Cybersecurity Definitions and Academic Landscape Balkrishnan Dasarathy, PhD Program Director, Information Assurance Graduate School University of Maryland University College (UMUC) Email: Balakrishnan.Dasarathy@umuc.edu Talk at the NPSMA Workshop Arlington, VA November 13, 2013
Talk Overview Definitions Key Concepts in Information Assurance (IA) / Cybersecurity Drivers in determining the contents of a Cybersecurity Program Cybersecurity education characteristics 2
Definitions Security: In its most basic sense means the protection of assets from harm. Information Security: Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality, and availability. Federal Information Security Management Act (FISMA) definition) (H. R. 245848 (2002). Retrieved from: http://csrc.nist.gov/drivers/documents/fismafinal.pdf) Computer Security: The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources NIST (1995). An Introduction to Computer Security: The NIST Handbook, Retrieved from:: http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf 3
Definitions (Contd.) Cybersecurity: The ability to protect or defend the use of cyberspace from cyber attacks. Cyberspace: A global domain consisting of the interdependent network of information systems infrastructures including the Internet, telecommunications networks, computer systems, and embedded processors and controllers. NIST (2013). Glossary of Key Information Terms. NISTR 7298, Revision 2, Retrieved from: http://nvlpubs.nist.gov/nistpubs/ir/2013/nist.ir.7298r2.pdf Information Assurance Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and nonrepudiation. This includes providing for restoration of information systems DoD (2007). DoD Directive 8500.01E Subject: Information Assurance. Retrieved from: http://www.dtic.mil/whs/directives/corres/pdf/850001p.pdf IA in practice Emphasizes risk analysis (Is money being spent wisely?) and corporate governance issues such as privacy, regulatory and standards compliance, business continuity and disaster recovery as they relate to information systems 4
Definitions (Contd.) Computer Science: Computer Science is the study of the feasibility, structure, expression, and mechanization of the methodical processes (or algorithms) that underlie the acquisition, representation, processing, storage, communication of, and access to information Boston University. (n.d.). Computer Science Definition. Retrieved from: http://www.cs.bu.edu/aboutcs/whatiscs.pdf Information Assurance Compliance Governance Cybersecurity Computer Science 5
Key Concepts in Cybersecurity Confidentiality CIA Triad of Information Security They often conflict; so trade-offs needed Authenticity and non-repudiation are often added to CI Your security is only as strong as your weakest link or point Risk Analysis There is no infinite budget Mediate completely Least privilege Mutual suspicion Security should be baked in Defense in depth 6
Secure Design Principles Separation of domains (Segmentation) Encapsulation (Minimize attack surfaces) Fail secure Genetic diversity 7
Defense in Depth Practice of layering defenses Not all controls will fail at the same time Use of multiple technologies and tools in the same layer Controls in multiple manner: technology, operations (trained people) and management NSA (n.d.) Defense in Depth. Retrieved from: http://www.nsa.gov/ia/_files/support/defenseindepth.pdf 8
Defense in Depth (with example technologies) Perimeter (Network Layer) Boundary Routers VPN Firewalls Network IDS/IPS RADIUS NAC Gateway Anti-Virus Software (Application Layer) Web Service Security Application Proxy Database Security Content Filter Data Encryption Proxy Servers Spam Blocker Input Validation Identity Management Personnel (User Layer) Multiple &Controls Across Multiple LayersTraining Authentication Authorization PKI RBAC Two-Factor Authentication Host IDS/IPS Desktop Anti-Virus Biometrics Clearances Host (Platform Layer) Server Anti-Virus Server Anti-Spyware Patch Management Server Certificates Physical Security Locks Biometrics PIV Credentials/ID Badges CCTV Disaster Recovery/COOP Guards RFID 9
Drivers for IA/Cybersecurity Program Content NSA/DHS Center for Academic Excellence (CAE) in Information Assurance/Cyber Defense Education Core and Optional Knowledge Units Many institutions now preparing for re-designation / designation National Cybersecurity Workforce Framework developed by the National Initiative for Cybersecurity Education (NICE) KSA (Knowledge, Skill and Ability) KSAs provide a basis for competency-based education 10
CAE IA-CD Knowledge Units National Security Agency (2013). National Center of Academic Excellence. Retrieved from: http://www.nsa.gov/ia/academic_outreach/nat_cae/index.shtml Core Knowledge Units(KUs) 2 Year Core IA Fundamentals (Cyber defense, cyber threats, crypto) Security Design Principles Scripting., System Admin Law, Ethics and compliance Four year Includes 2 year core Programming, OS, DBMS, and Networks (Solid Computer Science background) Optional Knowledge Units Specialties (e.g., Forensics, Software Assurance) 11
National Cybersecurity Workforce Framework Categories Securely Provision Operate and Maintain Oversight and Development Course Replacement Framework Categories Protect and Analyze Defend Collect and Operate Investigate 12
Cybersecurity Workforce Framework KSAs Department of Homeland Security (n.d.). National Cybersecurity Workforce Framework: Knowledge, Skills and Abilities. Retrieved from: http://niccs.uscert.gov/training/tc/framework/ksas) Organized hierarchically (Top Level: Category, Middle Level: Area, Low Level: KSA) e.g., Category: Securely Provision Area: Technology R&D KSAs: Ability to apply network programming toward client/server models; knowledge of telecommunication concepts; Skill in applying and incorporating IT technologies into proposed solutions 13
Characteristics of Good IA/Cybersecurity Programs Characteristic Highlights Holistic databases, OS, networks, testing and V&V, law, privacy, risk analysis, cryptography Interdisciplinary IT, telecom; law, policy, digital crime investigation Diverse Offerings PhDs, Masters, Bachelors and Certificates in IA, Cybersecurity, Policy, Forensics and Homeland Security, etc. Hands-on Strong lab components Business Focus PSM, Industry scholarships Research Orientation Research at all offerings Global Global collaboration and perspectives and common language David Jarvis (April 2013). Cybersecurity education for the next generation. IBM Center for Applied Insights, Retrieved from: http://www.slideshare.net/dajarvis/cybersecurity-edu-forthenextgenexecdeck042513final 14