SlideShare una empresa de Scribd logo
1 de 60
Descargar para leer sin conexión
Cybersecurity in the Age of the Everynet
New materials for mischief and magic
This presentation was given to the
British Computer Society IRMA SG
on May 9th 2017
09/05/2017 © 2017 Astius Technology 2
Bill Harpley MSc
• 30+ years in technology sector
• Founder of Astius Technology
• Organiser of Brighton IoT meetup group
(700+ members)
• Initiator of Brighton node of the global
Things Network
• Organiser of the Self-driving Cars &
Autonomous Vehicles meetup group
https://uk.linkedin.com/in/billharpley
bill.harpley@astius.co.uk
www.astius.co.uk
About your presenter
09/05/2017 © 2017 Astius Technology 3
What you will discover today
• In this presentation we will talk
about:
– The Five Epochs of Computing
– The Everynet: its origins and meaning
– Emerging Cybersecurity challenges
– Why we need a new approach to
Cybersecurity
– What the future holds for the
Cybersecurity profession
09/05/2017 © 2017 Astius Technology 4
Part 1: The Five Epochs
09/05/2017 © 2017 Astius Technology 5
The Five Epochs
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
• The history and future of Computing can be divided into five epochs
• Although this is slightly arbitrary, it provides a solid basis for our
discussion today
09/05/2017 © 2017 Astius Technology 6
The age of the Mainframe
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
09/05/2017 © 2017 Astius Technology 7
1950 1960 1970 1974
IBM ship
S/360
mainframe
(1964)
IBM ship
S/370
mainframe
(1970)
TRANSIC - first
transistorised
Computer
(1954)
Intel
launch
4004
processor
(1971)
Work begins on
development of
TCP/IP (1973)
Work
begins on
ARPANET
project
(1969)
MULTICS
time-
sharing
operating
system
(1969)
AT&T ship
Unix
Version 5
(1973)
Research into virtual
machine technology
began in late 1960s
Ethernet developed at
Xerox Parc (1973-1974)
Gordon Moore
publishes
“Moore’s Law”
(1965)
Alan Turing
describes
the “Turing
Test”
1950
LEO
Computer
designed in
UK (1951)
First workshop
on Artificial
Intelligence at
Dartmouth
College (1956)
The age of the Ethernet
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
09/05/2017 © 2017 Astius Technology 8
IBM launch
Personal
Computer
(1981)
1975 1985 1994
Apple I
computer
Launched
(1976)
Apple II
computer
Launched
(1977)
Apple
Newton
launched
(1994)
Domain Name
System created
(1983)
HTTP
protocol
created at
CERN
(1989)
Cisco ships
its first router
(1987)
NCSA
Mosaic web
browser
released
(1993)
Demon Internet pioneer
“tenner a month” dial-up
access to the Internet
in the UK (1993)
Ethernet standardised
as IEEE802.3 (1983)
Ethernet begins steady
rise towards dominance
UK home computer
boom led by
ZX Spectrum and
BBC Micro (1981)
Digital ship
VAX-11/780
mini-computer
(1977)
First ever
Internet worm
detected
(1988)
ChaosComputer
Club launchedin
Germany (1981)
NortonAntivirus
launchedto
combat rising tide
of software viruses
(1990)Microsoft ships
Windows 1.0
(1983)
Linus Torvald
announces
Linux OS (1991)
CMU Internet
Coke machine
(1982)
RSA crypto patent
granted(1983) DEC publishfirst paper
on Firewalls (1988)
Paul Benioff
proposes
Quantum
Computer
(1982)
The age of the Internet
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
09/05/2017 © 2017 Astius Technology 9
Number of connected
hosts reaches
100 million (2001)
1995 2005 2014
Vmware release
‘Workstation’
(1999)
Amazon Web
Services
(2006)
Facebook
announce
‘OpenCompute’
project (2011)Apple
iPhone
launched
(2006)
Google
launch
search
engine
(1998)
Launch of
Facebook
(2004)
Commercialisation of Internet
gathers pace
Ethernet has attained
dominant position by
2000
SSL 3.0 released
(1995)
Linux gains commercial
acceptance
SATAN security
tool released
(1995)
Cloud Computing gains
commercial acceptance
BS7799 (Part 1)
published(1995)
BS7799 (Part 2)
published(1998)
BS7799 adopted
as ISO17799
(2000)
ISO17799
morphs into
ISO27001/2
(2007)
STUXNET
incident
(2010)
Google
acquires
Android
(2005)
End of Moore’s
Law widely
predicted
Google launches
self-driving cars
project (2009)
You Tube
launch
(2005)
Satashi Nakamoto
publishes Bitcoin
paper (2008)
OpenStack SDN
project launched
(2010)
IEEE802.11b
Wireless LAN
standard (1999)
Massive cyber-
attacks on
Estonia (2007)
ETSI hold first
NFV trials (2014)
The age of the Everynet
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
09/05/2017 © 2017 Astius Technology 10
Hype begins
about 5G (2015)
2015 20342020
Mira IoT
DDoS attack
(2016)
Amazon Alexa
launched in UK
(2016)
Infamous
‘Jeep’
hack
(2015)
IoT concept
starts to go
mainstream
(2017)
First wave of near-
autonomous cars
takes to the roads
(2020)
Launch of 5G
mobile network
in UK (2023)
~ 20 billion
devices
connected to
the Everynet
(2020)
~ 30 billion
devices
connected to
the Everynet
(2025)
IP protocol stack
replaced by Next-
generation
protocol ( ~2030)
Anything from 2020 onwards is idle speculation
First demonstration
of quantum-safe
cryptography
(2028)
Steady progress is made towards building viable quantum computers
The last smartphone
rolls off the production
line (2027)
Moore’s Law
comes to an
end (2022)
Neuromorphic
Computing
grows in
popularity
(2026)
First generation quantum
computers come to
market (2030)
Early signs that
innovation in
Everynet paradigm
has peaked (2032)
Concern about
election hacking
(2016-2017)
Resurgence of interest
in AI and Machine
Learning
5G standards
agreed (2018)
LPWANs grow
in popularity
The age of the Quantnet
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
09/05/2017 © 2017 Astius Technology 11
Your guess is as good as mine
2035 2045 2055
Fully autonomous
cars common site
on roads (2035)
Launch of 6G
mobile network
in UK (2036)
Quantum computing is now where
mainframes were in the 1960s -
primitive but with great potential
for growth and improvement.
The Singularity
arrives when
machine intelligence
can match human
intelligence (2045)
Bio-hacking to improve human
performance is now commonplace
~ 80 billion devices
connected to the
Quantnet (2035)
The expanding attack surface
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
Rapidly inflating size of attack surface
09/05/2017 © 2017 Astius Technology 12
Internet traffic forecasts
09/05/2017 © 2017 Astius Technology 13
According to Cisco Visual Networking Index global Internet report, by the year 2020
there will be:
4.1bn global
Internet users 26.3bn devices
and connections
82% of Internet
traffic will be video
2.3bn zetabytes of
traffic per annum
The past and future of cybersecurity
Mainframe
Ethernet
Internet
Everynet
Quantnet
Long-term drivers of complexity
 Increasing Computational Power
 Evolving network architecture
( Fixed, Wireless, Mobile, Satellite)
 Increasing data transmission rates
 Increasing network bandwidth
 Expanding user population
(People, Things, Machines)
 More distributed intelligence
 Changing traffic diversity (Email,
Video, Web, Voice, Raw data)
 Changing expectations of users
Question: how can this growth be
securely managed in the future?
Answer: reduce complexity!
09/05/2017 © 2017 Astius Technology 14
Part 2: ‘Everynet’: it’s origins and meaning
09/05/2017 © 2017 Astius Technology 15
The Internet of Nonsense
Origins of IoT phrase
British born researcher and
entrepreneur Kevin Ashton is
credited with coining the term
‘Internet of Things’ in an article
which he wrote in 1999
My personal view
• The phrase ‘Internet of Things’
has zero resonance with
non-technical people.
• It’s widespread use has
bemused non-technical people
and delayed development of
the market.
Photo: Wikimedia Commons
To be fair, Kevin Ashton cannot have anticipated
that the phrase ‘Internet of Things’ would be
picked up by corporate Marketing departments
and turned into a stupid marketing sound-bite.
09/05/2017 © 2017 Astius Technology 16
The Everynet concept
Meaning: you can connect every thing to the global Internet.
As a concept:
• It’s more readily accepted by non-technical people (which is
the majority of humans on the planet)
• It can be understood as the next phase of evolution towards
the creation of a rich global communications fabric
• It’s not just a stupid marketing phrase!
CONTENT
Video, voice, email,
web
INDUSTRIAL
Data collected from
sensors and to
control actuators
CONSUMER
Data collected from
sensors and to
control actuators
Management and Supervisory
Traffic
on the
Everynet
09/05/2017 © 2017 Astius Technology 17
Part 3: Emerging Cybersecurity Challenges
09/05/2017 © 2017 Astius Technology 18
An overview of current threats
Here are a few tasty nuggets from the Cisco Cybersecurity Report 2017
• On average, organisations only have
capacity to deal with 56% of the
security alerts which they receive on
a given day
• It’s thought that 27% of connected
cloud applications introduced
by employees pose a security risk to
enterprise infrastructure (due to
O-Auth single sign-on)
• Spam accounts for 65% of global
email volume and 10% of global spam
is thought to be malicious
• Organisations which have not yet
suffered a security breach believe
their networks to be safe
• There is growing concern about the
expansion of the attack surface.
• Security professionals surveyed by the
report expressed similar degrees of
concern:
 Mobile Devices (58% expressed
concern)
 Data in the Public cloud
(57% expressed concern)
 Cloud Infrastructure
(57% expressed concern)
 ‘Dangerous’ user behaviour
- e.g. clicking links in emails (57%)
09/05/2017 © 2017 Astius Technology 19
Errant Actors on the cyber-stage
Cyber-criminals Violent terror groups State-sponsored actors
Hacktivist groups Script kiddies
09/05/2017 © 2017 Astius Technology 20
The size of the potential attack surface is about
to increase dramatically
