ARL_Cyber_2016_Industry_Day-Slides.pptx

U.S. Army Research Laboratory

Cyber Industry Day Presentation 13 December 2016 Curtis Arnold Chief, Sustaining Base Network Assurance Branch Director, Cybersecurity Service Provider (CSSP)

Approved for Public Release The Nation’s Premier Laboratory for Land Forces

The Nation’s Premier Laboratory for Land Forces This industry day’s purpose is twofold.

First, to provide background information on ARL’s Cyber program to help explain the size and complexity Second, to gain awareness from industry on their capabilities and abilities to perform at the level and complexity of the ARL mission

The Government will not be answering questions concerning the type of vehicle, expected costs, or other related issues today.

Please submit any questions concerning this industry day in writing to Jessica Camunez at jessica.r.camunez.civ@mail.mil by 16 December 2016 Purpose

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces This support is for one of the largest, most complex Cyber research programs within the DoD. It has three major focus areas. They are;

Cyber research – Includes both theoretical and applied research that is operationally grounded and transitioned to a number of partners 24/7 Operational Research Support Components – Responsible for providing Defensive Cyber Operations (DCO) around the world in support of the research components ARL Information Assurance Manager (IAM) Support – Provide expert cyber policy and procedures support for ARL Areas of Focus

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces U.S. Army Research Laboratory

The ARL Sustaining Base Network Assurance Branch (SBNAB) vision provides world-class cyber research and development laboratory, which is operationally focused and relevant, to confront the most sophisticated and damaging cyber threats for the U.S. Army and the DoD.

Mission Vision

The ARL SBNAB mission is to be a recognized leader in the Cyber R&D field through advanced research and collaboration and staying operationally focused by providing Defensive Cyber Operations (DCO). Researching and investigating the next generation of defensive cyber operational tools, techniques, and procedures; tactical network security; exploring prospective sensor capabilities; executing components of information security continuous monitoring; risk measurement and monitoring; improving adversary attribution; and insider threat analysis.

Customer Base Personnel Support

400, projected growth 700+ by FY18 200, projected growth XXX by FY18

Data Resources

Need insight here…..XXX by FY18

The Nation’s Premier Laboratory for Land Forces

S&T in RDECOM

XM25

Counter Defilade Target Engagement System Discovery Innovation Advanced Development

Translational Neuroscience

ARL

RDECs PMs/PEOS Engineering & Production Support to Warfighter

Face-Gear Technology for Block III Apache

MRAP Armor

MEMS TBI Sensor

LCMCs

ARL / RDEC LNOs Embedded in TRADOC COEs

The Nation’s Premier Laboratory for Land Forces

Understanding and exploiting interactions with cyber attackers – human and/or intelligent agents Defense of information systems and networks Assurance of persistent information support to Soldiers

Technical Areas:

Understanding the Cyber Threat Automated Detection of Hostile Activities Prevention & Defeat of Hostile Activities Risk Characterization Agile Adaptation Psycho-social Effects Big Data Platform and Analytics Cybersecurity

An agile fighting force in the cyber domain able to defeat sophisticated cyber adversaries

Vision

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces

Assessing vulnerabilities & trustworthiness Anticipating the impacts of malicious activities Approaches to rapid recovery Inference of Attacker TTPs Comprehend Psychosocial Aspects of Adversary Actions Cognitive Effects on Cyber Analysts Planning and control of cyber maneuvers Denial and Disruption of Enemy Networks Secure Network Availability to Essential Operations at all times

Challenges and Impact Cybersecurity

UNCLASSIFIED

Unique Cyber Approach

Operationally-grounded R&D, based on experience and input from the field:

Transfer & Cross Training of Personnel Among Teams Computer Network Defense Service Provider (CSSP) Highlights ARL is a Tier II CSSP – 6, Innovative Capabilities identified in 2016 by DISA.

430 DODIN Circuits Monitored across 4 DOD Networks Over 21 Billion records (Flow | Raw Data | Tool Alerts).

Over 21 Thousand confirmed Incident or Event Reports.

