Cyberspace Strategic Impact Social Risk Management. Cyber Security and Cyber Defence. Cyber Defense: NATO Vision

(1)

Lt Col Paulo Nunes Lisboa – GNS, 12Set13

Seminar ‘Cyber Security: An Action to Establish

the National Cyber Security Center’

GNS - Lisboa, 12 September 2013 Lisboa – GNS, 12Set13 Lt Col Paulo Nunes

Cyberspace Strategic Impact

Social Risk Management

Cyber Security and Cyber Defence

Cyber Defense: NATO Vision

National Cyber Security Strategic Concept

Conclusions

Agenda

2

Lt Col Paulo Nunes

Lisboa – GNS, 12Set13 3

Cyberspace dual nature:

(social, economic, political and

cultural interactions);

(Internet).

Physical and Logic Infrastructure …

… Internet Connected!

Cyberspace dual nature:

(social, economic, political and

cultural interactions);

(Internet).

Physical and Logic Infrastructure …

… Internet Connected!

Personal Access Networks …

Fonte: NNEC Abril 2011

The

The ““Cloud

Cloud” …

” …

Why?

(Commercial) Technology Evolution

6

Information

Superiority

Source:

(2)

Transações Transações Comerciais

Comerciais ComércioComércio Sexual Sexual Hackers Hackers Redes Redes Terroristas Terroristas Autoridades Autoridades

Lt Col Paulo Nunes

Threat Spectrum

Why are we attacked?

Affect Functioning

Affect Functioning Information Theft Information Theft Money Extortion Money Extortion

-- SpamSpam

-- DDOS DDOS AtacksAtacks -- PhishingPhishing -- Sensitive InformationSensitive Information

ex: personal data ex: personal data and and home bankhome bankinging

-- BlackmailBlackmail -- SpearphishingSpearphishing

Destruction Destruction

-- HackitivismHackitivism -- CyberCyber--SabotageSabotage

Rustock

Zeus

Rogue AV

Stuxnet

Examples: Examples:

Adapted from Symantec (2011)

Mainly for:

Information Theft Information Theft and Destruction and Destruction -- SpyingSpying -- Cyber WarfareCyber Warfare

Flame

Cyber Arms Cyber Arms

More disruptive

and destructive Attacks

Mobile Threats

SMiShing Goes Mainstream

15B, 6B

All About APPS !

Downloads de Apps do iTunes store e do Android Market, respectively Activações de Dispositivos Android TODOS os dias.

550K

EXPLOSIVE

EXPLOSIVE Grouth

Grouth !!

Source: Symantec (2011)

9

Lt Col Paulo Nunes

Warfare

Warfare –– Dynamic Evolution …

Dynamic Evolution …

Warfare was always a question of “Threats vs. Security”

Technology and Maneuver interact to speed up the pace of Conflicts

A da pte d fr om

: Cyber DefenseCyber Defense

Cyber Warfare Cyber Warfare “ClickzkriegClickzkrieg”

Military Cyber Impact: 4+1 Paradigm…

(3)

Lt Col Paulo Nunes

Cyber Threats are here to stay ...

Cyber Attacks:

China, USA, Israel, Palestina, Estónia, Georgia, Radio Free Europe, Kyrgyzstão …

Armed Forces (20-30 Countries) with Cyber Warfare Units

(Soriano, Mar11)

Events:

Estonia Cyber Attack (April/May 2007); Georgia Invasion (August 2009);

US Cyber Command (IOC: May10, FOC: Nov10)

Cyber Arms (Stuxnet – 2011; Flame – 2012; etc. )

Documents:

NATO Cyber Defence Concept (2007) NATO Strategic Concept 2010 (Lisboa, 18-19 Nov 2010) NATO Cyber Defence Policy and Action Plan (2011) National Cyber Security and Cyber Defence Strategies

Lt Col Paulo Nunes

Fonte: WEF, Global Risks Report 2013

Global

Global Risks

Risks 2013

2013 –– Cyber

Cyber Impact

Impact

Lt Col Paulo Nunes

Fonte: WEF, Global Fonte: WEF, Global RisksRisks ReportReport 20132013

Global Risks

Global Risks 2013

2013 –– Cyberspace is a Global Risk!