This will create yet more opportunities for
malice and mischief
09/05/2017 © 2017 Astius Technology 21
The world of Cyber-physical systems
09/05/2017 © 2017 Astius Technology 22
Wikipedia definition
A cyber-physical system (CPS) is a mechanism controlled or
monitored by computer-based algorithms, tightly integrated
with the internet and its users.
In cyber-physical systems, physical and software components
are deeply intertwined, each operating on different spatial and
temporal scales, exhibiting multiple and distinct behavioural
modalities, and interacting with each other in a myriad of ways
that change with context.Examples of CPS include smart grid,
autonomous automobile systems, medical monitoring, process
control systems, robotics systems, and automatic pilot avionics
Source: Wikipedia
In other words, it’s where the digital world meets
the physical world
09/05/2017 © 2017 Astius Technology 23
Example: M2M applications
M2M is a broad term which describes any kind of wired or wireless
communication between electronic or electro-mechanical end-points.
M2M is
employed in
a wide range
of vertical
market
applications
09/05/2017 © 2017 Astius Technology 24
Example: Industrial monitoring and automation
SCADA systems are employed in monitoring and control applications
• Industrial Processes: e.g. oil refining, electrical power generation
• Infrastructure Management: e.g. Windfarms, Water treatment, Energy grids
• Facilities Management: e.g. Air-conditioning, Heating, Ventilation
09/05/2017 © 2017 Astius Technology 25
Connecting critical systems
A great deal of industrial and public infrastructure
was designed and built in a more innocent age:
• Many components in a SCADA system were designed to have a
long operational life (15+ years)
• They were built using a patchwork of proprietary and industry
de facto standards
• Such systems were never intended to be connected to an
enterprise network
• Trend is towards making these systems IP enabled, which poses
major security challenges
These types of systems make modern life possible: e.g. National Electricity Grid, Mass
Transport, Food Distribution – growing concern that cyber-attacks on critical infrastructure
could cause major economic disruption and potential loss of life.
09/05/2017 © 2017 Astius Technology 26
Massive attacks
UKRANIAN POWER GRID (2015)
Three electricity power distribution
companies were subject to a massive
cyber-attack:
• 225,000 customers were without
power for several hours
• Call centres were flooded with
bogus calls to hinder the response
to the outage
• It’s thought that the attackers
gained access to the system via
email ‘phishing’ and malware
attacks
• The source of the attack was
suspected to be a foreign
government agency
STUXNET (2009)
Targeted at Iran’s nuclear
programme with a view to disrupting
production of nuclear material
• It was a malicious computer
‘worm’ which targeted industrial
control systems
• It’s thought to have been
introduced into the system via a
USB storage device
• The infection caused the nuclear
centrifuges to spin out of control
• Good example of use of zero-day
software defects to launch
malicious attack on a system
09/05/2017 © 2017 Astius Technology 27
Protecting UK critical infrastructure
• Government classifies Critical National Infrastructure
(CNI) on the basis of potential for disruption
– Responsibility for managing risks lies with CNI operators
– Not everything can be ‘critical’, so priorities have to be set
According to the Cambridge Centre for Risk Studies, the economic impact of a
major cyber-attack on a regional electricity supply network would be £12bn in
terms of direct and indirect losses
09/05/2017 © 2017 Astius Technology 28
https://www.sbs.ox.ac.uk/cybersecurity-capacity/system/files/Integrated_Infrastructure_Cyber_Resiliency_in_Society_8_Apr_2016.pdf
Safety v. Security
Potential source of conflict exists between Safety and Security
• Example: automotive safety stand ISO26262
• Problem: adding security features (e.g. firewalls) may impede
the performance of time-critical software functions, which may
degrade safety
• It may be difficult to retrofit security to existing cyber-physical
systems
• New systems must be carefully designed to meet requirements of
both Safety and Security
09/05/2017 © 2017 Astius Technology 29
Novel forms of attack
• Side-channel attacks aim to gather cryptographic
intelligence about a system by indirect means
• Examples include:
– Cache monitoring attack on shared computing
environment
– Electromagnetic monitoring attack
– Power monitoring attack
– Data remanence
The proliferation of ‘things’ will increase scope for these type of attacks
09/05/2017 © 2017 Astius Technology 30
Protecting consumers
09/05/2017 © 2017 Astius Technology 31
A problem of Trust
• There is no recognised trust model for designing security into
connected consumer devices.
• These devices can potentially be controlled and used to eavesdrop
on the local environment from anywhere in the world.
INVASION OF
PRIVACY
RANSOMWARE
THEFT OF
PERSONAL
INFORMATION
MALICIOUS
HIJACKING OF
DEVICES
A February 2017 survey showed that 72% of consumers were not sure how to
check whether their devices had been compromised.
09/05/2017 © 2017 Astius Technology 32
Common issues
MANUFACTURER
 May have left “back-door”
into the device software
 May put onus on consumer to
apply software updates
 May cease to provide
software updates after a
relatively short period of time
( ~2-3 years )
CONSUMER
 Not obligated to change
well-known default
passwords
 May choose weak
passwords which are easy
to guess or readily cracked
with dictionary attack
 May be unaware of the
manufacturers default
settings for the device
(2016) Mirai bot attack compromised thousands of IP Cameras and home routers.
Exploited ‘old’ versions of Linux to launch a massive DDoS attack.
09/05/2017 © 2017 Astius Technology 33
The perils of Software Complexity
09/05/2017 © 2017 Astius Technology 34
All code is vulnerable
Commercial code is
estimated to have about
25 bugs per thousand
lines of code
Safety critical code is
estimated to have 1 bug
per thousand lines of
code (e.g. Aviation)
Software (and hardware)
may be compromised
within global supply
chains.
Questions for you to ponder
1. Do you feel that some manufacturers
prioritise ‘time to market’ over security?
2. Do you think that modern ‘dev-ops’ fast
release software cycles in any way
diminishes security?
3. How can we ensure the integrity of
hardware and software products within
the context of long global supply chains?
4. Do you think that we need better
methods of designing and testing
software?
5. Would you be prepared to pay more for
products if you knew that they
conformed to strict security standards?
09/05/2017 © 2017 Astius Technology 35
Two cultures, One big problem
09/05/2017 © 2017 Astius Technology 36
A tale of two cultures
Enterprise
Security
Automation /
Process Control
Security
Cyberphysical
Security
You have a major
challenge ahead!
What happens when
two security teams
from within the same
organisation have to
work together for the
first time?
09/05/2017 © 2017 Astius Technology 37
Emerging Solutions
09/05/2017 © 2017 Astius Technology 38
The attackers advantage
Attackers have plenty of time to research, plan and execute their attack.
What can we do to minimise their strategic advantage?
09/05/2017 © 2017 Astius Technology 39
Designing for Security and Privacy
GOLDEN RULE: Design a system that is as secure as possible,
given the prevailing needs and constraints
SOFTWARE / HARDWARE
• Define the security, availability and
privacy goals of the system
• Define the types of threats that the
system will encounter in use
• Prove that the design meets criteria
(1) and (2)
• Implement the system using a
‘defence in depth’ strategy
• Processes must run with the lowest
level of privileges needed to
execute a task
PRIVACY
• ‘Privacy’ should be the default design
goal
• Collect only the minimum amount
of information needed for the system
to fulfil its purpose
• Securely store user credentials
• Understand how “anonymised” data
can be exploited in undesirable ways
• Securely destroy data which is no
longer required
09/05/2017 © 2017 Astius Technology 40
OWASP guidelines
Minimise attack surface area Reduce the number possible attack vectors
Establish secure defaults Application should be secure “out of the box”
Principle of Least Privilege Processes should be assigned lowest level of privilege
needed to fulfil its task
Employ ‘defence in depth’ Fortify with diverse set of security measures
Fail securely Processes which fail must not divulge confidential
information
Don’t trust services Mistrust applications provided by external service
providers
Separation of duties Employ role based access control
Avoid ‘security by obscurity’ Use only as part of a broad set of security measures
Keep security simple Complexity is the enemy of security, so always strive for
simplicity
Fix security issues correctly Ascertain root cause and test fix thoroughly
Based on OWASP Developer Guide https://www.owasp.org/index.php/OWASP_Guide_Project
09/05/2017 © 2017 Astius Technology 41
Share cyber intelligence
Information Sharing and Analysis
Organizations (ISAOs)
These are a global community of organisations
which share threat intelligence
• Facilitates adoption of a proactive
stance towards cybersecurity
• Likely to become more predictive
in the future and better able to
prevent or mitigate attacks
• May play an important role in
helping to secure consumer grade
connected devices
• Example: Cyber-threat Intelligence
Network (http://ctin.us )
UK Cyber-security Sharing
Information Partnership (CiSP)
