Date post: | 19-Dec-2015 |
Category: |
Documents |
Upload: | damian-logan |
View: | 223 times |
Download: | 0 times |
CYBERSAFE OverviewAFCEA C4ISR Symposium
28 April 2015
Presented by:
Mr. Brian MarshAssistant Chief Engineer
(Certification & Mission Assurance)SPAWAR 5.0
Statement A: Approved for public release, distribution is unlimited (27 APRIL 2015)
2
CYBERSAFE BLUF
▼ The CYBERSAFE Program is focused on ensuring effective cybersecurity design, procurement, and operation of the Navy’s most critical warfighting systems
▼ SPAWAR will play multiple key roles from both a Navy Enterprise and a SYSCOM perspective
▼ CYBERSAFE will bring heightened consideration to the cybersecurity elements of many SPAWAR Programs
But first, let’s discuss CYBERSAFE in the context of Navy cybersecurity
3
Source: Symantec 2015 Internet Security Threat Report
Extreme challenge to keep pace with exponential increase in cybersecurity requirements
Current Cyber Environment
4
Information Technology / Information Assurance Technical Authority Board
(IT/IA TAB)
Task Force Cyber Awakening
Technical Specs/Standards Developer
Joint Regional Security Stack (JRSS)
Authority to Operate (ATO) – Security Control Assessor
(SCA)
As Navy’s IA Technical Authority, SPAWAR will assume additional roles in CYBERSAFE
SPAWAR’s Role in Navy Cybersecurity
5
Scope
CYBERSAFE Overview
Construct
Platform PMsPEOs
Technical AuthorityIT/IA TA
Security & QA Authority
SYSCOMs
CYBERSAFE CERTIFICATION
AUTHORITYCYBERSAFE PMO
Navy Cybersecurity
CYBERSAFE
▼ Focused on limited subset of select network components that enable Mission Critical capabilities
▼ CYBERSAFE components may require additional controls beyond RMF
▼ CYBERSAFE Office to become an element within the overall Navy cybersecurity construct
Objective
Establish a CYBERSAFE Program to provide maximum reasonable assurance of a hardened subset of critical warfighting components
CYBERSAFE Program will focus on Mission Assurance of critical warfighting capabilities
6
CYBERSAFE Facets
Cyber System Level Cyber Condition
Y
Z
X FULL NET
• --------------• --------------
• --------------• --------------
TE
CH
NIC
AL C
AP
AB
ILITIE
S
CYBERSAFE Grade
NO NET
SEMI NET
• --------------• --------------CSL 1: Platform Safety
CSL 2: Platform Combat
CSL 3: Networked Combat
CSL4: Sustained Combat
Grade A: Mission Critical
Grade B: Mission Essential
Material Grade C: Non-Mission Essential
OperateOperating mode of platform based on likelihood of cyber
attack
DesignFunctionality Hierarchy of system to end-to-end
mission
Procure & BuildLevel of cyber protection incorporated into system
design
IT/IA TAB to develop criteria for leveraging facets to identify CYBERSAFE critical items
7
SPAWAR’s Role in CYBERSAFE
SPAWAR is Technical Authority for CYBERSAFE
– Cross-Enterprise Role
– Define criteria to identify CYBERSAFE Critical Items
– Develop specs & standards for CYBERSAFE Critical Items
– Interface with SYSCOM TAs to resolve CYBERSAFE issues
SPAWAR to establish a CYBERSAFE Entity
– Cross-SPAWAR Role (Led by SPAWAR 5.0)
– Identify SPAWAR’s CYBERSAFE Critical Items
– Ensure specs & standards are incorporated into acquisition and implemented into capabilities
– Perform certification of SPAWAR CYBERSAFE Critical Items
Ente
rpris
e Ro
leSY
SCO
M R
ole
COMSPAWAR assigned CHENG as SPAWAR’s Lead for CYBERSAFE
8
FY14 FY15 FY16 FY17
Host Level ProtectionSecurity Information Event Management (SIEM)
Information Sharing-Cross Domain Solution Information Tagging - Data Tagging
Network Firewall Vulnerability Scanning Account Management Public Key EnablingNetwork Intrusion Detection System (IDS) / Intrusion Protection System (IPS) Boundary Protection Cyber Configuration Management Wireless CommunicationsDFIA Afloat Cyber Risk Assessment Software Assurance Wireless Enclave Access Control
Continuous Monitoring DFIA Airborne
Event Management-Incident Management, Contingency Planning, Disaster Recovery, and Incident Response Data Encryption - DIT , Link
