Nas enterprise information system security neiss vic patel faa icap acp wg i may 28 th 30 th
This presentation is the property of its rightful owner.
Sponsored Links
1 / 33

Agenda PowerPoint PPT Presentation


  • 111 Views
  • Uploaded on
  • Presentation posted in: General

NAS Enterprise Information System Security (NEISS) Vic Patel, FAA ICAP, ACP WG-I May 28 th – 30 th. Agenda. Why do we need NEISS NEISS described Current status/activities Future plans. Introduction. The NAS Enterprise Information Systems Security (NEISS) Program

Download Presentation

Agenda

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Nas enterprise information system security neiss vic patel faa icap acp wg i may 28 th 30 th

NAS Enterprise Information System Security (NEISS)Vic Patel, FAAICAP, ACP WG-IMay 28th – 30th


Agenda

Agenda

  • Why do we need NEISS

  • NEISS described

  • Current status/activities

  • Future plans


Introduction

Introduction

  • The NAS Enterprise Information Systems Security (NEISS) Program

    • Seeks to implement a NAS Security Architecture that is based on Enterprise or “Common” Controls rather than the current system-by-system controls

    • All NAS and NextGen Programs interface to and use the Common Controls to gain the mitigation benefits

    • The five Common Controls that comprise NEISS


Changing environment increases cyber security risks to the nas

Changing Environment Increases Cyber Security Risks to the NAS

Today’s NAS

Limited inter-connectivity

NextGen

Significant inter-connectivity

  • Planned NAS improvements

    • Moving to net-centric operations

    • Moving from custom to commercial software

  • Cyber threats on the increase

External

NAS Sensors

IP

IP

Services

External

users

Cyber risk

IP

SWIM

External

users

Greater use of Internet Protocol (IP) and greater connectivity within the NAS requires an effective Enterprise Information System Security Architecture

Aviation

Partner

Networks


Potential impacts to nas are serious

Potential Impacts to NAS Are Serious

  • Major disruption of NAS services possible

    • Malware can enter the NAS accidently

    • The NAS can be targeted

  • Disruption can cause substantial economic loss

  • Loss of public confidence in the NAS

  • NAS disruption can interfere with logistical support of military missions


The threat

The Threat

  • Cyber exploitation activity has

    • Grown more sophisticated

    • More targeted

    • And more serious

  • The intelligence community has concluded that nation states

    • Have the technical capabilities to

      • Target and disrupt elements of the US information infrastructure

      • Collect intelligence information for future use against the US

  • StuxNet – Specifically targeted an Industrial Control System similar to NAS


The challenge

The Challenge

It’s hard to keep them out

When they get in, it’s hard to find them

When we find them, it’s hard to get them out


What can we do

What Can We Do?

  • Lay a solid foundation

    • Develop core Enterprise Solutions that position the NAS to deal with an ever increasing problem

  • Be agile

    • Develop techniques and approaches useful for defending and countering cyber attacks

    • Developing and enforcing Enterprise Solutions that can quickly adapt to the changing threat environment and apply to all NAS systems

  • Be resilient

    • Adopt approaches for continued operations during cyber attacks

  • Understand the threat

    • Characterize the NAS cyber threat environment

    • Identify tools, techniques, and procedures used by adversaries


The plan nas enterprise information system security

The Plan:NAS Enterprise Information System Security

  • NAS ISS architecture was developed to provide a foundational cyber infrastructure for NAS enterprise security beginning now and continuing through NextGen

  • Doable in five years

    • Enterprise-wide solutions

    • Minimal end-system changes

    • Expand existing program solutions where applicable

  • Flexible and Scalable - Security solutions can vary over time.

  • NAS ISS architecture will allow:

    • Improvements in security technology

    • New security features


Agenda

The NAS ISS Architecture

Keep the bad stuff out

Know whom you’re talking to

01101

01101

External Boundary Protection

Secured NAS

Identity & Key Management

Crown Jewels

Certified Software Management

T&E

Internal Policy Enforcement

Protect the software

supply chain

Incident Detection and Response

Minimize damage and

don’t let it spread

If they get in, find them

and deal with it


Neiss design principles

NEISS Design Principles

Keep the bad stuff out

Secured NAS

External Boundary Protection

Know who’s who

Only approved software

Certified Software Management

Identity & Key Management

When they get in, find them

and deal with the problem

Internal Policy Enforcement

Incident Detection and Response

Minimize the damage once

in and don’t let it spread!