• Joint industry and Government
initiative
• Hosted by National Cyber
Security Centre (NCSC)
https://www.ncsc.gov.uk/cisp
• Currently has more than 2,225
participating organisations
engaged in sharing of cyber-
intelligence
09/05/2017 © 2017 Astius Technology 42
Also see NIST 800-150
https://www.nist.gov/publications/guide-cyber-threat-information-
sharing
Mining for cyber-intelligence
One emerging approach is to employ Big Data and
Machine Learning to detect real-time cyber incidents
Apache Metron originated as a Cisco project but is
now curated by the Apache Foundation
•Store massive volumes of telemetry
data for current and historical analysisSecurity Data Lake
•Can ingest and parse data from
common security apps (e.g. Snort,
Netflow, pcap)
Pluggable
Framework
•Performs standard SIEM1 analysis,
plus forensic facilities such as packet
replay and evidence storage
Security
Application
•Anomaly detection and analysis, plus
machine learning tools
Threat Intelligence
Platform
1. SIEM “Security Information and Event Management (SIEM)”
https://metron.incubator.apache.org
09/05/2017 © 2017 Astius Technology 43
Improving Software Quality
• Developing secure bug-free software would be a
significant step towards reducing complexity
• NIST recommends the goals of security design
should aim to reduce complexity at all levels by:
– Reducing software engineering complexity
– Making security more science and less art
– Provide secure building blocks for creating complex
software.
• By abstracting the complexity away from software
development, the ‘average’ developer could
produce secure software
09/05/2017 © 2017 Astius Technology 44
NIST IR 8151 (draft October 2016)
NIST study “Dramatically Reducing Software Vulnerabilities” recommends:
• Software analysis based on mathematical methodsFormal Methods
• Eliminate vulnerabilities such as ‘buggy’ APIs and
tightly manage resourcesSystem-Level Security
• Tools to analyse software and eliminate problems
(improves long-term quality of code base)
Additive Software
Analysis Techniques
• Employ proven frameworks which promote the
development an reuse of high quality, thoroughly
tested software
Domain-specific
Software Development
•Reduce the attack surface by dynamically adjusting the
interface presented to the attacker and/or regenerating
system components that have been compromised
Automatic Software
Diversity
Goal is to achieve 25 errors per 100,000 lines of code for commercial software.
09/05/2017 © 2017 Astius Technology 45
Moving Target Defences (MTD)
• “Virtualise” the attack
surface that is presented to
the attacker
– Configuration interface
presented to an attacker
constantly “morphs”
– Reduces the attackers
‘window’ for planning and
executing an attack
– This does not reduce the
number of software defects!
09/05/2017 © 2017 Astius Technology 46
MTD: how it works
• MTD is very active area of
research
• Currently more that 40
methods have been
proposed
• Examples:
– Non-persistent execution
environments
– randomized execution of code
– randomized network and host
identities
– randomizing compilers
– dynamic address spaces
– automated patch synthesis
and installation
http://blog.morphisec.com/moving-
target-defense-common-practices
09/05/2017 © 2017 Astius Technology 47
Inspired by nature
DARPA ‘CRASH’ programme: Clean-Slate Design of Resilient, Adaptive, Secure Hosts
• Biological immune systems can detect and
supress ‘Intruders’
• Immune systems possess mechanisms
that could enable us to build effective
MTD systems:
 Distributed processing
 Pathogenic pattern recognition
 Multilayered protection
 Decentralized control
 Diversity
 Signalling between co-operating cells
http://www.darpa.mil/program/clean-slate-design-of-resilient-adaptive-secure-hosts
09/05/2017 © 2017 Astius Technology 48
Biohacking
• “Biohacking” has several
meanings but here we mean
physical augmentation of
human capabilities by
hardware and/or software
means
• Examples include:
– RFID implantation for personal
ID purposes
– Control of physical
environment using Brain—
Computer Interface (BCI)
https://dangerousthings.com/
09/05/2017 © 2017 Astius Technology 49
Security designed for people
• Security Ergonomics is
emerging as a field of
UX research
• It seeks to understand:
– How people react to security
alerts
– The influence of personality
traits on attitudes to security
• Emphasis is on observing
people in their working and
home environments
Example: Carnegie Mellon University's
Security Behaviour Observatory (SBO)
https://www.cylab.cmu.edu/index.html
09/05/2017 © 2017 Astius Technology 50
A role for blockchain
• Blockchain is a distributed ledger
technology which creates a
permanent and immutable record
of transactions
• It is being used to record and
secure data in many Smart City
projects around the world
– Secure data from IoT sensors
– Enable smart contracts
http://wwwf.imperial.ac.uk/blog/security-institute/2017/04/04/the-role-of-
distributed-ledgers-in-securing-urban-infrastructure
09/05/2017 © 2017 Astius Technology 51
A role for legislation
EU Networks and Information
Security Directory (2016)
This obligates member states to:
• Adopt a national cyber security
strategy
• Assign a national body the task
of enforcing compliance
• Establish a national CERT team
to monitor threats and respond
to incidents
• Participate in a new
Co-operation group to support
the strategic exchange of
information between member
states
General Data Protection Regulation
(2017)
The GDPR aims to strengthen privacy
rights an impose large fines for non-
compliance. Member states must:
• Raise public awareness of
cybersecurity
• Support cyber training at all levels
• Work with service providers to
ensure that the Internet is safe to
use
• Provide support for Critical
Network Infrastructure (CNI)
providers to promote best practice
and test cyber defences
09/05/2017 © 2017 Astius Technology 52
Global governance
Budapest Convention on
Cybercrime
• Aims to foster global co-operation
on combating cybercrime
• Currently has 52 signatories
• Key states such as China, Russia
and India have declined to sign the
convention
Strong argument to say that further international treaty needed to
both combat cybercrime and curtail state-sponsored cyber attacks
09/05/2017 © 2017 Astius Technology 53
The science of Security
• There is no “Science of Security”
• According to NASA the foundations of such a discipline are:
•Develop methods to enable the construction of secure systems
which have known propertiesScalability and Composability
•Develop methods to enable policy based data handling and
sharing across different authority domains
Policy-driven Secure
Collaboration
•Develop metrics which allow us to predict how a system will
behave in a given context
Security-Metrics-Driven
Evaluation
•Design resilient architectures which continue to deliver services
even when subject to attackResilient Architectures
•Develop models of human behaviour (both users and
adversaries) which enable us to build systems which have
known security properties
Understanding and accounting
for human behaviour
https://www.nsa.gov/what-we-do/research/science-of-security
09/05/2017 © 2017 Astius Technology 54
Quantum Computing: the joker in the pack
A few final thoughts on Quantum Computing…
• It is very different than conventional notions of
computation!
• From a security perspective, the main interest is the
theoretical ability of a Quantum Computer to break
conventional cryptography
• The security researcher Peter Shor estimated that a modest
hybrid quantum/conventional computer could crack a
powerful RSA cypher faster than a conventional computer
could encrypt it. So this topic is the subject of a great deal
of research
• We are probably at least two decades away from the age of
the Quantum Internet ( or the Quantnet, as I like to call it )
• At the present time, you need a large and expensive
laboratory to perform even simple tasks
http://systemdesign.altera.com/cares-quantum-computing
http://www.etsi.org/images/files/ETSIWhitePapers/QuantumSafeWhitepaper.pdf
09/05/2017 © 2017 Astius Technology 55
Training and skills development
• Expect the Cybersecurity profession to change
dramatically over the next decade
• There will be increased automation to cope with
complexity and skills shortages
• It will become more proactive (rather than reactive)
• It will become more multidisciplinary:
– UX
– Psychology
– AI and Machine Learning
– Safety conscious ( as more ‘things’ come online)
You will need to engage more in training and professional development!
09/05/2017 © 2017 Astius Technology 56
Conclusions
09/05/2017 © 2017 Astius Technology 57
Dividing the history of Computing into five epochs is useful for the thinking
about how Security has evolved in the past (and may evolve in the future)
We need to devise methods to manage the expanding attack surface and
help us deal with increasing complexity
Attaching critical cyber-physical systems to the Internet brings with it the
potential for devastating and disruptive large-scale cyber attacks
We have surveyed a variety of emerging methods to help us build better
quality software and to reduce the asymmetric advantage of the attacker
Legislation and global governance will play an important role in the future
Age of the Everynet
Quantum Computing is still at the ‘hype’ phase but has the potential to
break conventional cyphers
The Cybersecurity profession will experience major transformation over the
next decade.
What have we learned today?
09/05/2017 © 2017 Astius Technology 58
Any
Questions
09/05/2017 © 2017 Astius Technology 59
Advanced System Technologies
in Urban Spaces™
6009/05/2017 © 2017 Astius Technology 60

