Differences between defence-in-depth for computer security and … · Differences between...

16
Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent consultant, UK [email protected]

Transcript of Differences between defence-in-depth for computer security and … · Differences between...

Page 1: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

Differences between defence-in-depth for computer security and physical protection

Mike StJohn-Green

Independent consultant, UK

[email protected]

Page 2: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

Medieval castle with its concentric walls

Page 3: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

Digital technology

Also known asProgrammable Digital systems

and Computer-based systems

Images: www. wallpapercave.com

Page 4: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

Images: www. Wallpapercave.com

Is the notional environment … that harnesses the power of networked digital technology

Cyberspace …

Page 5: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

https://giphy.com/gifs/super-mario-maker-W9xUtJVpgSyHu

1. Lack of determinism, instinct and intuition

Differences between Cyberspace and physical space

Page 6: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

https://www.economist.com/blogs/economist-explains/2015/04/economist-explains-17

1. Lack of determinism, instinct and intuition

Differences between Cyberspace and physical space

2. Pace of change

Moore’s Law

100x increase in transistors every ten years

Page 7: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

https://www.nngroup.com/articles/law-of-bandwidth/

1. Lack of determinism, instinct and intuition

Differences between Cyberspace and physical space

2. Pace of change

Neilsen’s Law

50x increase every ten years in Internet connectivity

Page 8: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

1. Lack of determinism, instinct and intuition

Differences between Cyberspace and physical space

2. Pace of change

PLENTY OF SCOPE FOR FAULTS:SOFTWARE COMPLEXITY

Software size doubles every 4 years

3. Unknown vulnerabilities

http://www.engineeringnewworld.com

Page 9: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

1. Lack of determinism, instinct and intuition

Differences between Cyberspace and physical space

2. High pace of change

ALL DIGITAL TECHNOLOGY IS PART OF THE GLOBAL INTERNET

3. Unknown vulnerabilities

www.wallpapercave.com, Wikimedia.org – 68040 microprocessor

4. Indistinct boundaries

Page 10: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

1. Lack of determinism, instinct and intuition

Differences between Cyberspace and physical space

2. High pace of change

3. Unknown vulnerabilities

www.wallpapercave.com,

4. Indistinct boundaries

5. Unreliable detection methods

European companies take an average of 469 days to discover attackers in their system.

Global average is 146 days

– based on analysis by Mandiant in 2016

THE EVIDENCE IS IN PLAIN VIEW:

The average dwell-time of attackers is 229 days – FireEye in 2014

Page 11: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

1. Deterrence

Differences between PPSAnd computer security

2. Detection

ATTRIBUTION IS VERY DIFFICULT

3. Delay

4. Response

WE HEARD – DECTECTION IS UNRELIABLE

THEREFORE CANNOT RELY ON DELAY

RESPONSE IS STILL VITALLY IMPORTANT;FALSE ALARMS MAY BE HIGHER

PACE OF CHANGE MAKES THIS CHALLENGING;MUST DEAL WITH BLENDED ATTACKS

5. Design Basis Threat

Page 12: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

SecurityLevel 5

SecurityLevel 4

SecurityLevel 3 Security

Level 2Security Level 1

Zone SL2

Zone SL1

Zone SL2

Zone SL3

Zone SL4

Zone SL3

Zone SL4

Zone SL5

Zone SL5

SDA SL1 SDA SL1

SDA SL2

SDA SL2

SDA SL2

SDA SL2

SDA SL3

SDA SL3SDA SL3

SDA SL3

SDA SL3

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL5

Digital Asset SL5

Digital Asset SL5

Digital Asset SL4

Zone SL3

Zone SL4

Digital Asset SL2

Networks not associated with the facility

Security measure

What does this mean forDefence-in-depth?