Security Control Assessor – Validator (SCA-V) Highlights ACA Assessment tool adopted by Army Enterprise in 2009 DIACAP & RMF (Boots on the ground experience) Remote Assessment significantly influences CCRI results Virtual Inspection Program (25% resource recovery) Army Cyber Research and Analytics Laboratory (ACAL)

UNCLASSIFIED

UNCLASSIFIED

CSSP

Network Monitoring

Compliance Oversight

ACAL

R&D Center

Assessment

C&A Validation Support

Systems Engineering Support

IA Whitepapers

Systems Engineering Consulting

Incident Response

Threat Analysis

Software Source Code Reviews

Cyber Training Environment

R&D Themes

R&D Themes

Inducing Change Risk Decision Support Accelerating Transition to Practice Resilient Maximizing Research Impact

R&D Strategy

Secure

Big Data Analytics Building Trustworthy Resilient Systems Cloud Computing Cyber Attack Detection and Analysis Cyber Attack Protection, Prevention, and Preemption Cyber Attack Response and Recovery Supply Chain Risk Management Moving Target and Dynamic Cyber Defenses Insider Threat Information Security Continuous Monitoring Hardware–Rooted Security in Mobile Devices Cyber Situational Awareness Designed–In Cybersecurity

Innovation Confidence

UNCLASSIFIED

Techniques for detection and identification Methods for active responses Approaches to characterizing risks Quantifying effects of cyber maneuvers Actionable Cyber Intel for Real-time situational awareness

CURRENT RESEARCH

MAXIMIZE DEMAND REDUCTION AND IMPROVE RELIABILITY; MAINTAIN OVERMATCH; CONTINOUSLY UPGRADE, PROTECT AND SIMPLIFY THE NETWORK AWFC 1,3,7,11,13,16,19

FUTURE TECHNOLOGY

Rapidly transform friendly cyber resources to deny adversary cyber actions

Autonomous and covert collection and analysis Methods to destroy enemy cyber assets Agent-based integrated collaborative planning Autonomously update and replace cyber agents Degrade, disrupt, deny, deceive, and destroy adversary cyber capabilities Information Sciences Campaign Key Campaign Initiative 1 Cyber Fire and Maneuver in Tactical Battle

0101110010101001

Speed/Agility Cost (person – days) per major new threat weeks days hours seconds

MOSTLY MANUAL PROCESSING

We need this:

We have this:

10-1 10 0

AUTOMATED PROCESSING

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces

Series 1 Series 2 Series 3

Understanding the Cyber Threat Understanding the Cyber Threat:

Understand cyber attackers, their tools, techniques, tactics and procedures, infrastructure, and psychosocial aspects of the intent and preferences of their actions.

Enable better training, more effective cyber tool development, and reduced cognitive load through the derivation of models of cyber defender cognitive processes.

Develop novel techniques to visually analyze the cyber domain, assess situational awareness, and identify sophisticated adversaries with reduced cognitive load based on proven scientific foundations.

The Nation’s Premier Laboratory for Land Forces Automated Detection of Hostile Activities

Detection:

Anticipating, detecting & analyzing malicious activities—Theories & models that relate properties of cyber threat detection & recognition to properties of malicious activity Enhance and explore detection capabilities using statistical, machine learning, and graph theoretic approaches to understand of the limits of cyber threat detection.

Develop on-device real-time protection against emerging threats that can be tailored to both mission requirements and device capabilities

Approach Enhance sensing techniques, characterize impact of sensing Detection of advanced stealthy scans Machine learning in malware identification Tools for rigorous testing of detection and analysis capabilities Automated Detection of Hostile Activities:

Understand theories, models, and optimized methods of properties and behaviors of processes by which automated and human agents detect, recognize and comprehend malicious activities conducted of adversaries on friendly networks and hosts

UNCLASSIFIED

Goal: Develop a rigorous science of cyber-security Theories & models of detection that provide:

What is the most likely threat What impact will it have The confidence in the process

DETECTION

Theories & models of system agility that reason about:

The universe of security-compliant maneuvers & end-states The impacts of maneuvers on humans & outcomes

AGILITY

Theories & models of user behavior in cyber-environments:

Classify user intent & capability Predict how a user will react to stimuli Induce mitigating adversarial behavior Psychosocial Effects:

A Cross-Cutting Research Issue Theories & models of risk assessment in cyber-environments that combine:

System & network risk Human oriented risk

RISK

Formal structures for reasoning about cyber-maneuvers & security goals/ strategies

Mathematical representations that are decomposable & composable in ways that make analysis tractable & answer key questions Operations Model:

An Integrating Framework Lead Research Organization

Cyber Security Collaborative Research Alliance

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces

Vision and Objective:

Develop foundational science:

to advance the state-of-the art in network science by understanding the interplay between networks of multiple genres under complex, military-relevant conditions.

through characterizing the adoption of new technology and analyze its impact on tactical networks Impact:

Fundamental understanding of the dynamics that characterize complex, multi-genre networks and the data generated by them Approaches to develop capabilities to model, provision and execute hybrid virtualized/physical experiments Extensible multi-genre experimental framework that enables the testing of various network science scenarios Military Problems being Addressed Assuring uninterrupted access to critical communication and information links given the constraints of a hybrid tactical network environment Developing network interactions that sustain a high degree of situational understanding

Experimental Methods for Multi-Genre Networks

Objective To have an integrated, network science experimentation platform that provides increased understanding of interaction between different types of networks and the ability to measure the effects one layer has on another.