Más contenido relacionado

La actualidad más candente

IDATE DigiWorld - Autonomous Cars Antoine Klifa
IDATE DigiWorld - Autonomous Cars Antoine KlifaIDATE DigiWorld - Autonomous Cars Antoine Klifa
IDATE DigiWorld - Autonomous Cars Antoine KlifaIDATE DigiWorld
 
Role of Satellite Technology in Supporting Connectivity to Vehicles - Intelsat
Role of Satellite Technology in Supporting Connectivity to Vehicles - IntelsatRole of Satellite Technology in Supporting Connectivity to Vehicles - Intelsat
Role of Satellite Technology in Supporting Connectivity to Vehicles - IntelsattechUK
 
20160914 EuroSPI: "Automotive Security: Challenges, Standards and Solutions"
20160914 EuroSPI: "Automotive Security: Challenges, Standards and Solutions"20160914 EuroSPI: "Automotive Security: Challenges, Standards and Solutions"
20160914 EuroSPI: "Automotive Security: Challenges, Standards and Solutions"Alexander Much
 
5 Autonomous Cars Trends Everyone Should Know About In 2019
5 Autonomous Cars Trends Everyone Should Know About In 20195 Autonomous Cars Trends Everyone Should Know About In 2019
5 Autonomous Cars Trends Everyone Should Know About In 2019Bernard Marr
 
Connected Cars & 5G
Connected Cars & 5GConnected Cars & 5G
Connected Cars & 5GITU
 
The Autonomous Revolution of Vehicles and Transportation
The Autonomous Revolution  of Vehicles and TransportationThe Autonomous Revolution  of Vehicles and Transportation
The Autonomous Revolution of Vehicles and TransportationMark Goldstein
 
The Dawn of Industry 4.0
The Dawn of Industry 4.0The Dawn of Industry 4.0
The Dawn of Industry 4.0CPqD
 
Ericsson for opa 270318 rev_c_novideo
Ericsson for opa 270318 rev_c_novideoEricsson for opa 270318 rev_c_novideo
Ericsson for opa 270318 rev_c_novideoMaria Boura
 
The perfect storm: 5G, Industry 4.0 and Women
The perfect storm: 5G, Industry 4.0 and WomenThe perfect storm: 5G, Industry 4.0 and Women
The perfect storm: 5G, Industry 4.0 and WomenMaria Boura
 
Key note speech media-130716_final
Key note speech media-130716_finalKey note speech media-130716_final
Key note speech media-130716_finalMaria Boura
 
DWS17 - Smart Mobility seminar - Samuel ROPERT - IDATE Digiworld
DWS17 - Smart Mobility seminar - Samuel ROPERT - IDATE DigiworldDWS17 - Smart Mobility seminar - Samuel ROPERT - IDATE Digiworld
DWS17 - Smart Mobility seminar - Samuel ROPERT - IDATE DigiworldIDATE DigiWorld
 
How operator core networks evolve towards 5G - Digital Futures 2025
How operator core networks evolve towards 5G - Digital Futures 2025How operator core networks evolve towards 5G - Digital Futures 2025
How operator core networks evolve towards 5G - Digital Futures 2025Ovum
 
A technology marketer's view on innovation (2019)
A technology marketer's view on innovation (2019)A technology marketer's view on innovation (2019)
A technology marketer's view on innovation (2019)Marc Jadoul
 
Connected Vehicle 101 - US Department of Transportation
Connected Vehicle 101 - US Department of TransportationConnected Vehicle 101 - US Department of Transportation
Connected Vehicle 101 - US Department of TransportationAndy Palanisamy
 
Smartweek 2014 - Internet of Things (closing day 1 keynote)
Smartweek 2014 - Internet of Things (closing day 1 keynote)Smartweek 2014 - Internet of Things (closing day 1 keynote)
Smartweek 2014 - Internet of Things (closing day 1 keynote)Rick Huijbregts
 
Future agenda autonomous vehicles -the emerging landscape final
Future agenda   autonomous vehicles -the emerging landscape finalFuture agenda   autonomous vehicles -the emerging landscape final
Future agenda autonomous vehicles -the emerging landscape finalFuture Agenda
 
DWS15 - Digital Channels Plenary Session - Vertical industries race to digiti...
DWS15 - Digital Channels Plenary Session - Vertical industries race to digiti...DWS15 - Digital Channels Plenary Session - Vertical industries race to digiti...
DWS15 - Digital Channels Plenary Session - Vertical industries race to digiti...IDATE DigiWorld
 
Future of autonomous vehicles initial perspective - 8 october 2018
Future of autonomous vehicles   initial perspective - 8 october 2018Future of autonomous vehicles   initial perspective - 8 october 2018
Future of autonomous vehicles initial perspective - 8 october 2018Future Agenda
 
The Autonomous Revolution of Vehicles & Transportation 6/12/19
The Autonomous Revolution of Vehicles & Transportation 6/12/19The Autonomous Revolution of Vehicles & Transportation 6/12/19
The Autonomous Revolution of Vehicles & Transportation 6/12/19Mark Goldstein
 

La actualidad más candente (20)

IDATE DigiWorld - Autonomous Cars Antoine Klifa
IDATE DigiWorld - Autonomous Cars Antoine KlifaIDATE DigiWorld - Autonomous Cars Antoine Klifa
IDATE DigiWorld - Autonomous Cars Antoine Klifa
 
Role of Satellite Technology in Supporting Connectivity to Vehicles - Intelsat
Role of Satellite Technology in Supporting Connectivity to Vehicles - IntelsatRole of Satellite Technology in Supporting Connectivity to Vehicles - Intelsat
Role of Satellite Technology in Supporting Connectivity to Vehicles - Intelsat
 
20160914 EuroSPI: "Automotive Security: Challenges, Standards and Solutions"
20160914 EuroSPI: "Automotive Security: Challenges, Standards and Solutions"20160914 EuroSPI: "Automotive Security: Challenges, Standards and Solutions"
20160914 EuroSPI: "Automotive Security: Challenges, Standards and Solutions"
 
5 Autonomous Cars Trends Everyone Should Know About In 2019
5 Autonomous Cars Trends Everyone Should Know About In 20195 Autonomous Cars Trends Everyone Should Know About In 2019
5 Autonomous Cars Trends Everyone Should Know About In 2019
 
Connected Cars & 5G
Connected Cars & 5GConnected Cars & 5G
Connected Cars & 5G
 
The Autonomous Revolution of Vehicles and Transportation
The Autonomous Revolution  of Vehicles and TransportationThe Autonomous Revolution  of Vehicles and Transportation
The Autonomous Revolution of Vehicles and Transportation
 
The Dawn of Industry 4.0
The Dawn of Industry 4.0The Dawn of Industry 4.0
The Dawn of Industry 4.0
 
Ericsson for opa 270318 rev_c_novideo
Ericsson for opa 270318 rev_c_novideoEricsson for opa 270318 rev_c_novideo
Ericsson for opa 270318 rev_c_novideo
 
The perfect storm: 5G, Industry 4.0 and Women
The perfect storm: 5G, Industry 4.0 and WomenThe perfect storm: 5G, Industry 4.0 and Women
The perfect storm: 5G, Industry 4.0 and Women
 
Key note speech media-130716_final
Key note speech media-130716_finalKey note speech media-130716_final
Key note speech media-130716_final
 
DWS17 - Smart Mobility seminar - Samuel ROPERT - IDATE Digiworld
DWS17 - Smart Mobility seminar - Samuel ROPERT - IDATE DigiworldDWS17 - Smart Mobility seminar - Samuel ROPERT - IDATE Digiworld
DWS17 - Smart Mobility seminar - Samuel ROPERT - IDATE Digiworld
 
How operator core networks evolve towards 5G - Digital Futures 2025
How operator core networks evolve towards 5G - Digital Futures 2025How operator core networks evolve towards 5G - Digital Futures 2025
How operator core networks evolve towards 5G - Digital Futures 2025
 
A technology marketer's view on innovation (2019)
A technology marketer's view on innovation (2019)A technology marketer's view on innovation (2019)
A technology marketer's view on innovation (2019)
 
Connected Vehicle 101 - US Department of Transportation
Connected Vehicle 101 - US Department of TransportationConnected Vehicle 101 - US Department of Transportation
Connected Vehicle 101 - US Department of Transportation
 
Smartweek 2014 - Internet of Things (closing day 1 keynote)
Smartweek 2014 - Internet of Things (closing day 1 keynote)Smartweek 2014 - Internet of Things (closing day 1 keynote)
Smartweek 2014 - Internet of Things (closing day 1 keynote)
 
Future agenda autonomous vehicles -the emerging landscape final
Future agenda   autonomous vehicles -the emerging landscape finalFuture agenda   autonomous vehicles -the emerging landscape final
Future agenda autonomous vehicles -the emerging landscape final
 
DWS15 - Digital Channels Plenary Session - Vertical industries race to digiti...
DWS15 - Digital Channels Plenary Session - Vertical industries race to digiti...DWS15 - Digital Channels Plenary Session - Vertical industries race to digiti...
DWS15 - Digital Channels Plenary Session - Vertical industries race to digiti...
 
Future of autonomous vehicles initial perspective - 8 october 2018
Future of autonomous vehicles   initial perspective - 8 october 2018Future of autonomous vehicles   initial perspective - 8 october 2018
Future of autonomous vehicles initial perspective - 8 october 2018
 
The Autonomous Revolution of Vehicles & Transportation 6/12/19
The Autonomous Revolution of Vehicles & Transportation 6/12/19The Autonomous Revolution of Vehicles & Transportation 6/12/19
The Autonomous Revolution of Vehicles & Transportation 6/12/19
 
Health 4.0
Health 4.0Health 4.0
Health 4.0
 

Similar a Cybersecurity in the Age of the Everynet

Bridgera enterprise IoT security
Bridgera enterprise IoT securityBridgera enterprise IoT security
Bridgera enterprise IoT securityRon Pascuzzi
 
EMC Solutions for the Internet of Things and Industrie 4.0 - Platforms (EN) <...
EMC Solutions for the Internet of Things and Industrie 4.0 - Platforms (EN) <...EMC Solutions for the Internet of Things and Industrie 4.0 - Platforms (EN) <...
EMC Solutions for the Internet of Things and Industrie 4.0 - Platforms (EN) <...Dell Technologies
 
The Next Big Thing in Technology: What innovations will have the biggest impa...
The Next Big Thing in Technology: What innovations will have the biggest impa...The Next Big Thing in Technology: What innovations will have the biggest impa...
The Next Big Thing in Technology: What innovations will have the biggest impa...Career Communications Group
 
