View
79
Download
1
Category
Tags:
Preview:
DESCRIPTION
Cyber- security Horizon Scan. Security of e- Government | Florent Kirchner. February 2013. Why do you trust ( your ) software?. Defense in Depth – Safety. Butterfly. Level 1: prevention of abnormal operation. Level 2: control of abnormal operation. - PowerPoint PPT Presentation
Citation preview
CEA | 10 AVRIL 2012
CYBER-SECURITYHORIZON SCAN
Security of e-Government | Florent Kirchner
| PAGE 1
FEBRUARY 2013
Why do youtrust (your) software?
DEFENSE IN DEPTH – SAFETY
Leve
l 1:
prev
entio
n of
ab
norm
al
oper
atio
n
Leve
l 2:
cont
rol o
f ab
norm
al
oper
atio
n
Leve
l 3:
cont
rol o
f ac
cide
nts
Leve
l 4:
prev
entio
n of
ac
cide
nt
prog
ress
ion
Leve
l 5:
cons
eque
nce
miti
gatio
n
Butterfly
DEFENSE IN DEPTH – SECURITY
Attacker
Net
wor
k Fi
rew
all
Net
wor
k tra
nsla
tion
Wor
ksta
tion
firew
all
App
licat
ion
inte
grity
Ker
nel
cont
rols
Hyp
ervi
sor
sepa
ratio
n
Har
dwar
e w
atch
dog
Critical cyber-systems require thorough security guarantees
COTS are seeing heavy use
CYBER LEAP YEAR
5 INNOVATION CATEGORIES:
Digital Provenance basing trust decisions on verified assertions
Moving-target Defense attacks only work once if at all
Hardware-enabled trust knowing when you’ve been had
Health-inspired Network Defense from forensics to real-time diagnostics
Cyber Economics crime doesn’t pay
Propose changes to the cybersecurity landscape
MANY COMPONENT TYPES:
Compilers new security languages
COTS new API-level security controls
Network novel privacy protocols
Platforms innovative behavior verification
Models different model-based security
…
CYBER LEAP YEAR
?
FORMAL METHODS
Guaranteed software properties
Based on mathematical reasoning
Properties are formalized using unequivocal logical sentences
Software systems are represented by sets of rulestransforming the system statesatisfying certain properties
On a given perimeter
Formal methods are used to prove that some software properties hold…
… or to provide insight on why other properties do not.
FORMAL METHODS – CODE, COTS & APIS
!
int abs(int x){ int r; if (x >= 0) r = x; else r = - x; return r;}
/*@ requires -1000 <= x <= 1000; ensures \result >= 0; */
int abs(int x){ int r; if (x >= 0) r = x; else r = - x; return r;}
FORMAL METHODS – MODELS
!
% Conflict during interval [B,T]conflict_2D?(s,v) : bool = EXISTS (t: Lookahead): sqv(s+t*v) < sq(D)
% 2-D Conflict Detection (cd2d)cd2d?(s,v) : bool = horizontal_los?(s+B*v) OR omega_vv(s)(v) < 0
% THEOREM: cd2d is correct and completecd2d : THEOREM conflict_2D?(s,v) IFF cd2d?(s,v)
FORMAL METHODS – PROTOCOLS
!
input_clause(intruder_knows_session_key_as_seen_by_B, conjecture,
[ --knows (crypt (s (nonceb (Kab, A, B)), Kab)), --knows (Kab) ]).
*** Derived: intruder_knows_session_key_as_seen_by_B ***
1. A -> S : A,B2. S -> A : {KPb, B}KSs3. A -> B : {Na, A}KPb4. B -> S : B,A5. S -> B : {KPa, A}KSs6. B -> A : {Na, Nb}KPa7. A -> B : {Nb}KPb
PROCESS- VS. PRODUCT-BASED
Formal methods provide additional means to build trust
Process-based assurance
Based on testing, V&V tools designed in the 1980sFamiliar, but expensive to scale up for software-intensive systemsInapplicable to COTS software components
Product-based assurance
Using formal techniques spawned in the 1980s to provide strong guarantees regarding:- Compliance with software safety standards- Absence of software security vulnerabilitiesDisruptive, but can help meet mandatory requirements at reduced costs
The first wave of next-generation verification tools is reaching maturity in terms of cost effectiveness and industrial readiness
THE FORMAL METHODS LEAP
But…
Far out research questions
Difficult to transfer industrially
Scattered contributors worldwide
Insufficiently adopted by the public
Little support from standardization bodies
This leap requires a significant amount of investment acrossa wide range of domains. However it cannot rely solely on the will of a few commited individuals.
Yet…
DARPA-funded disruptive CSFV program: use games to lower the cost of formal verifications
Strong successes from foward-looking industrials
It is the policy of the United States to enhance the security and resilience of the Nation's critical infrastructure and to maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy, and civil liberties.
The [NIST-developed] Cybersecurity Framework shall include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks.
[Recommend the] feasibility, security benefits, and relative merits of incorporating security standards into acquisition planning and contract administration.
WHITE HOUSE EXECUTIVE ORDER – 2013
Sec. 7(b) The Cybersecurity Framework shall provide a prioritized, flexible, repeatable,
performance-based, and cost-effective approach, including information security measures
and controls, to help owners and operators of critical infrastructure identify, assess, and
manage cyber risk. The Cybersecurity Framework shall focus on identifying cross-sector
security standards and guidelines applicable to critical infrastructure. The Cybersecurity
Framework will also identify areas for improvement that should be addressed through
future collaboration with particular sectors and standards-developing organizations. To
enable technical innovation and account for organizational differences, the Cybersecurity
Framework will provide guidance that is technology neutral and that enables critical
infrastructure sectors to benefit from a competitive market for products and services that
meet the standards, methodologies, procedures, and processes developed to address
cyber risks. The Cybersecurity Framework shall include guidance for measuring the
performance of an entity in implementing the Cybersecurity Framework.
Recommendation: open & ambitious cyber-security policies
Recommended