cybex - the cybersecurity information exchange framework tony rutkowski,...
Post on 17-Dec-2015
218 Views
Preview:
TRANSCRIPT
CYBEX - The Cybersecurity Information Exchange Framework
Tony Rutkowski, tony@yaanatech.comRapporteur, ITU-T Cybersecurity Rapporteur Group
EVP, Yaana TechnologiesSenior Fellow, Georgia Tech, Sam Nunn School, Center for
International Strategy, Technology, and Policy (CISTP)
2.1
What is the Cybersecurity Information Exchange Framework (CYBEX) ?
• A global initiative to– identify a set of platform specifications to facilitate the trusted exchange of
information among responsible parties worldwide supporting cybersecurity for
• Infrastructure protection• Incident analysis and response• Law enforcement and judicial forensics
– Enhance the availability, interoperability, and usefulness of these platforms• Extensible use of best-of-breed open cyber security information
exchange platforms• Facilitated by the Cybersecurity Rapporteur Group of ITU-T (Q.4/17)• ITU-T Recommendations during 2010-2011, with continuing
evolution to current user community versions and needs
What is cybersecurity?Contractual service
agreements and federations
Deny resources
Intergovernmental agreements and
cooperation
Tort & indemnification
Regulatory/ administrative law
Criminal law
Reputation sanctions
Provide basis for actions
Legal remedies may also institute protective measures
Provide awareness of vulnerabilities and remedies
Data retention and auditing
Identity Management
4. Legal Remedies
Forensics & heuristics analysis
Provide data for analysis
Encryption/ VPNs esp. for
signalling
Resilient infrastructure
Routing & resource
constraints
Network/ application
state & integrity
Real-time data availability
= information exchange for analysis
1. Measures for protection
2. Measures for threat detection
= information exchange for actions
Blacklists & whitelists
Vulnerability notices
Patch development
Investigation & measure initiation
3. Measures for thwarting and
other remedies
The CYBEX Initiative:basic model for information exchange
CybersecurityInformationacquisition
(out of scope)
CybersecurityOrganization
CybersecurityInformation
use(out of scope)
CybersecurityOrganization
Structure information
Identify & discover cyber security information and organizations
requesting & responding with cybersecurity information
Trusted exchange of cyber security information
CYBEX Focus
Vulnerability/State Exchange Cluster Event/Incident/Heuristics Exchange Cluster
Structured Information
CWECommon Weakness
Enumeration
CCECommon
Configuration Enumeration
ARFAssessment
Results Format
CVECommon
Vulnerabilities and
Exposures
CVSSCommon
Vulnerability Scoring System
SCAPSP800-126
Security Content
Automation Protocol
CWSSCommon Weakness Scoring System
XCCDFeXtensible
Configuration Checklist
Description Format
OVALOpen
Vulnerability and
Assessment Language
CPECommon Platform
Enumeration
LEA/Evidence Exchange Cluster
TS102232 Handover
Interface andService-Specific
Details (SSD) for IP delivery
TS102657 Handover
interface for the request and delivery of retained
data
RFC3924 Architecture
for Lawful Intercept in IP
Networks TS23.271 Handover for
Location Services
X.dexf Digital
Evidence Exchange File
FormatERDM
Electronic Discovery Reference
Model
Exchange Terms and Conditions
X.cybex-tcCyber
information terms and condition
exchange format
= imported
= new
= referenced
CEE Common
Event Expression
Specific Events
X.gridf
SmartGrid Incident
Exchange Format
MAECMalware
Attribution Enumeration
and Characterization
Black/WhitelistExchange
Format
PFOC Phishing,
Fraud, and Other
Non-Network Layer Reports
CAPEC Common
Attack Pattern Enumeration
and Classification
IODEF RFC5070Incident Object
Description Exchange Format
CEE Common
Event Expression
CEE Common
Event Expression
CEE Common
Event Expression
Exchange Cluster
Discovery and Trusted Exchange
Identity Trust Cluster
X.evcert
Extended Validation Certificate
TS102042V.2.0
Policy requirements for
certification authorities