Keynote - IoT and role of Mediatek in the IoT space
Keynote - IoT and role of Mediatek in the IoT spaceKeynote - IoT and role of Mediatek in the IoT space
Keynote - IoT and role of Mediatek in the IoT spaceDr. Shivananda Koteshwar
 
Addressing Global Chanllenges Through IoT
Addressing Global Chanllenges Through IoTAddressing Global Chanllenges Through IoT
Addressing Global Chanllenges Through IoTDr.Vetrivelan Pandu
 
Trust in the Digital Single Market - Cloud Expo 2017
Trust in the Digital Single Market - Cloud Expo 2017Trust in the Digital Single Market - Cloud Expo 2017
Trust in the Digital Single Market - Cloud Expo 2017CloudWATCH Consortium
 
Little.story.it.architecture
Little.story.it.architectureLittle.story.it.architecture
Little.story.it.architectureÉric Grall
 
CTO-Frühjahrsforum_Huawei_20190412
CTO-Frühjahrsforum_Huawei_20190412CTO-Frühjahrsforum_Huawei_20190412
CTO-Frühjahrsforum_Huawei_20190412MIPLM
 
Security & Privacy Considerations for Advancing Technology
Security & Privacy Considerations for Advancing TechnologySecurity & Privacy Considerations for Advancing Technology
Security & Privacy Considerations for Advancing TechnologyJohn D. Johnson
 
Tutorial on Internet of Thing (IoT) Paradigm in Consumer Applications
Tutorial on Internet of Thing (IoT) Paradigm in Consumer ApplicationsTutorial on Internet of Thing (IoT) Paradigm in Consumer Applications
Tutorial on Internet of Thing (IoT) Paradigm in Consumer ApplicationsRaffaele Giaffreda
 
Evolution of Mobile Communication(1G-6G) and IoT
Evolution of Mobile Communication(1G-6G) and IoTEvolution of Mobile Communication(1G-6G) and IoT
Evolution of Mobile Communication(1G-6G) and IoTMd.Imtiaz Ahmed
 
informationtech1-180930175759.pptx
informationtech1-180930175759.pptxinformationtech1-180930175759.pptx
informationtech1-180930175759.pptxjaspreetkaur908049
 
Industry4.0 IoT Vincent Thavonekham - Azure Day Ukraine
Industry4.0 IoT Vincent Thavonekham - Azure Day UkraineIndustry4.0 IoT Vincent Thavonekham - Azure Day Ukraine
Industry4.0 IoT Vincent Thavonekham - Azure Day UkraineFactoVia
 
Tech Careers 101 - Empowering Your Tech Journey
Tech Careers 101 - Empowering Your Tech JourneyTech Careers 101 - Empowering Your Tech Journey
Tech Careers 101 - Empowering Your Tech JourneySFSupport
 
Ericsson Technology Review: Spotlight on the Internet of Things
Ericsson Technology Review: Spotlight on the Internet of ThingsEricsson Technology Review: Spotlight on the Internet of Things
Ericsson Technology Review: Spotlight on the Internet of ThingsEricsson
 
1. How will the IoT help your business - cisco
1. How will the IoT help your business - cisco1. How will the IoT help your business - cisco
1. How will the IoT help your business - ciscoMITEF México
 
Smart Cities Day 2 Urban Innovation
Smart Cities Day 2 Urban InnovationSmart Cities Day 2 Urban Innovation
Smart Cities Day 2 Urban Innovation4 All of Us
 

Similar a Cybersecurity in the Age of the Everynet (20)

Bridgera enterprise IoT security
Bridgera enterprise IoT securityBridgera enterprise IoT security
Bridgera enterprise IoT security
 
EMC Solutions for the Internet of Things and Industrie 4.0 - Platforms (EN) <...
EMC Solutions for the Internet of Things and Industrie 4.0 - Platforms (EN) <...EMC Solutions for the Internet of Things and Industrie 4.0 - Platforms (EN) <...
EMC Solutions for the Internet of Things and Industrie 4.0 - Platforms (EN) <...
 
The Next Big Thing in Technology: What innovations will have the biggest impa...
The Next Big Thing in Technology: What innovations will have the biggest impa...The Next Big Thing in Technology: What innovations will have the biggest impa...
The Next Big Thing in Technology: What innovations will have the biggest impa...
 
Keynote - IoT and role of Mediatek in the IoT space
Keynote - IoT and role of Mediatek in the IoT spaceKeynote - IoT and role of Mediatek in the IoT space
Keynote - IoT and role of Mediatek in the IoT space
 
Addressing Global Chanllenges Through IoT
Addressing Global Chanllenges Through IoTAddressing Global Chanllenges Through IoT
Addressing Global Chanllenges Through IoT
 
Trust in the Digital Single Market - Cloud Expo 2017
Trust in the Digital Single Market - Cloud Expo 2017Trust in the Digital Single Market - Cloud Expo 2017
Trust in the Digital Single Market - Cloud Expo 2017
 
Cloud Revolution Conitnues
Cloud Revolution ConitnuesCloud Revolution Conitnues
Cloud Revolution Conitnues
 
From IoT Devices to Cloud
From IoT Devices to CloudFrom IoT Devices to Cloud
From IoT Devices to Cloud
 
Little.story.it.architecture
Little.story.it.architectureLittle.story.it.architecture
Little.story.it.architecture
 
CTO-Frühjahrsforum_Huawei_20190412
CTO-Frühjahrsforum_Huawei_20190412CTO-Frühjahrsforum_Huawei_20190412
CTO-Frühjahrsforum_Huawei_20190412
 
Security & Privacy Considerations for Advancing Technology
Security & Privacy Considerations for Advancing TechnologySecurity & Privacy Considerations for Advancing Technology
Security & Privacy Considerations for Advancing Technology
 
Tutorial on Internet of Thing (IoT) Paradigm in Consumer Applications
Tutorial on Internet of Thing (IoT) Paradigm in Consumer ApplicationsTutorial on Internet of Thing (IoT) Paradigm in Consumer Applications
Tutorial on Internet of Thing (IoT) Paradigm in Consumer Applications
 
Evolution of Mobile Communication(1G-6G) and IoT
Evolution of Mobile Communication(1G-6G) and IoTEvolution of Mobile Communication(1G-6G) and IoT
Evolution of Mobile Communication(1G-6G) and IoT
 
informationtech1-180930175759.pptx
informationtech1-180930175759.pptxinformationtech1-180930175759.pptx
informationtech1-180930175759.pptx
 
Industry4.0 IoT Vincent Thavonekham - Azure Day Ukraine
Industry4.0 IoT Vincent Thavonekham - Azure Day UkraineIndustry4.0 IoT Vincent Thavonekham - Azure Day Ukraine
Industry4.0 IoT Vincent Thavonekham - Azure Day Ukraine
 
Tech Careers 101 - Empowering Your Tech Journey
Tech Careers 101 - Empowering Your Tech JourneyTech Careers 101 - Empowering Your Tech Journey
Tech Careers 101 - Empowering Your Tech Journey
 
Ericsson Technology Review: Spotlight on the Internet of Things
Ericsson Technology Review: Spotlight on the Internet of ThingsEricsson Technology Review: Spotlight on the Internet of Things
Ericsson Technology Review: Spotlight on the Internet of Things
 
1. How will the IoT help your business - cisco
1. How will the IoT help your business - cisco1. How will the IoT help your business - cisco
1. How will the IoT help your business - cisco
 
PROFINET of Things, IIoT and Industry 4 - Derek Lane
PROFINET of Things, IIoT and Industry 4 - Derek LanePROFINET of Things, IIoT and Industry 4 - Derek Lane
PROFINET of Things, IIoT and Industry 4 - Derek Lane
 
Smart Cities Day 2 Urban Innovation
Smart Cities Day 2 Urban InnovationSmart Cities Day 2 Urban Innovation
Smart Cities Day 2 Urban Innovation
 

Más de Bill Harpley

Marine and coastal applications of LoRa wireless technology
Marine and coastal applications of LoRa wireless technologyMarine and coastal applications of LoRa wireless technology
Marine and coastal applications of LoRa wireless technologyBill Harpley
 
How to survive the Fourth Industrial Revolution: a guide to Digital Manufactu...
How to survive the Fourth Industrial Revolution: a guide to Digital Manufactu...How to survive the Fourth Industrial Revolution: a guide to Digital Manufactu...
How to survive the Fourth Industrial Revolution: a guide to Digital Manufactu...Bill Harpley
 
SME 10-minute guide to digital transformation v1
SME 10-minute guide to digital transformation v1SME 10-minute guide to digital transformation v1
SME 10-minute guide to digital transformation v1Bill Harpley
 
Scaling IoT Security
Scaling IoT SecurityScaling IoT Security
Scaling IoT SecurityBill Harpley
 
Building an 'Internet of Things' ( IoT ) technology cluster in Brighton
Building an 'Internet of Things' ( IoT ) technology cluster in BrightonBuilding an 'Internet of Things' ( IoT ) technology cluster in Brighton
Building an 'Internet of Things' ( IoT ) technology cluster in BrightonBill Harpley
 
Building the Social Internet of Things
Building the Social Internet of ThingsBuilding the Social Internet of Things
Building the Social Internet of ThingsBill Harpley
 
Get yourself connected: Google Glass and the Internet of Bling
Get yourself connected: Google Glass and the Internet of BlingGet yourself connected: Google Glass and the Internet of Bling
Get yourself connected: Google Glass and the Internet of BlingBill Harpley
 

Más de Bill Harpley (7)

Marine and coastal applications of LoRa wireless technology
Marine and coastal applications of LoRa wireless technologyMarine and coastal applications of LoRa wireless technology
Marine and coastal applications of LoRa wireless technology
 
How to survive the Fourth Industrial Revolution: a guide to Digital Manufactu...
How to survive the Fourth Industrial Revolution: a guide to Digital Manufactu...How to survive the Fourth Industrial Revolution: a guide to Digital Manufactu...
How to survive the Fourth Industrial Revolution: a guide to Digital Manufactu...
 
