LONDON 2012: CYBER SECURITY

LONDON 2012: CYBER

SECURITY

SHARING OUR EXPERIENCES

Oliver Hoare

Former Head of Cyber Security

Government Olympic Executive

1 UNCLASSIFIED

GREAT BRITAIN

CONGRATULATES

TOKYO 2020

THEMES

Scale and scope

Strategy and governance

Assurance, testing and exercising

Response

Reflections and the future

4 UNCLASSIFIED

“THE FIRST DIGITAL GAMES”

BBC Sport broke all previous records with 55m global

browsers (35m in the UK)

London 2012 website 4.73 billion web page views (109m

unique users in Games time)

BT and Cisco provided the largest high-density Wifi

network in the World (around the Olympic Park)

Online video 106m requests across all platforms (more

than double of any previous event)

Unprecedented use of Wifi, mobile, RF, IP and digital

services

ROLE OF TECHNOLOGY

Reputation

Increased reliance

Spectator experience

High expectations

Global audience

Showcase for a nations capability

What’s new? (innovation)

THREAT AND RISK

7

Reputational risk

Scale / pressure to deliver

Errors / things going wrong

Hostile threats

Cyber crime

Cyber espionage (APT)

Cyber terrorism

Cyber activism / ‘Hacktivism’

Strategic Risk Assessment

23 Strategic Cyber Risks identified

Senior Risk Owners

STRATEGY – OVERVIEW

Integrated strategy and risk assessment

30 point Cyber-Security action plan

Governance

Ministerial / Senior

Programme / Assurance / Technical

Operational / Response (OCCT/CERT)

Assurance strategy

Critical systems

Testing and exercising

Police Activity – Operation ‘Podium’

Stakeholder engagement (Government, industry, sponsors,

broadcasters, transport and utilities, public)

GOVERNANCE

STRUCTURE

9

International Olympic

Committee

Olympic Delivery Authority

INFRASTRUCTURE ¥ DESIGN &

CONSTRUCTION ¥TRANSPORT

London Organising Committee

for Olympic and Paralympics

Games (LOCOG)

LOCOG

Greater London

Authority

(Mayor)

Olympic Board

British Olympic

Association

Government /

Olympic

Security

Directorate

GOVERNANCE AND STAKEHOLDERS

Ministers (Olympic Ministers,

Home Secretary, Prime Minister,

Mayor)

Government Olympic Executive

– Overall lead, assurance &

finance

Home Office – Security lead

Senior ICT Leaders Group

(Director & CIO level)

Information Assurance & Cyber

Security Co-ordination Group

Other key cyber stakeholders

Technology supplies/ utilities/

transport

MSP Forum (CPNI) – Managed

Service Provider Forum

TISAC – Telecommunication

Industry Security Advisory

Forum

Broadcasters (national,

international and Olympic) –

IBC/MBC

Olympic sponsors

Public / spectators / overseas

visitors

Organisations

Operations

_Centres

Critical

Supporting

systems

Venues

Command, Control and Comms (C3) architecture / testing & exercising

London 2012 Information Assurance

COMMAND, CONTROL &

COMMUNICATIONS (C3)

OLYMPIC CYBER CO-ORDINATION TEAM

13

UK Joint team brought together

establishing the first dedicated

TECHNOLOGY OPERATIONS CENTRE

14

600 Staff

24/7

Operated by LOCOG Technology Team

Jointly staffed by BT, Atos and CISCO (Omega other sponsors)

Secure comms direct to Olympic CERT

CRITICAL SYSTEMS

Surveyed approx 450 Olympic specific and supporting systems

Identified 40 critical systems

Criteria:

risk to public safety

impact on sporting event

quality and ability to broadcast

impact on spectator experience

damage to reputation of UK

Multi layered assurance (questionnaires, visits, inspections, games

readiness statements)

Non-critical systems!