Approach Develop capabilities on which any collaborator could perform their experiment & collect data Stay consistent in designing experiments, implementation and execution Investigate and integrate other NS CTA capabilities into this framework Demonstrate hybrid networking capability by performing field experiment utilizing WNaN and CSR radios Impact The creation of an experimentation framework and environment for integration and interoperability of different network components Lowers the integration effort Shared experiments Realistic network environment to test and validate capabilities

Experimental Methods for Multi-Genre Networks

The Nation’s Premier Laboratory for Land Forces

Scenarios & Environment Related work:

NRL

NATO-IST-124 “Heterogeneous Tactical Networks: Improving Connectivity and Efficiency” Network Science Experimentation & Software Framework Publications:

Q1: Tech Report: Design and Implementation of DAVC 2.0 using fiber optic backbone Q2: Case Study: Bare metal vs virtual vs containers Q3: SPIE paper on field experimentation Q4: Conf. Paper/TR: Updates & Documentation on DAVC extensions to support experimentation in tactical SDN

Problem: Ability to understand multi-genre networks is challenging and hinges on ability to characterize the interconnectivity that exist Goal: Develop a medium for linking various Network Science models to enable coherent analysis of the behavior of complex hybrid systems Approach:

Develop scenarios that highlight basic network properties which can be used to study different areas of Network Science research Enhance experimentation environment to utilize advances in emulation and networking technologies Conduct experiments to establish baseline metrics of hardware performance under various build and utilization configurations Impact:

Ability to challenge, compare, extend, validate and invalidate proposed theories, models and methods in network science

The Nation’s Premier Laboratory for Land Forces Visualization Problem: Visual ability to extensively comprehend the results of network science related experiments

Goal: Understanding and comprehending multi-genre network topographies, traffic flows, and other network characteristics

Approach:

Develop ability to gather data from experiment into the ARL VizFramework Develop a method for classifying data to distinguish between multiple experiments, runs, and data owners Convert large network science datasets into an exploitable format where new knowledge and concepts can be inferred ElasticSearch, Splunk, Mongodb

Publications: ARL-TR-7561 Transitions/Collaboration:

NATO, CERDEC, NRL, AFRL

The Nation’s Premier Laboratory for Land Forces Internet of Battlefield Things Goal: Explore new approaches to encoding, transmitting, deconflicting and optimizing information delivery and processing through previously unexplored network configurations, channels, protocols and allocation techniques

Approach:

Analysis and fusion of multi-modal heterogeneous information, in the context of the mission, including quantification of risk and uncertainty Sensors are distributed throughout the NSRL to detect temperature, movement, and provide a timebase among other events

Publications: Technical Reports Transitions/Collaboration:

CERDEC, OSD, NRL, AFRL, NATO

The Nation’s Premier Laboratory for Land Forces CSSP Roles and Responsibilities CSSP Service Provider (Tier 2) Primarily responsible for reporting incidents to Tier 1 Conducts higher level Incident Response & Analysis Responsible for providing external assessment support Enclave Perimeter Intrusion Detection and Monitoring Provide higher level AS&W / I&W SA capabilities Disseminate Tier 1 information, guidance, and direction CSSP Service Subscriber (Tier 3) Reports to provider on incidents/issues Conducts initial Incident Response & Analysis Reviews results of external assessments reviews and alerts Tier 2 as required Provide lower level intrusion detection and monitoring to Tier 2 Align to a provider via MOA/SLA for some CSSP services Implement and execute Tier 2 guidance

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces Understanding CSSP DoD Cybersecurity Services are broken down into four Functional Areas:

PROTECT

DETECT

RESPOND

Event Prevent React

Vulnerability Assessment and Analysis

Vulnerability Management

Malware Protection

INFOCON/CPCON

Cyber Incident Handling

Information Security Continuous Monitoring

Insider Threat

Warning Intelligence

Attack Sensing & Warning (AS&W)

SUSTAIN

Program Management

Personnel

Security Administration

Service Provider Information Systems

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces

IDS Framework

Centralized, modular design promotes rapid integration of tools addressing evolving threat

Captures, prototypes, and implements innovations of analysts, academics, & external experts

Tests concepts quickly with in-house analysts in live environment (feedback focuses R&D efforts)