Cyberspace is a Global Risk!

Lt Col Paulo Nunes

Low Risk – High Benefit!

High Exposure of most Countries

(including Portugal)

…

Cyber Threats: Value Preposition

Lt Col Paulo Nunes

(4)

Lt Col Paulo Nunes

Social Risk : What can we do about it?

Lt Col Paulo Nunes

Protection and Defense of NII

Relevant Questions

GLOBAL CYBER SECURITY

PT CYBER SECURITY

CYBER DEFENSE

(Computer Network Operations - CNO)

Global (Common) Cyberspace

National Cyberspace

National Defense and Security Missions

Cyber Security vs Cyber Defense

21 Lisboa – GNS, 12Set13 Lt Col Paulo Nunes

How to Articulate Different Operational Domains?

22 F o nt e: Li no S an to s , R o gé rio B ra vo e P au lo V ie ga s N un es ( 20 12 ), P ROTECÇÃO DO C IBERESPAÇO : V isã o A na lít ica

Criminal

Prossecution

National

Defence

Simple

Protection

Individual and Organizational Crisis Crisis Management Management Intelligence Mitigation Measures Evidence Colletion Alerts Intelligence Mitigation Measures Evidence Colletion Alerts Intelligence Mitigation Measures Evidence Colletion Alerts

Cyber Security and Cyber Defense:

“One House, several Pillars”

NATIONAL CERTS NETWORK (Civil and Military)

A RM E D F O RC E S A RM E D F O RC E S

NATIONAL AND INTERNACIONAL COOPERATION (Civil and Military)

Missão

Objectivos

Policy and Policy and Strategic Orientation Strategic Orientation Crisis Crisis Management Management L A W E N F O R C E M E N T L A W E N F O R C E M E N T L A W E N F O R C E M E N T L A W E N F O R C E M E N T IN T EL L IGEN C E A GEN C IES IN T EL L IGEN C E A GEN C IES I N T EL L IGEN C E A GEN C IES IN T EL L IGEN C E A GEN C IES

(5)

Information

Information Assurance

Assurance:

:

NATO

Vision

Computer Network Operations (CNO) Computer Network Attack

(CNA)

Computer Network Defence

(CND)

Computer Network Exploitation

(CNE)

Information

Information SecuritySecurity ((INFOSECINFOSEC)) Communications Security (COMSEC) Computer Security (COMPUSEC)

CYBER DEFENSE = CNO+ (COMPUSEC)

CYBER

DEFENSE

_INFOSEC

Cyber Defence Capability Framework Document

(Ver.2 -28Feb11)

25

INFORMATION ASSURANCE

25 Lisboa – GNS, 12Set13 Lt Col Paulo Nunes

NATO Cyber Defence Policy: Cyber Attacks Response

NCIRC Technical Centre (FOC)

(NCSA/NIATC, Mons, Belgium)

CD Coordination and Support Centre CD Coordination and Support Centre NCIRC CC + CD Threat Assessment Cell NCIRC CC + CD Threat Assessment Cell

(NOS & NHQC3S

(NOS & NHQC3S –– NATO HQ)NATO HQ)

NATO Cyber Defence

Management Board

(NATO HQ, BI-SCs, NCSA, NC3A, ACOS CIS&INT)

NATO Computer Networks

(~70.000 computers in 58 Locations in 30 Countries )

Support Request

Rapid Reaction Team National

CERT CERT (Cyber Defense)

NATO Cyber Defence Concept

26 Tactical Level Operational Level Political/Strategic Level

NATIONS

Lt Col Paulo Nunes

Lisboa – GNS, 12Set13 27 NOS/NC3Staff

Coordination

Centre

All NATO HQs and Agencies

NATO CIS

Operating Authorities

NITC / NCSA NITC / NCSA

NCIRC Technical Centre

27

1

2

3

Policy Strategic direction National level liaison

CERT services IDS Management Vulnerability Management Scientific services Local INFOSEC management