TESTING AND EXERCISING

‘FLAMING TORCH’ - programme of table top exercises

‘BENDING METAL’ - specific cyber / CERT testing

Command Post Exercises – fully integrated testing

LIVE EX (exercise)

Torch relay

Technical rehearsals – test events

WHAT WE SAW

London 2.35 billion security system messages logged (Beijing reportedly 12 billion security events)

Blocked 200 million malicious connection requests, 11,000 per second in one Distributed Denial-of-Service attack.

Olympic Website – 493,000 peak concurrent users

OCCT & TOC – 50 tickets raised each Virus during construction (Conflicker) DOS & DDOS (Olympic Website,

government sites, other sites)

Theft of cable and high value components

Spoof websites/e-mail scams (tickets, accommodation and merchandise) 200 arrests under “PODIUM” (approx 100 related to online crime)

Laptop thefts

Evacuation of TOC

Flooding - evacuation of Police control centre

Two national level cyber response incidents - Opening ceremony – national level response (COBR)

LESSONS FROM LONDON 2012

What we got right

Testing & exercising C3 / Olympic CERT

Blend between government and industry

Spectrum allocation

Right technology partners (BT, Atos, Cisco etc)

Broadcasting (digital) is a critical Utilities – generally a low level threat, but potentially very high impact – manual resilience / C3

What we learned

ICT is very expensive, particularly to retrofit (get it right first time)

Build Cyber-Security from very beginning, preferably into contracts

Build relationships with commercial providers and Government early

Co-ordination across many different systems and sectors is hard but crucial (Information Assurance and Cyber

Security Coordination Group / Senior ICT Group / Olympic Cyber Coordination Team)

19

COULD WE HAVE DONE IT BETTER?

Started earlier

Built information assurance into contracts at an earlier stage

Establish senior governance and leadership in place earlier

Better/earlier engagement with Ministers on cyber issues

Appointed an independent overarching partner to assure cyber security

Heavily reliant on technology sponsors (inevitable)

If a national CERT in place, would not needed to create one

Considered cyber issues in terms of insurance (e.g. lost of broadcast, or

other major services)

Online ticketing – some issues with website (almost inevitable)

20

WHAT’S COMING DOWN THE TRACK FOR

TOKYO 2020?

Lessons from Sochi and Rio? Technology

‘the internet of things’

HD, 3D & Super High Vision broadcasting (limited use during London - outdoor broadcasts live sites)

4G/LTE and very high volume of mobile smartphone/tablets Interactive technologies

Cyber threat for Tokyo?

Global political situation in summer 2020 - expect protest and hacktivism Espionage – does it matter?

Cyber crime - it will happen! Cyber terrorism?

EXPERIENCE AND

EXPERTISE WE

CAN SHARE

22

UK CYBER SECURITY EXPERTISE

Advise – develop security policy, programme strategy, risk

management & audit methodology

Assure – Validate, verify and accredit capability (Confidentiality, Integrity & Availability)

Educate & train – build knowledge, skills and know-how

Services – run solutions on behalf of customers

Integration – holistic and integrated programme delivery (design→specification→programme→operations)

Architecture & Design – design secure, robust and resilient systems and services

Surveillance &

reconnaissance – observe behaviours and identities of users and platforms

Social Media Analysis – Capture and analyse of social network activity

Trusted platforms

Ensure integrity of hardware systems

Incident Management– Effective co-ordination and crisis management , to ensure systems recovery and data cleansing

Forensics – Extract, secure and analyse data to evidential standards

Identify & Authenticate – Capture, store and manage identity data, authentication

Security Management – integrate effective and agile security management across an organisations

Venue Security Operations

- Acquire, store, analyses and visualise very large and complex datasets

Infrastructure – creating secure storage, processing and communications capacity with resilient supporting infrastructure

UNCLASSIFIED Transactional Protection

End to end security for information transactions, across variable trust environments

GREAT BRITAIN

CAN HELP SECURE YOUR

MAJOR EVENTS AND PROGRAMMES

23 UNCLASSIFIED