SME 10-minute guide to digital transformation v1
SME 10-minute guide to digital transformation v1SME 10-minute guide to digital transformation v1
SME 10-minute guide to digital transformation v1
 
Scaling IoT Security
Scaling IoT SecurityScaling IoT Security
Scaling IoT Security
 
Building an 'Internet of Things' ( IoT ) technology cluster in Brighton
Building an 'Internet of Things' ( IoT ) technology cluster in BrightonBuilding an 'Internet of Things' ( IoT ) technology cluster in Brighton
Building an 'Internet of Things' ( IoT ) technology cluster in Brighton
 
Building the Social Internet of Things
Building the Social Internet of ThingsBuilding the Social Internet of Things
Building the Social Internet of Things
 
Get yourself connected: Google Glass and the Internet of Bling
Get yourself connected: Google Glass and the Internet of BlingGet yourself connected: Google Glass and the Internet of Bling
Get yourself connected: Google Glass and the Internet of Bling
 

Último

Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Servicegiselly40
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsRoshan Dwivedi
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Igalia
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreternaman860154
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...gurkirankumar98700
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024Results
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 

Último (20)

Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024A Call to Action for Generative AI in 2024
A Call to Action for Generative AI in 2024
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 

Cybersecurity in the Age of the Everynet

  • 1. Cybersecurity in the Age of the Everynet New materials for mischief and magic
  • 2. This presentation was given to the British Computer Society IRMA SG on May 9th 2017 09/05/2017 © 2017 Astius Technology 2
  • 3. Bill Harpley MSc • 30+ years in technology sector • Founder of Astius Technology • Organiser of Brighton IoT meetup group (700+ members) • Initiator of Brighton node of the global Things Network • Organiser of the Self-driving Cars & Autonomous Vehicles meetup group https://uk.linkedin.com/in/billharpley bill.harpley@astius.co.uk www.astius.co.uk About your presenter 09/05/2017 © 2017 Astius Technology 3
  • 4. What you will discover today • In this presentation we will talk about: – The Five Epochs of Computing – The Everynet: its origins and meaning – Emerging Cybersecurity challenges – Why we need a new approach to Cybersecurity – What the future holds for the Cybersecurity profession 09/05/2017 © 2017 Astius Technology 4
  • 5. Part 1: The Five Epochs 09/05/2017 © 2017 Astius Technology 5
  • 6. The Five Epochs 1950 1975 1995 2015 2035 2055 The age of the Mainframe The age of the Internet The age of the Ethernet The age of the Quantnet The age of the Everynet • The history and future of Computing can be divided into five epochs • Although this is slightly arbitrary, it provides a solid basis for our discussion today 09/05/2017 © 2017 Astius Technology 6
  • 7. The age of the Mainframe 1950 1975 1995 2015 2035 2055 The age of the Mainframe The age of the Internet The age of the Ethernet The age of the Quantnet The age of the Everynet 09/05/2017 © 2017 Astius Technology 7 1950 1960 1970 1974 IBM ship S/360 mainframe (1964) IBM ship S/370 mainframe (1970) TRANSIC - first transistorised Computer (1954) Intel launch 4004 processor (1971) Work begins on development of TCP/IP (1973) Work begins on ARPANET project (1969) MULTICS time- sharing operating system (1969) AT&T ship Unix Version 5 (1973) Research into virtual machine technology began in late 1960s Ethernet developed at Xerox Parc (1973-1974) Gordon Moore publishes “Moore’s Law” (1965) Alan Turing describes the “Turing Test” 1950 LEO Computer designed in UK (1951) First workshop on Artificial Intelligence at Dartmouth College (1956)
  • 8. The age of the Ethernet 1950 1975 1995 2015 2035 2055 The age of the Mainframe The age of the Internet The age of the Ethernet The age of the Quantnet The age of the Everynet 09/05/2017 © 2017 Astius Technology 8 IBM launch Personal Computer (1981) 1975 1985 1994 Apple I computer Launched (1976) Apple II computer Launched (1977) Apple Newton launched (1994) Domain Name System created (1983) HTTP protocol created at CERN (1989) Cisco ships its first router (1987) NCSA Mosaic web browser released (1993) Demon Internet pioneer “tenner a month” dial-up access to the Internet in the UK (1993) Ethernet standardised as IEEE802.3 (1983) Ethernet begins steady rise towards dominance UK home computer boom led by ZX Spectrum and BBC Micro (1981) Digital ship VAX-11/780 mini-computer (1977) First ever Internet worm detected (1988) ChaosComputer Club launchedin Germany (1981) NortonAntivirus launchedto combat rising tide of software viruses (1990)Microsoft ships Windows 1.0 (1983) Linus Torvald announces Linux OS (1991) CMU Internet Coke machine (1982) RSA crypto patent granted(1983) DEC publishfirst paper on Firewalls (1988) Paul Benioff proposes Quantum Computer (1982)
  • 9. The age of the Internet 1950 1975 1995 2015 2035 2055 The age of the Mainframe The age of the Internet The age of the Ethernet The age of the Quantnet The age of the Everynet 09/05/2017 © 2017 Astius Technology 9 Number of connected hosts reaches 100 million (2001) 1995 2005 2014 Vmware release ‘Workstation’ (1999) Amazon Web Services (2006) Facebook announce ‘OpenCompute’ project (2011)Apple iPhone launched (2006) Google launch search engine (1998) Launch of Facebook (2004) Commercialisation of Internet gathers pace Ethernet has attained dominant position by 2000 SSL 3.0 released (1995) Linux gains commercial acceptance SATAN security tool released (1995) Cloud Computing gains commercial acceptance BS7799 (Part 1) published(1995) BS7799 (Part 2) published(1998) BS7799 adopted as ISO17799 (2000) ISO17799 morphs into ISO27001/2 (2007) STUXNET incident (2010) Google acquires Android (2005) End of Moore’s Law widely predicted Google launches self-driving cars project (2009) You Tube launch (2005) Satashi Nakamoto publishes Bitcoin paper (2008) OpenStack SDN project launched (2010) IEEE802.11b Wireless LAN standard (1999) Massive cyber- attacks on Estonia (2007) ETSI hold first NFV trials (2014)
  • 10. The age of the Everynet 1950 1975 1995 2015 2035 2055 The age of the Mainframe The age of the Internet The age of the Ethernet The age of the Quantnet The age of the Everynet 09/05/2017 © 2017 Astius Technology 10 Hype begins about 5G (2015) 2015 20342020 Mira IoT DDoS attack (2016) Amazon Alexa launched in UK (2016) Infamous ‘Jeep’ hack (2015) IoT concept starts to go mainstream (2017) First wave of near- autonomous cars takes to the roads (2020) Launch of 5G mobile network in UK (2023) ~ 20 billion devices connected to the Everynet (2020) ~ 30 billion devices connected to the Everynet (2025) IP protocol stack replaced by Next- generation protocol ( ~2030) Anything from 2020 onwards is idle speculation First demonstration of quantum-safe cryptography (2028) Steady progress is made towards building viable quantum computers The last smartphone rolls off the production line (2027) Moore’s Law comes to an end (2022) Neuromorphic Computing grows in popularity (2026) First generation quantum computers come to market (2030) Early signs that innovation in Everynet paradigm has peaked (2032) Concern about election hacking (2016-2017) Resurgence of interest in AI and Machine Learning 5G standards agreed (2018) LPWANs grow in popularity
  • 11. The age of the Quantnet 1950 1975 1995 2015 2035 2055 The age of the Mainframe The age of the Internet The age of the Ethernet The age of the Quantnet The age of the Everynet 09/05/2017 © 2017 Astius Technology 11 Your guess is as good as mine 2035 2045 2055 Fully autonomous cars common site on roads (2035) Launch of 6G mobile network in UK (2036) Quantum computing is now where mainframes were in the 1960s - primitive but with great potential for growth and improvement. The Singularity arrives when machine intelligence can match human intelligence (2045) Bio-hacking to improve human performance is now commonplace ~ 80 billion devices connected to the Quantnet (2035)
  • 12. The expanding attack surface The age of the Mainframe The age of the Internet The age of the Ethernet The age of the Quantnet The age of the Everynet Rapidly inflating size of attack surface 09/05/2017 © 2017 Astius Technology 12
  • 13. Internet traffic forecasts 09/05/2017 © 2017 Astius Technology 13 According to Cisco Visual Networking Index global Internet report, by the year 2020 there will be: 4.1bn global Internet users 26.3bn devices and connections 82% of Internet traffic will be video 2.3bn zetabytes of traffic per annum
  • 14. The past and future of cybersecurity Mainframe Ethernet Internet Everynet Quantnet Long-term drivers of complexity  Increasing Computational Power  Evolving network architecture ( Fixed, Wireless, Mobile, Satellite)  Increasing data transmission rates  Increasing network bandwidth  Expanding user population (People, Things, Machines)  More distributed intelligence  Changing traffic diversity (Email, Video, Web, Voice, Raw data)  Changing expectations of users Question: how can this growth be securely managed in the future? Answer: reduce complexity! 09/05/2017 © 2017 Astius Technology 14
  • 15. Part 2: ‘Everynet’: it’s origins and meaning 09/05/2017 © 2017 Astius Technology 15
  • 16. The Internet of Nonsense Origins of IoT phrase British born researcher and entrepreneur Kevin Ashton is credited with coining the term ‘Internet of Things’ in an article which he wrote in 1999 My personal view • The phrase ‘Internet of Things’ has zero resonance with non-technical people. • It’s widespread use has bemused non-technical people and delayed development of the market. Photo: Wikimedia Commons To be fair, Kevin Ashton cannot have anticipated that the phrase ‘Internet of Things’ would be picked up by corporate Marketing departments and turned into a stupid marketing sound-bite. 09/05/2017 © 2017 Astius Technology 16
  • 17. The Everynet concept Meaning: you can connect every thing to the global Internet. As a concept: • It’s more readily accepted by non-technical people (which is the majority of humans on the planet) • It can be understood as the next phase of evolution towards the creation of a rich global communications fabric • It’s not just a stupid marketing phrase! CONTENT Video, voice, email, web INDUSTRIAL Data collected from sensors and to control actuators CONSUMER Data collected from sensors and to control actuators Management and Supervisory Traffic on the Everynet 09/05/2017 © 2017 Astius Technology 17