Enables forensic analysis of post-penetration activities

Expandable computational, storage, & network capabilities

POD concept allows distribution of central workload & conservation of bandwidth

Modular design permits flexible arrangement of PODs Diverse partners/customers, including NSA, HPCMP, AMC, DISA, NARA, universities & industry

Ingest

POD

POD

POD

POD

NIPR

DREN

Other Internet Providers Raw Data Store Experiments Tools Detects Incidents Management Data Analysis Systems Administration Reports Sensor Sensor Sensor Central Facility Diverse partners/customers, including NSA, HPCMP, AMC, DISA, NARA, universities & industry

CYBERCOM

ARCYBER

The Nation’s Premier Laboratory for Land Forces Consolidated Virtual Inspection Program (CVIP)

Contribution Consolidated 5 distinct cyber inspection checklists into one overarching checklist since 90% of the controls overlap.

Successfully executed both an onsite and remote assessment for West Point (USMA) and the Indiana National Guard using the CVIP checklist.

Objective: Provide a comprehensive, remote view of network security compliance with IA policies and configuration requirements, leveraging DoD enterprise-wide capabilities

Insight: ARL is positioned to collaborate in this space with the DoD Cyber components and others to enhance the Department’s assessment capabilities. Partnering with NSA to develop a framework for conducting remote assessments using the OCIL tool suite.

Result: Remote assessments have proved successful in providing a near real time view of a site’s security posture, thereby reducing costs and timelines that allow for improved resource recovery of vital assets.

Impact From the CVIP inception, 2012-2016, the ARL CDSP subscribers have been subject to 179 CCRIs.

93% pass rate for all subscribers that have participated in the remote assessment. 11 of 13 failures can be directly correlated to their non-participation with the remote assessment.

The Nation’s Premier Laboratory for Land Forces

ISCM Project Overview Continuous Monitoring: on-going observation, assessment, analysis, and diagnosis of an organization’s cybersecurity posture, hygiene, and operational readiness

The following widgets will be implemented on a data-intensive computational platform with the intent of providing in-depth situational awareness for decision makers:

MDA

NMA

VMA

RMA

AMA

ISCM

Asset Management

Malware Detection Network Management

Vulnerability Management Risk Management

Insight: ARL is integrating an ISCM solution in collaboration with representatives from DISA, NSA, and the DoD CIO’s office. This solution will provide the foundation for classification-agnostic analytics that will advise Army cyber security shaping efforts.

Result: Capability that maintains ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. Allows both GOTS and COTS plug-ins as needed to fill threat gaps, yet is open and flexible.

Collaboration Partners

UNCLASSIFIED//FOUO

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces

One-on-One Meeting Questions for Discussion:

1) Explain your methodology and capabilities to integrate research and development with a world-wide cyber security defense operation that continues to expand?

2) Explain your organization’s methodology for supporting large scale (PB) distributed DoD standard computation environments from both an R&D and production/operations perspective. Additionally, describe some of the technologies and methodologies that you have used for correlation and aggregation of high volume and high velocity data sets.

3) Explain your methodology and capabilities to conduct cyber research and development that is operationally focused and relevant, to confront the most sophisticated and damaging cyber threats for the U.S. Army and the DoD?

Please submit follow up questions to- Jessica Camunez jessica.r.camunez.civ@mail.mil or the Small Business Specialist Anne Carman anne.m.carman.civ@mail.mil Thank You Curtis Arnold Chief, Sustaining Base Network Assurance Branch Director, ARL Cybersecurity Service Provider (CSSP

UNCLASSIFIED

The Nation’s Premier Laboratory for Land Forces image5.jpeg image6.png image3.jpeg image7.png image4.png image18.png image19.png image11.png image12.png image13.png image14.png image15.png image16.png image17.png image27.jpeg image20.png image21.jpeg image22.jpeg image23.png image24.png image25.jpeg image26.png image28.png image29.png image30.png image31.png image32.png image33.jpeg image34.png image35.png image36.png

Microsoft_Excel_Worksheet1.xlsx Sheet1

Series 1 Series 2 Series 3

To update the chart, enter data into this table. The data is automatically saved in the chart.

image43.png image44.png image45.jpeg image46.jpeg image47.png image37.jpeg image38.png image39.png image40.jpeg image41.png image42.png image48.png image49.jpeg image50.png image51.png image59.jpeg image52.png image53.png image54.png image55.png image56.png image57.png image58.png image60.png image61.png image62.png image63.png image64.png image65.emf image66.png image67.png image68.png image69.png image70.png image71.png image72.png image73.jpeg image74.jpeg image75.jpeg image76.jpeg image77.png image78.png image79.png image86.png image80.png image81.png image82.png image83.png image84.png image85.png image1.jpeg image2.png