Systems Engineering and the Security Imperative

1. Systems Engineering and the Security Imperative INCOSELas VegasSeptember 15-18 Rick Dove Chairman, Agile Security Forum (an open participation initiative in formative stage) www/parshift.com/AgileSecurityForum SecurityForum@parshift.com

2. Security Strategy Elements Policy: Goals, and principles governing how goals may be attained. Procedure: Proscribed method for satisfying policy. Practice: Implementation that carries out procedure. Security Strategy Is... a business system, not a collection of vendor technologies.

3. Examples

4. Information Security - Today • The Facts • Vulnerability – Increasing points and modes of attack • Threat – Increasing attackers and incidents • Risk – Increasing value available for compromise • The Result • Time stolen by security measures is increasing • Money invested in security measures is increasing • Effectiveness and life-cycle of security measures are decreasing • ROI is Declining!

5. Security's Seven Ignorances of Reality • Human Behavior – Human error, whimsy, expediency, arrogance, ... • Organizational Behavior – Survival rules rule, nobody's in control, ... • Technology Pace – Accelerating vulnerability-introductions, ... • System Complexity – Incomprehensible, unintended consequences, ... • Globalization – Partners with different ethics, values, infrastructures, ... • Agile Enterprise – Outsourcing, on-demand, webservices, transparancy, ... • Agile Attackers – Distributed, collaborative, self organizing, proactive, ... For 50 years of IT-progress, management policy/procedure/practice has followed behind ... patching potholes.

6. SP SP Attacker Behavior SP Maintaining Systems in Unstable StatesTakes Constant Energy Input Security Process Human Behavior Security Process Laws Litigation Penalties Regulation Rules Threats Org Behavior Reality Landscape Expecting or enforcing ideal and repetitive behavior ignores reality... and is not a substitute for Strategy

7. A Rational Strategy Requires New Knowledge • A rational view of the problem: • Reality bites – what is its nature? • The problem is bigger than technology – what is its nature? • The situation is in constant flux – what is its nature? • A rational view of the solution: • You are compromised – now what? • Situation in constant flux – what is proactive response-ability? • Excellence – what is its nature?

8. Problem Analysis Frwks Agile Security Forum Pathfinder Initiative www/parshift.com/AgileSecurityForum Problem AnalysisKnowledge Frameworks include Focus Reality Issues Situation Agility dealing with with reactive domains of with proactive domains of arising from Technology Pace Systems Complexity Policy Correction Creation Agile Enterprise Globalization Procedure Variation Improvement Human Behavior Otg Behavior Practice Expansion Migraation Agile Attack Community (Perhaps More) Reconfig- uration Modification The Bite Problem Breadth Situation Flux

9. Solution Fitness Frwks Agile Security Forum Pathfinder Initiative www/parshift.com/AgileSecurityForum Solution FitnessKnowledge Frameworks include Excellence Principles Agile Principles Reality Objectives of with proactive domains of with reactive domains of of Self Contained Units Evolvable Framework Requisite Variety Vulnerability Anticipation Detection Plug Compatibility Elastic Capacity Parsimony Prudence Containment Facilitated Reuse Self Organization Delight Transfor- mation Mitigation Deferred Commitment Distributed Ctrl & Info Threat/Risk Anticipation Assessment Redundancy & Diversity Peer-Peer Interaction Migration Recovery [Rick Dove, Response Ability, Wiley 2001] Accountability Accountability (proactive) (reactive) Situation Flux Excellence Nature Assume Compromise

10. Excellence Principles – Strawman Framework • Requisite Variety • Ashby's Law: "The larger the variety of actions available to a control system, the larger the variety of perturbations it is able to compensate....variety must match variety." • Any effective system must be as agile as its environmental forces. • Reality-compatible (rational) policy, procedure, and practice. • Functional Quality. • Parsimony • Occam's Razor: Given a choice between two ... choose the simplest. • Unintended consequences are the result of complexity. • Humans can only deal with 5-9 items simultaneously. • Bounded rationality (Herb Simon). • Reduces perceived Risk. • Delight • Engenders feelings of Trust and Respect. • Aesthetic Quality.