Asset ManagementAuthentication and Authorization / IdAM Data Encryption - DAR
Cyber Situational Awareness Web Security Remote AccessSupply Chain Risk Management Email Security DNS Security
DFIA AshoreBIOS Protection / TPM / Embedded Firmware Virtualization Security
IA TA Glossary Key Management / Exchange Assured Cloud ComputingDFIA and Standards POR Implementation Guidance (includes Controls / Standards mapping) Patch Management Unified Capability - VoIP, Telecom
IA Standards Work Plan approved by the IT/IA TAB
SPAWAR IA Standards Plan
9
FY14 FY15 FY16 FY17
Host Level ProtectionSecurity Information Event Management (SIEM)
Information Sharing-Cross Domain Solution Information Tagging - Data Tagging
Network Firewall Vulnerability Scanning Account Management Public Key EnablingNetwork Intrusion Detection System (IDS) / Intrusion Protection System (IPS) Boundary Protection Cyber Configuration Management Wireless CommunicationsDFIA Afloat Cyber Risk Assessment Software Assurance Wireless Enclave Access Control
Continuous Monitoring DFIA Airborne
Event Management-Incident Management, Contingency Planning, Disaster Recovery, and Incident Response Data Encryption - DIT , Link
Asset ManagementAuthentication and Authorization / IdAM Data Encryption - DAR
Cyber Situational Awareness Web Security Remote AccessSupply Chain Risk Management Email Security DNS Security
DFIA AshoreBIOS Protection / TPM / Embedded Firmware Virtualization Security
IA TA Glossary Key Management / Exchange Assured Cloud ComputingDFIA and Standards POR Implementation Guidance (includes Controls / Standards mapping) Patch Management Unified Capability - VoIP, Telecom
CYBERSAFE Standards
CYBERSAFE Certification Criteria
CYBERSAFE Grade A/B/C Criteria
Requirements for CYBERSAFE Grades A/B/C Systems
Inspection and Audit Criteria for CYBERSAFE
Plus…New task to develop initial CYBERSAFE Standards
SPAWAR IA Standards Plan
SPAWAR will play a lead role in developing the technical underpinnings for CYBERSAFE
10
SPAWAR Equities
▼ SPAWAR 5.0 work with PEOs to identify SPAWAR CYBERSAFE Items
▼ Baseline Configuration Pilot will assist in identifying Control Points
▼ Potential Programs with CYBERSAFE components:
CANES BFTN JALN ADNS DCGS-N GCCS-M/J NMT MUOS
CANES aligns with CYBERSAFE Grade A criteria as it provides networking, compute, and storage for mission critical applications and data
Due to its role as entryway to the ship, ADNS is a critical Control Point that enables connectivity for mission critical systems and components
NMT’s vital SATCOM capabilities provide assured C2 to Naval Commanders in support of Ballistic Missile Defense
SPAWAR will not identify CYBERSAFE Critical Items until TAB issues selection criteria
11
CYBERSAFE Way Ahead
▼ CYBERSAFE Implementation Plan approved by CNO on 21 April
▼ CYBERSAFE Office to release CYBERSAFE Instruction and 100-Day Plan
FOC
OctCYBERSAFE
FOC
AugSubmit CYBERSAFE
POA&M
AprCYBERSAFE
Instruction and 100-Day Plan
AprCNO Approval
IT/IA TAB begin work on criteria development
▼ Establish SPAWAR Tiger Team Led by SPAWAR 5.0
Cross-SYSCOM representation
Leverage TAB criteria and Baseline Pilot to identify CYBERSAFE Items
Develop POA&M for developing implementing, and maintaining CYBERSAFE Entity at SPAWAR
CYBERSAFE 2015 Timeline
Apr - FOCIT/IA TAB develop criticality
criteria. SPAWAR Tiger Team develops
implementation approach.
12
▼ Building upon the foundation provided by IA TA, CYBERSAFE is a key component of a common Navy plan for Cyber that: Promotes a holistic approach to securing critical warfighting capabilities Mandates use of common specifications and standards in acquisition and implementation Ensures compliance with common specifications and standards through certification process
▼ CYBERSAFE will increase awareness of cybersecurity requirements for many SPAWAR Programs IT/IA TAB will set criteria for identifying CYBERSAFE Critical Items SPAWAR 5.0 will work with PEOs to identify CYBERSAFE Critical Items within Programs
Summary
13