issuing public key certificates
X.eaa
Entity authentication
assurance
Discovery Cluster
X.cybex.1 An OID arc for cybersecurity information exchange
X. cybex-disc
OID-based discovery
mechanisms in the exchange of
cybersecurity information
X. cybex.2XML
namespace in the Exchange
of Cybersecurity Information
X. chirp Cybersecurity Heuristics and
Information Request Protocol
X.cybex-beep
BEEP Profile for
Cybersecurity Information Exchange
Framework
X.cybex-tp
Transport protocols
supporting cybersecurity information exchange
LEA/Evidence Exchange
TS102232-1 Handover
Interface andService-Specific Details (SSD) for
IP delivery
= imported
= new
= referenced
A Cybersecurity Namespace• Trusted global cybersecurity information exchange requires identifiers for
– The parties and other objects involved in the exchanges– The information exchanged– The terms and conditions associated with the exchanged information
• A global cyber security namespace is part of CYBEX and described in draft Rec. ITU-T X.cybex.1
• The OID namespace 2.48 has been reserved for this purpose by joint ISO|IEC JTC1 SC6 and ITU SG17 action– OID namespaces
• Are hierarchical and enable autonomous distributed management• Were developed for and have been used for these kinds of purposes for the past 30 years
• Can also be used to meet new ETSI TC LI Dynamic Triggering requirement for a global identifier for warrants and related needs
Architecture TBD
A Global Cybersecurity Namespace
1[each country , organization, subdivision allocates namespaces and levels as desired]
48 = cybersecurity. . .48
USA8404
Afghanistan
756Suisse
250. . .France
. . . . . .Every country has a numeric identifier automatically reserved in the OID 2.48 cybersecurity namespace
nnn
FIRST
. . .
Non-country organizations can also be allocated
identifiers
4
ISOITU-T|ITU-R
01
23
Joint ITU-T & ISO[jointly allocated by ITU-T SG17 and ISO|IEC JTC1 SC6]
[Allocated by ITU-T SG17]
[Allocated by ISO|IEC JTC1 SC6]
0 1 2
Use of the OID cybersecurity namespace: an example
2.48.1.756.3[hypothetical Swiss agency]
CybersecurityOrganization
2.48.1.250.2 [hypothetical
French agency]
CybersecurityOrganization
Incident 2.48.1.756.3.1.[local identifier]
Terms & conditions 2.48.1.756.3.2.[local identifier]
The namespace identifiers need not be publicly exposed – only unique and consistent within the namespace
Local agency and community identifiers can continue to be used
Ensures coherent ability to know who is involved, specific
identification of the information, and expected treatment policies
The cybersecurity problems are about to get much worse
• Cloud Services and SmartGrids create potential significant new cybersecurity threats with far reaching consequences
• Public services are being pushed into the marketplace with– No regulation– No standards– Availability of massive network data center resources– With little understanding of the cybersecurity dimensions,
much less effective solutions– No international agreements
Will history repeat itself?• Similar kinds of cyber security challenges were faced a hundred years
ago– Fast-paced new network technology emerged– Networks became global in scope– Harmful incidents were rapidly scaling– Governments did not intervene to avoid harm to innovation– Sinking of the Titanic in 1912 finally motivated global action
• Every new network technology has faced similar challenges– The 1980s OSI Internet had public infrastructure security solutions, but lacked
innovation– The 1990s TCP/IP academic Internet had no public infrastructure security
solutions, but was great for innovation• Criminals , hackers, terrorists, miscreants are also innovative and have many incentives
• CYBEX assembles open, extensible, technology-neutral capabilities essential for public network infrastructure/service cybersecurity in different forms over the past hundred years
SS Cyber Infrastru
cture
How many cyber icebergs do you need before substantial global action occurs?
It usually takes a major disaster
top related