11. Reality Objectives - Strawman Framework Reactive Principles Detection – Detect intrusion and damage quickly Containment – Minimize potential damage scope Mitigation – Minimize potential damage magnitude Assessment – Understand what has been damaged and how Recovery – Repair damage quickly Accountability (Reactive) – Identify the perpetrators forensically, after damage Proactive Principles Vulnerability Anticipation – Identify/fix vulnerabilities before exploitation, sense indirect indicators of exploitation Prudence – Correct vulnerabilities before exploitation Transformation – Change randomly the elements/nature of security system Threat/Risk Anticipation – Identify and counter threats and risks before exploitation Migration – Continuous upgrade of security strategy and components Accountability (Proactive) – Identify perpetrators with traps, glass houses, disinformation, etc, before damage

12. Early Rational-Security Examples • Buffer overflows– coders will create them, QA will miss them. AMD Solution: New processors will stop them (shift point of focus). • Access-rightsto critical resources will be abused. Military Solution: Two-person access required on critical elements. • Credit Card Theft– eSites will make it easy to re-order. SWA Solution: Retain the trivial info, don't retain the number. • M&Ainterconnectwill occur quickly. Cisco(?) Solution: Strategic fast/phased/buffered integration process. • Known vulnerabilities will exist in systems. HP Solution: "Active Countermeasures" probe and remediate. Sygate Solution: Magellan product shows real-time network node states. • New virus/wormversions defy advance signature filtering. HP Solution: "Virus Throttle" detects infection-speed and stops it. Symantic Solution: "Generic Exploit Blocking" filters for vulnerability exploit-pattern. • Foreign equipment of contractors and employees needs network access. Sygate solution: End-point, acceptable-equipment-condition access monitor. Anonymous solution: AV vendor sends updates to employee-equipment. • Many/complex/changing passwords – users will write them down. Dove Solution: write all into one strongly-encrypted user file. • Rogue employeeswill be bought or go postal. Mitigation: Assume penetration is a natural state and act accordingly. • Outsource Centerswill become major opportunity targets. Mitigation: Security-level agreements, Compartmentalized hard/soft/wet-ware.

13. Agile Security Forum Pathfinder Initiative – Concept of Operations This is a map summarizing concept relationships. It is not a flow chart or organizational structure. Relationships are read downward along connecting lines. Pathfinder Initiative provides has provides Market Value Mission Operating Modes Deliverables Participant Value of create cause documented as of Wake Up Call Roadmap for Action Rational Strategy Profile Broad Pursuit of Strategy Situation Profile Solution Profile Deep Effective Insight of Knowledge Discovery Community Preparation augmented with with immediate guidance for developed by Pathfinder Group Preliminary Community Agenda Refined Knowledge Frameworks conducted by of assisted by Users and Developers Media and Research Firms Forum Staff with Community Involvement Plan Real People Rational Procedures Rational Practices representing assisting coordinating providing Rational Policy CFO/HR/ CIO/CSO CTO/Mkt working on affecting affecting Real Problems Deliverable Construction Community Awareness Logistics, Planning and Facilitation Methods & Controls Technology & Activities developing Solution Fitness Profile Situation Reality Analysis in with affecting Real Time Mission Accountability Structured Workshop Procedures Initial Knowledge Frameworks Management Expectations & Objectives of on ~9 Months Current Personal Issues see detail maps

14. Rational Security Strategy • A strategy that ignores reality • is a loosing proposition. • Humans and organizations swim in reality, • and naturally fight incompatibilities. • "Unintended consequences are inevitable. Nevertheless, we are responsible both for what we do and what we fail to dowith technology [and strategy]." Pathfinder Initiative Participation Inquiries: AgilityForum@parshift.com Quote from "Frankenstein Today" by Scott Yoder http://www.msu.edu/~marianaj/frank2.ppt