NSA - DIB Cybersecurity Services - WEXMAC 2.0 Industry Day Brief.pdf

OVERALL CLASSIFICATION:

UNCLASSIFIED

We harness the power of industry partnerships to prevent and eradicate foreign cyber threats from our nation’s most critical networks.

Our efforts focus on the Department of Defense (DoD), the Defense Industrial Base (DIB) and National Security Systems (NSS).

We establish open, robust and collaborative relationships

Designed to protect against the primary methods that adversaries are weaponizing against the DIB

Our Cybersecurity Services

Endorsed and Paid For by DoD CIO

Provided through third parties (competitively awarded contracts)

Bolstered by NSA threat intel

Supports NIST 800-171 requirements

Low barrier for entry:

Active DoD contract (sub or prime) OR access to non-public DoD information

DIB PRIMES

Our Core Services

PROTECTIVE

DNS (DNS FILTER)

DIB SMBs

ATTACK SURFACE

MANAGMENT

THREAT INTELLIGENCE

COLLABORATION

NIST 800-171

System & Information Integrity

3.14.03

NIST 800-171

Risk Assessment 3.11.02, 3.11.03

NIST 800-171

System & Information Integrity

3.14.06

& how they support NIST 800-171 controls

Protective DNS (DNS Filtering)

The Domain Name System (DNS) is the phone book of the Internet.

As with many Internet protocols, DNS was not built to withstand abuse from malicious actors.

DNS can be used to phish credentials, download malware, conduct command and control, or exfiltrate information.

- 1 in 3 breaches could have been contained by DNS filtering

- 80% of surveyed orgs experienced a DNS attack in

THE THREAT

Protective DNS adds a threat intelligence check against all DNS queries to sinkhole known bad domains. It integrates easily with existing security architectures via a simple recursive resolver switch.

THE SOLUTION

Built on Akamai’s GovShield architecture, NSA’s PDNS combines commercial and government threat intelligence to block malicious activity

Protective DNS: IMPACT

Malicious/suspicious domains blocked to date, including nation-state spear phishing, malware, botnets, and ransomware activity

2.8B of unique IOCs fed into our proprietary blocklist weekly100s

Our team identified domains used for malicious network command and control in industry partner networks using NSA’s unique intelligence posture.

We provided guidance so that industry partners could surgically remove these threats

Further inspection illuminated additional pernicious domains, which we added to our knowledge base for continued strengthening of DoD networks

Through our cybersecurity services, we improved the hygiene of our industry partner networks and deepened our intelligence base.

Attack Surface Management

Attack Surface Management begins with asset discovery, taking an “adversarial approach” to identify Internet-facing assets for DIB organizations

Once assets are determined, vulnerability assessments are conducted to find vulnerabilities or misconfigurations through more thorough scans of an organization’s Internet-facing network assets

DISCOVER PRIORITIZE REMEDIATE

All participants received a tailored, threat-informed report on issues found

FIND AND FIX ISSUES BEFORE THEY BECOME COMPROMISES.

Attack Surface Management: IMPACT vulnerable hosts identified

~10,000 Vulnerabilities found across DIB networks

1.3M of a zero-day vulnerability under active exploitation by

APT5

Identification & Eradication

Assisted in under active exploitation, CVEs with POC for an exploit released, etc.

Flags CVEs

Threat Intelligence Collaboration

STAY A STEP AHEAD OF THE ADVERSARY.

“Push” mechanism Access to NSA analysts and technical expertise Receive non-public, DIB-specific, threat intel Collaborate and conversate on CTI Ability to submit company-specific RFIs

Together: we have discovered, exposed, and mitigated multiple nation-state campaigns targeting the DIB

Mitigate email-based threats by providing a commercial email gateway service that quarantines malicious emails. The gateway analyzes emails for phishing and malSPAM. Potentially malicious files and URLs are sandboxed, analyzed, and quarantined.

Phishing Protection

Support small and medium companies in critical supply chains by providing a SIEM platform with analytics geared towards detecting advanced persistent threat activities.

Threat Hunting

Discover cloud assets and configurations across all major cloud providers.

Perform vulnerability assessment and apply corrective actions through automated controls.

Cloud Security

External or internal tests run through Software as a Service offering. Discovers how vulnerabilities and misconfigurations can be chained to gain access to critical resources with proof of exploitability and specific mitigation guidance.

Autonomous Penetration Testing

Future Cybersecurity Pilots

What do you get out of this?

Secure warfighter (data, comms, weapons, etc.)

Proprietary tech is protected, ensuring national security and economic advantage

We understand how our adversaries are targeting the networks we care about the most (greater insights)

We impact our adversaries’ cyber operations – with ripple effects

We help SMBs below the “cyber poverty line”

What does NSA get out of this?

Free stuff

Improved cyber hygiene

Improved protection of your proprietary information

Reduce risk of becoming a victim to a costly incident

Support on your CMMC journey

Access to additional cybersecurity pilots down the road

CALL TO ACTION: ENROLL & TELL YOUR FRIENDS

Eligibility Confirmation

Contact Us

Sign Agreement

Services Enrollment

In some cases, this process can take less than 15 minutes

DIB_DEFENSE@cyber.nsa.gov www.NSA.gov/CCC @NSAcyber