  • Create a Cyber Security Infrastructure

    • Enterprise wide

    • Monitor NAS data flows

    • Apply cyber security controls to data flows

  • Majority of implementation involves infrastructure, rather than end-systems

  • Modify enterprise controls, as new threats & controls warrant it

    • Ongoing R&D effort

    • Present controls represent 5 year timeline


Under the hood what s happening in neiss

Under the Hood:What’s Happening in NEISS


Why a nas enterprise information system security iss architecture is needed i

Why a NAS Enterprise Information System Security (ISS) Architecture Is Needed (I)

Growing and evolving cyber security threats

Cyber terrorism, cyber crime, cyber vandalism, cyber espionage, cyber war

Evolution to support and enable NextGen

Increased levels of network connectivity (from point-to-point to net-centricity)

Newer technologies (satellite-based surveillance and navigation)

Increased complexity from interoperability needs (legacy systems and NextGen implementation)

Security is based around individual systems

Non-uniform security, the weakest link paradigm applies

Costly to implement

Individual system security never intended to mitigate the advanced threats


Why a nas enterprise information system security iss architecture is needed ii

Why a NAS Enterprise Information System Security (ISS) Architecture Is Needed (II)

Architecture Provides

Uniform and enterprise cyber security capabilities

Layered cyber security capabilities (defense-in-depth)

Robust, resilient, agile and scalable cyber security capabilities

Incremental approach


Why a nas enterprise information system security iss architecture is needed iii

Why a NAS Enterprise Information System Security (ISS) Architecture Is Needed (III)

  • Benefits

    • Protect the NAS from malware and advance cyber threats Organized crime, terrorist organizations, foreign governments

    • Provide better opportunities to leverage net-centric services for security

    • Greater network connectivity, newer technologies, greater complexity

    • Provide uniform enterprise cyber security capabilities

      • Reduce complexity, weakest link paradigm

    • Reduce implementation costs

      • One enterprise implementation vs. each system’s implementation

NEISS will be responsible for the implementation of the NAS EA ISS roadmap


Agenda

External Boundary Protection (EBP)

Added

Application

Gateway

EBP consolidates all NAS level security controls that are applied to data that transit the NAS security boundary


External boundary protection ebp

FTI MATRIX

External Boundary Protection (EBP)


External boundary protection ebp status

External Boundary Protection (EBP) Status

  • Developing AMS artifacts supporting EBP

  • Working with SWIM and FTI to implement early capability centered around the NAS Enterprise Security Gateway (NESG)

  • Conducting the Operational Safety Assessment

  • Future Activities:

    • Transition strategy

    • Governance

    • Guidance

    • FY13 Legacy NAS transition candidates


Identity and key management ikm

Identity and Key Management (IKM)

The IKM capability allows users and machines to be identified and provides key services for authentication, confidentiality, integrity, and non-repudiation; wherever these functions are needed.


Agenda

Identity and Key Management (IKM) - cont

  • Status: Actively Developing Requirements

  • Implementer: SWIM

  • Accomplishments:

    • Defined IKM requirements in SWIM S2 FPR,

    • OSA data collection complete,

    • Leading implementation of IKM in SWIM Segment 1+

  • Future Activities: Implement in test bed the four phase approach regarding integration with legacy systems.

  • Issues:

    • Need clarity on allocation of some IKM functions, including Security Token Service

    • Selection of early adopters

    • Policy/Standards needed


Internal policy enforcement ipe

Internal Policy Enforcement (IPE)

IPE mitigates the impact of security incidents within the NAS by dividing NAS systems and networks into enclaves and providing internal boundary protection (IBP) security mechanisms at the boundaries between enclaves.


Internal policy enforcement ipe cont

Internal Policy Enforcement (IPE) - cont

Status: Engineering new environment

Implementer: NEISS

Accomplishments: Defined Enclave Environment

Future Activities:

Prototype IPE in test bed.

Implement IPE in legacy environment utilizing a four step approach.

