need to build internal systems that anticipate security lapses in Big Data because risks are correspondingly Big

25 Provenance in S&P Fabric Consider existing solutions, extended for Big Data RA Prov4J Allows expressive provenance queries Leverage semantic web to ease management challenges for provenance data Provide mechanisms for capturing provenance data Discovery mechanisms for provenance descriptors on the Web Open Provenance Model escience workflow focus SPADE SRI provenance collection and management system Notion of provenance tracing PAFS Provenance Aware DFS