Cyber Security:

NATO vs National Model

Users Users Operational Operational Management Management Planning Planning and and Coordenation

Coordenation _{Crisis Management}_{Crisis Management}

Cyber Security

National Counsel

Incidents Response

National

Cyber Security Centre

Citizens, Enterprises,

Organizations

Users

Lt Col Paulo Nunes

CNC

CNC Operational

Operational View

View:: Principles

Principles

MULTIPURPOSE MULTIPURPOSE FLEXIBLEFLEXIBLE SIMPLESIMPLE SCALABLE SCALABLE COMPATIBLE COMPATIBLE COMPLEMENTARY COMPLEMENTARY

National

Cyber Security Structure

to face all kinds of attacks (different level of threats);

to adapt and cope with threat scenarios dynamics

to provide a gradual response, proportionally applying resources to the situation requirements (be more efficient) to be interoperable with systems of allied

countries and organizations that Portugal is part of (NATO, EU and UN ...);

to ensure a more comprehensive and complete response as possible, integrating more areas and sectors concerning

the National Cybersecurity. to be easily understood, eliminate

malfunctions and promote an efficient inter-ministerial coordination.

Lt Col Paulo Nunes

Conceptual

Conceptual Model

Model :

: National vs International Framework

Political Level Strategic Level Operational Level Cyber Security National Counsel National Conselho Nacional de Segurança e Defesa (...) International EU CIIP EFMS (...) National Cyber Security Centre National Rede de CISRT Academia Indústria International EGP FIRST EU CIIP E3PR Government of Portugal Armed Forces

Lt Col Paulo Nunes

National Cyber Security and Defence

National Cyber Security and Defence –– Value Chain

Value Chain

Primary Activities

Development Development and and Management of Management of Competencies Competencies and Skills and Skills Information Information Security Security IntelligenceIntelligence Cyber Cyber

Cyberspace Cyberspace Operations Operations (CNO (CNO)) National National Synergies Synergies International International Cooperation Cooperation

Supporting Activities

Human Resources Management Human Resources Management Finantial Resourses Management Finantial Resourses Management Specific Legislation and Norms Specific Legislation and Norms

Education & Courses Education & Courses Doctrine & Training Doctrine & Training Research & Development Research & Development

Security and Defense of

National Cyberspace

(6)

Lt Col Paulo Nunes

FROM VISION TO ACTION

Lt Col Paulo Nunes

Strategic

Strategic Approach

Approach::

From

From Vision

Vision to

to Action

Action

National Interests

Aim

Objectives

Measures

Promote and Reinforce National Strategic

Potential

Principles and Strategic Goals

(Level of Ambition)

Lt Col Paulo Nunes

National

National Cyber

Cyber Security

Security Strategy

Strategy::

Aim

Aim,

, Objectives

Objectives and

and Measures

Measures

Information

Assurance

 Secure and efficient use

of Cyberspace; Protection and Defense

of National Critical Information Infrastructure

 Information Security and Cyber Defense

Secure use of Cyberspace

(Generate and Protect Value)

Analyse Information environment and anticipate attacks; • Detect and block attacks, alert and support potential victims; • Enhance R&D to promote National technological independence; • Adapt Legal framework and fight Cybercrime; • Develop international cooperation initiatives • Communicate, raise awareness and inform citizens Reinforce

Cyber Security of National Critical Infraestruturas

(Reduce Social Risk)

• Reinforce Governmental Networks ICT Security;

• Reinforce Government and Critical Infrastructures IS Security (Resilience and Survival);

Defend National Interests and Freedom of Action

in Cyberspace

(ReaffirmNational Identity

and Defend National

Sovereignty)

• “Knowledge and Information Society” initiatives; • Protect and Defend National E-Gov; • National Cyber Security and Cyber Defense Structures; • National Synergies and International Cooperation