  • 18. Part 3: Emerging Cybersecurity Challenges 09/05/2017 © 2017 Astius Technology 18
  • 19. An overview of current threats Here are a few tasty nuggets from the Cisco Cybersecurity Report 2017 • On average, organisations only have capacity to deal with 56% of the security alerts which they receive on a given day • It’s thought that 27% of connected cloud applications introduced by employees pose a security risk to enterprise infrastructure (due to O-Auth single sign-on) • Spam accounts for 65% of global email volume and 10% of global spam is thought to be malicious • Organisations which have not yet suffered a security breach believe their networks to be safe • There is growing concern about the expansion of the attack surface. • Security professionals surveyed by the report expressed similar degrees of concern:  Mobile Devices (58% expressed concern)  Data in the Public cloud (57% expressed concern)  Cloud Infrastructure (57% expressed concern)  ‘Dangerous’ user behaviour - e.g. clicking links in emails (57%) 09/05/2017 © 2017 Astius Technology 19
  • 20. Errant Actors on the cyber-stage Cyber-criminals Violent terror groups State-sponsored actors Hacktivist groups Script kiddies 09/05/2017 © 2017 Astius Technology 20
  • 21. The size of the potential attack surface is about to increase dramatically This will create yet more opportunities for malice and mischief 09/05/2017 © 2017 Astius Technology 21
  • 22. The world of Cyber-physical systems 09/05/2017 © 2017 Astius Technology 22
  • 23. Wikipedia definition A cyber-physical system (CPS) is a mechanism controlled or monitored by computer-based algorithms, tightly integrated with the internet and its users. In cyber-physical systems, physical and software components are deeply intertwined, each operating on different spatial and temporal scales, exhibiting multiple and distinct behavioural modalities, and interacting with each other in a myriad of ways that change with context.Examples of CPS include smart grid, autonomous automobile systems, medical monitoring, process control systems, robotics systems, and automatic pilot avionics Source: Wikipedia In other words, it’s where the digital world meets the physical world 09/05/2017 © 2017 Astius Technology 23
  • 24. Example: M2M applications M2M is a broad term which describes any kind of wired or wireless communication between electronic or electro-mechanical end-points. M2M is employed in a wide range of vertical market applications 09/05/2017 © 2017 Astius Technology 24
  • 25. Example: Industrial monitoring and automation SCADA systems are employed in monitoring and control applications • Industrial Processes: e.g. oil refining, electrical power generation • Infrastructure Management: e.g. Windfarms, Water treatment, Energy grids • Facilities Management: e.g. Air-conditioning, Heating, Ventilation 09/05/2017 © 2017 Astius Technology 25
  • 26. Connecting critical systems A great deal of industrial and public infrastructure was designed and built in a more innocent age: • Many components in a SCADA system were designed to have a long operational life (15+ years) • They were built using a patchwork of proprietary and industry de facto standards • Such systems were never intended to be connected to an enterprise network • Trend is towards making these systems IP enabled, which poses major security challenges These types of systems make modern life possible: e.g. National Electricity Grid, Mass Transport, Food Distribution – growing concern that cyber-attacks on critical infrastructure could cause major economic disruption and potential loss of life. 09/05/2017 © 2017 Astius Technology 26
  • 27. Massive attacks UKRANIAN POWER GRID (2015) Three electricity power distribution companies were subject to a massive cyber-attack: • 225,000 customers were without power for several hours • Call centres were flooded with bogus calls to hinder the response to the outage • It’s thought that the attackers gained access to the system via email ‘phishing’ and malware attacks • The source of the attack was suspected to be a foreign government agency STUXNET (2009) Targeted at Iran’s nuclear programme with a view to disrupting production of nuclear material • It was a malicious computer ‘worm’ which targeted industrial control systems • It’s thought to have been introduced into the system via a USB storage device • The infection caused the nuclear centrifuges to spin out of control • Good example of use of zero-day software defects to launch malicious attack on a system 09/05/2017 © 2017 Astius Technology 27
  • 28. Protecting UK critical infrastructure • Government classifies Critical National Infrastructure (CNI) on the basis of potential for disruption – Responsibility for managing risks lies with CNI operators – Not everything can be ‘critical’, so priorities have to be set According to the Cambridge Centre for Risk Studies, the economic impact of a major cyber-attack on a regional electricity supply network would be £12bn in terms of direct and indirect losses 09/05/2017 © 2017 Astius Technology 28 https://www.sbs.ox.ac.uk/cybersecurity-capacity/system/files/Integrated_Infrastructure_Cyber_Resiliency_in_Society_8_Apr_2016.pdf
  • 29. Safety v. Security Potential source of conflict exists between Safety and Security • Example: automotive safety stand ISO26262 • Problem: adding security features (e.g. firewalls) may impede the performance of time-critical software functions, which may degrade safety • It may be difficult to retrofit security to existing cyber-physical systems • New systems must be carefully designed to meet requirements of both Safety and Security 09/05/2017 © 2017 Astius Technology 29
  • 30. Novel forms of attack • Side-channel attacks aim to gather cryptographic intelligence about a system by indirect means • Examples include: – Cache monitoring attack on shared computing environment – Electromagnetic monitoring attack – Power monitoring attack – Data remanence The proliferation of ‘things’ will increase scope for these type of attacks 09/05/2017 © 2017 Astius Technology 30
  • 31. Protecting consumers 09/05/2017 © 2017 Astius Technology 31
  • 32. A problem of Trust • There is no recognised trust model for designing security into connected consumer devices. • These devices can potentially be controlled and used to eavesdrop on the local environment from anywhere in the world. INVASION OF PRIVACY RANSOMWARE THEFT OF PERSONAL INFORMATION MALICIOUS HIJACKING OF DEVICES A February 2017 survey showed that 72% of consumers were not sure how to check whether their devices had been compromised. 09/05/2017 © 2017 Astius Technology 32
  • 33. Common issues MANUFACTURER  May have left “back-door” into the device software  May put onus on consumer to apply software updates  May cease to provide software updates after a relatively short period of time ( ~2-3 years ) CONSUMER  Not obligated to change well-known default passwords  May choose weak passwords which are easy to guess or readily cracked with dictionary attack  May be unaware of the manufacturers default settings for the device (2016) Mirai bot attack compromised thousands of IP Cameras and home routers. Exploited ‘old’ versions of Linux to launch a massive DDoS attack. 09/05/2017 © 2017 Astius Technology 33
  • 34. The perils of Software Complexity 09/05/2017 © 2017 Astius Technology 34
  • 35. All code is vulnerable Commercial code is estimated to have about 25 bugs per thousand lines of code Safety critical code is estimated to have 1 bug per thousand lines of code (e.g. Aviation) Software (and hardware) may be compromised within global supply chains. Questions for you to ponder 1. Do you feel that some manufacturers prioritise ‘time to market’ over security? 2. Do you think that modern ‘dev-ops’ fast release software cycles in any way diminishes security? 3. How can we ensure the integrity of hardware and software products within the context of long global supply chains? 4. Do you think that we need better methods of designing and testing software? 5. Would you be prepared to pay more for products if you knew that they conformed to strict security standards? 09/05/2017 © 2017 Astius Technology 35
  • 36. Two cultures, One big problem 09/05/2017 © 2017 Astius Technology 36
  • 37. A tale of two cultures Enterprise Security Automation / Process Control Security Cyberphysical Security You have a major challenge ahead! What happens when two security teams from within the same organisation have to work together for the first time? 09/05/2017 © 2017 Astius Technology 37
  • 38. Emerging Solutions 09/05/2017 © 2017 Astius Technology 38
  • 39. The attackers advantage Attackers have plenty of time to research, plan and execute their attack. What can we do to minimise their strategic advantage? 09/05/2017 © 2017 Astius Technology 39
  • 40. Designing for Security and Privacy GOLDEN RULE: Design a system that is as secure as possible, given the prevailing needs and constraints SOFTWARE / HARDWARE • Define the security, availability and privacy goals of the system • Define the types of threats that the system will encounter in use • Prove that the design meets criteria (1) and (2) • Implement the system using a ‘defence in depth’ strategy • Processes must run with the lowest level of privileges needed to execute a task PRIVACY • ‘Privacy’ should be the default design goal • Collect only the minimum amount of information needed for the system to fulfil its purpose • Securely store user credentials • Understand how “anonymised” data can be exploited in undesirable ways • Securely destroy data which is no longer required 09/05/2017 © 2017 Astius Technology 40
  • 41. OWASP guidelines Minimise attack surface area Reduce the number possible attack vectors Establish secure defaults Application should be secure “out of the box” Principle of Least Privilege Processes should be assigned lowest level of privilege needed to fulfil its task Employ ‘defence in depth’ Fortify with diverse set of security measures Fail securely Processes which fail must not divulge confidential information Don’t trust services Mistrust applications provided by external service providers Separation of duties Employ role based access control Avoid ‘security by obscurity’ Use only as part of a broad set of security measures Keep security simple Complexity is the enemy of security, so always strive for simplicity Fix security issues correctly Ascertain root cause and test fix thoroughly Based on OWASP Developer Guide https://www.owasp.org/index.php/OWASP_Guide_Project 09/05/2017 © 2017 Astius Technology 41