Page 13: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

SecurityLevel 5

SecurityLevel 4

SecurityLevel 3 Security

Level 2Security Level 1

Zone SL2

Zone SL1

Zone SL2

Zone SL3

Zone SL4

Zone SL3

Zone SL4

Zone SL5

Zone SL5

SDA SL1 SDA SL1

SDA SL2

SDA SL2

SDA SL2

SDA SL2

SDA SL3

SDA SL3SDA SL3

SDA SL3

SDA SL3

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL5

Digital Asset SL5

Digital Asset SL5

Digital Asset SL4

Zone SL3

Zone SL4

Digital Asset SL2

Networks not associated with the facility

Security measure

What does this mean forDefence-in-depth?

Page 14: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

SecurityLevel 5

SecurityLevel 4

SecurityLevel 3 Security

Level 2Security Level 1

Zone SL2

Zone SL1

Zone SL2

Zone SL3

Zone SL4

Zone SL3

Zone SL4

Zone SL5

Zone SL5

SDA SL1 SDA SL1

SDA SL2

SDA SL2

SDA SL2

SDA SL2

SDA SL3

SDA SL3SDA SL3

SDA SL3

SDA SL3

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL4

Digital Asset SL5

Digital Asset SL5

Digital Asset SL5

Digital Asset SL4

Zone SL3

Zone SL4

Digital Asset SL2

Networks not associated with the facility

Security measure

What does this mean forDefence-in-depth?

Page 15: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

Some conclusions

• Digital technologies bring unparalleled benefits

• Computer security defences are imperfect at best

• Deterrence is difficult, delay is problematic to quantify

• Defence-in-depth is important but different – diversity is significant

• Resilience to cyber-attack may require changing the architecture

• Cyber design basis threat is a difficult concept

• Blended attack scenarios are vital, vital, vital!

• This raises some difficult questions for organisations

Page 16: Differences between defence-in-depth for computer security and … · Differences between defence-in-depth for computer security and physical protection Mike StJohn-Green Independent

Differences between defence-in-depth for computer security and physical protection

Mike StJohn-Green

Independent consultant, UK

[email protected]


Nuclear Safety Regulation · Strength in Depth (A proposal from INSAG) 2. ... • Defence in Depth involves building of multiple levels of safety, such that if one level fails the

Nuclear Safety Regulation · Strength in Depth (A proposal from INSAG) 2. ... • Defence in Depth involves building of multiple levels of safety, such that if one level fails the

Conflict fiche 3: Defence and other sea uses...Spatial context Conflicts between defence and other uses occur in all sea areas, including nearshore and offshore areas. Differences

Conflict fiche 3: Defence and other sea uses...Spatial context Conflicts between defence and other uses occur in all sea areas, including nearshore and offshore areas. Differences

Defence in Depth of Electrical Systems and Grid Interaction - Final

Defence in Depth of Electrical Systems and Grid Interaction - Final

The principle of Defence-in-Depth in the perspective of ... · The principle of the Defence-in-Depth concept has been set forth by the IAEA as fundamental for the safety of Nuclear

The principle of Defence-in-Depth in the perspective of ... · The principle of the Defence-in-Depth concept has been set forth by the IAEA as fundamental for the safety of Nuclear

Snow depth differences at 10,080 ft. under Limber Pine, Engelmann Spruce, and Aspen trees

Snow depth differences at 10,080 ft. under Limber Pine, Engelmann Spruce, and Aspen trees

Industrial Defence In-Depth - Where The World Talks Security · Industrial Defence In-Depth SBX1-R12 ... Corporate IT Security is about Data protection ... Proposal & pilot. #RSAC

Industrial Defence In-Depth - Where The World Talks Security · Industrial Defence In-Depth SBX1-R12 ... Corporate IT Security is about Data protection ... Proposal & pilot. #RSAC

WENRA views on Defence-in-Depth for new reactors...WENRA views on Defence-in-Depth for new reactors Contents –WENRA •RHWG •Safety objectives •Key safety issues for new NPPs

WENRA views on Defence-in-Depth for new reactors...WENRA views on Defence-in-Depth for new reactors Contents –WENRA •RHWG •Safety objectives •Key safety issues for new NPPs