Solicit support from different lines of business to test IPE design in and design secondary network for data transmission if enclave is compromised.

Issues: Concern with cost for possible secondary form of data transmission.


Certified software management csm

Certified Software Management (CSM)

Progress/FUSE

Repository

Authentication Check

Have vendor sign software

Digital

Signature

(IKM)

Internet

EBP

Release & snapshot

Available for

Download

Test

Repository

SWIM

Production

Repository

Off-line

Repository

Project Object

Model

Scan

Build

Verify

Verification

Report

Integrity scan

(Veracode)

per order1370.109

SWIM

Wiki

The Certified Software Management capability ensures that malware does not enter the NAS via the software supply chain. CSM authenticates the source of the software, controls it’s entry into the NAS, provides secure retrieval, transfer, and integrity guarantee utilizing the IKM capability.

Potential Reference Model Based on SWIM SOA Software Acquisition/Verification

Located in

Maintenance Enclave

Located in DMZ


Certified software management csm status

Certified Software Management (CSM) Status

  • Actively developing requirements

  • Implementer: SWIM

    • Augments existing CM process.

    • CSM will add

      • Authentication Check - Vendor will Digitally sign software to be downloaded.

      • Integrity scan - Per order 1370.109 Software Assurance Policy

      • Digital Signature- Utilizing IKM to Digitally sign software approved for distribution.

  • Accomplishments:

    • Functional Analysis

    • Use cases

    • Started safety OSA

  • Future Activities:

    • Determine process to authenticate with COTS SOA software provider


Incident detection and response idr

Incident Detection and Response (IDR)

NAS cyber security incident reporting, communications, monitoring, and maintenance


Incident detection and response idr1

Incident Detection and Response (IDR)

  • Status: Policy Development

    • Update of CONUSE and Functional Analysis Documents

  • Implementer: NEISS IDR

  • Accomplishments:

    • CEMWG was established to formalize/combine process of handling NAS cyber events

    • Drafted IDR Policy and SOP

    • OSA draft complete


Incident detection and response idr2

Incident Detection and Response (IDR)

  • Future Activities:

    • Completion of Policy and SOP

    • Continuous update of the supporting documents as we evolve

    • Validation of SOPs

  • Issues:

    • AMS process time – Training and resources needed

    • Technology – Tech changes and advancements

    • Use of automated tools for data and traffic flows to detect anomalies


Governance and policy

Governance and Policy

Establishing policy, procedures, roles and responsibilities for implementing the NAS Enterprise Information System Security (NEISS) Architecture

SUBJ:

National Airspace System (NAS) Enterprise Information System Security Architecture

1. Purpose of This Notice. This notice establishes the requirements for use of FAA National Airspace System (NAS) Enterprise Information System Security Architecture for National Airspace System (NAS) systems, including NAS performance-based service contracts. It also establishes the requirements for use of NEISSA enterprise common controls that provide security services to multiple NAS systems.


Governance and policy cont

Governance and Policy - cont

Status: Actively Drafting Policy

Extending Notice JO 1370.44 to include enterprise ISS and current NIST guidance

Working with FAA’s CIO Offices on incorporating ISS in AMS life cycle

Accomplishments: Annotated outline

Future Activities:

First full draft expected early January 2011

Identify and integrate Enterprise ISS in JRC checklist

Issues: Balancing specificity and clarity against length


Neiss challenges

NEISS Challenges

  • Disposition of the NAS Enterprise ISS requirements

    • Need a way to resolve and approve changes (particularly deletion) and implementation of NEISS requirements

  • Conveying an understanding of the NEISS

    • Threat/risk motivation

    • Understanding capabilities

    • Programs need to be clear on when and how to adapt to NEISS

      • Schedule, Funding, Requirements

  • ISS architecture governance

    • What are the Rules (Policy)?

    • Who are the Gatekeepers?

  • Establishing NEISS priority and importance

    • Urgency

    • Early funding

  • Coordinating across the many stakeholders

    • Nearly everyone in the NAS/NextGen is a stakeholder

    • All need attention


Backup slides

Backup Slides


Neiss implementation alternatives

NEISS Implementation Alternatives*

*Complete details provided in the NEISS Concept of Operations, v0.5


  • Login