  • 42. Share cyber intelligence Information Sharing and Analysis Organizations (ISAOs) These are a global community of organisations which share threat intelligence • Facilitates adoption of a proactive stance towards cybersecurity • Likely to become more predictive in the future and better able to prevent or mitigate attacks • May play an important role in helping to secure consumer grade connected devices • Example: Cyber-threat Intelligence Network (http://ctin.us ) UK Cyber-security Sharing Information Partnership (CiSP) • Joint industry and Government initiative • Hosted by National Cyber Security Centre (NCSC) https://www.ncsc.gov.uk/cisp • Currently has more than 2,225 participating organisations engaged in sharing of cyber- intelligence 09/05/2017 © 2017 Astius Technology 42 Also see NIST 800-150 https://www.nist.gov/publications/guide-cyber-threat-information- sharing
  • 43. Mining for cyber-intelligence One emerging approach is to employ Big Data and Machine Learning to detect real-time cyber incidents Apache Metron originated as a Cisco project but is now curated by the Apache Foundation •Store massive volumes of telemetry data for current and historical analysisSecurity Data Lake •Can ingest and parse data from common security apps (e.g. Snort, Netflow, pcap) Pluggable Framework •Performs standard SIEM1 analysis, plus forensic facilities such as packet replay and evidence storage Security Application •Anomaly detection and analysis, plus machine learning tools Threat Intelligence Platform 1. SIEM “Security Information and Event Management (SIEM)” https://metron.incubator.apache.org 09/05/2017 © 2017 Astius Technology 43
  • 44. Improving Software Quality • Developing secure bug-free software would be a significant step towards reducing complexity • NIST recommends the goals of security design should aim to reduce complexity at all levels by: – Reducing software engineering complexity – Making security more science and less art – Provide secure building blocks for creating complex software. • By abstracting the complexity away from software development, the ‘average’ developer could produce secure software 09/05/2017 © 2017 Astius Technology 44
  • 45. NIST IR 8151 (draft October 2016) NIST study “Dramatically Reducing Software Vulnerabilities” recommends: • Software analysis based on mathematical methodsFormal Methods • Eliminate vulnerabilities such as ‘buggy’ APIs and tightly manage resourcesSystem-Level Security • Tools to analyse software and eliminate problems (improves long-term quality of code base) Additive Software Analysis Techniques • Employ proven frameworks which promote the development an reuse of high quality, thoroughly tested software Domain-specific Software Development •Reduce the attack surface by dynamically adjusting the interface presented to the attacker and/or regenerating system components that have been compromised Automatic Software Diversity Goal is to achieve 25 errors per 100,000 lines of code for commercial software. 09/05/2017 © 2017 Astius Technology 45
  • 46. Moving Target Defences (MTD) • “Virtualise” the attack surface that is presented to the attacker – Configuration interface presented to an attacker constantly “morphs” – Reduces the attackers ‘window’ for planning and executing an attack – This does not reduce the number of software defects! 09/05/2017 © 2017 Astius Technology 46
  • 47. MTD: how it works • MTD is very active area of research • Currently more that 40 methods have been proposed • Examples: – Non-persistent execution environments – randomized execution of code – randomized network and host identities – randomizing compilers – dynamic address spaces – automated patch synthesis and installation http://blog.morphisec.com/moving- target-defense-common-practices 09/05/2017 © 2017 Astius Technology 47
  • 48. Inspired by nature DARPA ‘CRASH’ programme: Clean-Slate Design of Resilient, Adaptive, Secure Hosts • Biological immune systems can detect and supress ‘Intruders’ • Immune systems possess mechanisms that could enable us to build effective MTD systems:  Distributed processing  Pathogenic pattern recognition  Multilayered protection  Decentralized control  Diversity  Signalling between co-operating cells http://www.darpa.mil/program/clean-slate-design-of-resilient-adaptive-secure-hosts 09/05/2017 © 2017 Astius Technology 48
  • 49. Biohacking • “Biohacking” has several meanings but here we mean physical augmentation of human capabilities by hardware and/or software means • Examples include: – RFID implantation for personal ID purposes – Control of physical environment using Brain— Computer Interface (BCI) https://dangerousthings.com/ 09/05/2017 © 2017 Astius Technology 49
  • 50. Security designed for people • Security Ergonomics is emerging as a field of UX research • It seeks to understand: – How people react to security alerts – The influence of personality traits on attitudes to security • Emphasis is on observing people in their working and home environments Example: Carnegie Mellon University's Security Behaviour Observatory (SBO) https://www.cylab.cmu.edu/index.html 09/05/2017 © 2017 Astius Technology 50
  • 51. A role for blockchain • Blockchain is a distributed ledger technology which creates a permanent and immutable record of transactions • It is being used to record and secure data in many Smart City projects around the world – Secure data from IoT sensors – Enable smart contracts http://wwwf.imperial.ac.uk/blog/security-institute/2017/04/04/the-role-of- distributed-ledgers-in-securing-urban-infrastructure 09/05/2017 © 2017 Astius Technology 51
  • 52. A role for legislation EU Networks and Information Security Directory (2016) This obligates member states to: • Adopt a national cyber security strategy • Assign a national body the task of enforcing compliance • Establish a national CERT team to monitor threats and respond to incidents • Participate in a new Co-operation group to support the strategic exchange of information between member states General Data Protection Regulation (2017) The GDPR aims to strengthen privacy rights an impose large fines for non- compliance. Member states must: • Raise public awareness of cybersecurity • Support cyber training at all levels • Work with service providers to ensure that the Internet is safe to use • Provide support for Critical Network Infrastructure (CNI) providers to promote best practice and test cyber defences 09/05/2017 © 2017 Astius Technology 52
  • 53. Global governance Budapest Convention on Cybercrime • Aims to foster global co-operation on combating cybercrime • Currently has 52 signatories • Key states such as China, Russia and India have declined to sign the convention Strong argument to say that further international treaty needed to both combat cybercrime and curtail state-sponsored cyber attacks 09/05/2017 © 2017 Astius Technology 53
  • 54. The science of Security • There is no “Science of Security” • According to NASA the foundations of such a discipline are: •Develop methods to enable the construction of secure systems which have known propertiesScalability and Composability •Develop methods to enable policy based data handling and sharing across different authority domains Policy-driven Secure Collaboration •Develop metrics which allow us to predict how a system will behave in a given context Security-Metrics-Driven Evaluation •Design resilient architectures which continue to deliver services even when subject to attackResilient Architectures •Develop models of human behaviour (both users and adversaries) which enable us to build systems which have known security properties Understanding and accounting for human behaviour https://www.nsa.gov/what-we-do/research/science-of-security 09/05/2017 © 2017 Astius Technology 54
  • 55. Quantum Computing: the joker in the pack A few final thoughts on Quantum Computing… • It is very different than conventional notions of computation! • From a security perspective, the main interest is the theoretical ability of a Quantum Computer to break conventional cryptography • The security researcher Peter Shor estimated that a modest hybrid quantum/conventional computer could crack a powerful RSA cypher faster than a conventional computer could encrypt it. So this topic is the subject of a great deal of research • We are probably at least two decades away from the age of the Quantum Internet ( or the Quantnet, as I like to call it ) • At the present time, you need a large and expensive laboratory to perform even simple tasks http://systemdesign.altera.com/cares-quantum-computing http://www.etsi.org/images/files/ETSIWhitePapers/QuantumSafeWhitepaper.pdf 09/05/2017 © 2017 Astius Technology 55
  • 56. Training and skills development • Expect the Cybersecurity profession to change dramatically over the next decade • There will be increased automation to cope with complexity and skills shortages • It will become more proactive (rather than reactive) • It will become more multidisciplinary: – UX – Psychology – AI and Machine Learning – Safety conscious ( as more ‘things’ come online) You will need to engage more in training and professional development! 09/05/2017 © 2017 Astius Technology 56
  • 57. Conclusions 09/05/2017 © 2017 Astius Technology 57
  • 58. Dividing the history of Computing into five epochs is useful for the thinking about how Security has evolved in the past (and may evolve in the future) We need to devise methods to manage the expanding attack surface and help us deal with increasing complexity Attaching critical cyber-physical systems to the Internet brings with it the potential for devastating and disruptive large-scale cyber attacks We have surveyed a variety of emerging methods to help us build better quality software and to reduce the asymmetric advantage of the attacker Legislation and global governance will play an important role in the future Age of the Everynet Quantum Computing is still at the ‘hype’ phase but has the potential to break conventional cyphers The Cybersecurity profession will experience major transformation over the next decade. What have we learned today? 09/05/2017 © 2017 Astius Technology 58
  • 59. Any Questions 09/05/2017 © 2017 Astius Technology 59
  • 60. Advanced System Technologies in Urban Spaces™ 6009/05/2017 © 2017 Astius Technology 60