Overflowing attack potential, scoring defence in-depth

Overflowing attack potential, scoring defence in-depth

DEFENCE IN DEPTH AND PRACTICAL ELIMINATION OF EARLY …

DEFENCE IN DEPTH AND PRACTICAL ELIMINATION OF EARLY …

Defence in Depth in Nuclear Safety INSAG-10 · INSAG-10 DEFENCE IN DEPTH IN NUCLEAR SAFETY INSAG-10 A report by the International Nuclear Safety Advisory Group INTERNATIONAL ATOMIC

Defence in Depth in Nuclear Safety INSAG-10 · INSAG-10 DEFENCE IN DEPTH IN NUCLEAR SAFETY INSAG-10 A report by the International Nuclear Safety Advisory Group INTERNATIONAL ATOMIC

Enhancing Human and Organizational Factors in Defence in Depth · Enhancing Human and Organizational Factors in Defence in Depth Jozef Misak, UJV Rez a.s., Czech Republic, ... associated

Enhancing Human and Organizational Factors in Defence in Depth · Enhancing Human and Organizational Factors in Defence in Depth Jozef Misak, UJV Rez a.s., Czech Republic, ... associated

Defence in Depth

Defence in Depth

Defence in Depth in Nuclear Safety INSAG-10 · PDF fileINSAG-10 DEFENCE IN DEPTH IN NUCLEAR SAFETY INSAG-10 A report by the International Nuclear Safety Advisory Group INTERNATIONAL

Defence in Depth in Nuclear Safety INSAG-10 · PDF fileINSAG-10 DEFENCE IN DEPTH IN NUCLEAR SAFETY INSAG-10 A report by the International Nuclear Safety Advisory Group INTERNATIONAL

ROMAN CATHOLICISM- DIFFERENCES · 2017. 10. 2. · ROMAN CATHOLICISM- DIFFERENCES. MAJOR DIFFERENCES Let's look in greater depth, ... New dogma has been introduced in Catholic Church.

ROMAN CATHOLICISM- DIFFERENCES · 2017. 10. 2. · ROMAN CATHOLICISM- DIFFERENCES. MAJOR DIFFERENCES Let's look in greater depth, ... New dogma has been introduced in Catholic Church.

User-Access Management: a Defence in Depth Control ...Management... · Web viewUser-access management A DEFENCE IN DEPTH CONTROL ANALYSIS June 2008 DISCLAIMER: To the extent permitted

User-Access Management: a Defence in Depth Control ...Management... · Web viewUser-access management A DEFENCE IN DEPTH CONTROL ANALYSIS June 2008 DISCLAIMER: To the extent permitted

"In-Depth Study and Critical Review of ... - 164.100.24.208164.100.24.208/ls/CommitteeR/Defence/17threport.pdf · 17 standing committee on defence (2006-2007) (fourteenth lok sabha)

"In-Depth Study and Critical Review of ... - 164.100.24.208164.100.24.208/ls/CommitteeR/Defence/17threport.pdf · 17 standing committee on defence (2006-2007) (fourteenth lok sabha)

DEFENCE IN DEPTH INTERNALIZATION IN CAREM PROTOTYPE …

DEFENCE IN DEPTH INTERNALIZATION IN CAREM PROTOTYPE …

BT Ethical Hacking Quick Start - image.guardian.co.ukimage.guardian.co.uk/.../2012/01/27/BTEthicalHackingQuickStartV4.pdf · Defence in depth and 24x7 monitoring underpins BT’s

BT Ethical Hacking Quick Start - image.guardian.co.ukimage.guardian.co.uk/.../2012/01/27/BTEthicalHackingQuickStartV4.pdf · Defence in depth and 24x7 monitoring underpins BT’s

Defence in depth-+15+Oct+2… · layered Defence in Depth approach. With an understanding of the organisation’s goals, the critical processes supporting these goals, and their inter-relationships,

Defence in depth-+15+Oct+2… · layered Defence in Depth approach. With an understanding of the organisation’s goals, the critical processes supporting these goals, and their inter-relationships,

Commerce vs. Defence Irreconcilable Differences? Matt Minshall CSL Defence Interest Group 27 April 2005.

Commerce vs. Defence Irreconcilable Differences? Matt Minshall CSL Defence Interest Group 27 April 2005.