nsa’s secure mobility program - rsa conference...

13

Insert presenter logo here on slide master. See hidden slide 4 for directions Session ID: Session Classification: Margaret Salter NATIONAL SECURITY AGENCY INFORMATION ASSURANCE DIRECTORATE NSA’s Secure Mobility Program PNG 202 Intermediate

Upload: dinhnhi

Post on 01-Apr-2018

219 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

Insert presenter logo here on slide master. See hidden

slide 4 for directions

Session ID:Session Classification:

Margaret SalterNATIONAL SECURITY AGENCY

INFORMATION ASSURANCE DIRECTORATE

NSA’s Secure Mobility Program

PNG 202Intermediate

Page 2: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

2

Secure Anywhere, Anytime Accessto Enterprise Infrastructure

Page 3: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

3

Current Mobility Environment

Mobile Landscape

• Just do an Internet search• Numerous commercially available applications

• Low cost and in some cases "free"

• Minimal user technical experience required

User ThreatUsers are vulnerable to:• Social engineering• Ignorance of threats• Bypassing inconvenient security

• Insider threat

“The average computer user is

going to pick dancing pigs over security any day.”

Uncontrolled Infrastructure Threat• Towers • Communication centers• Communication lines• Main data centers• Carrier updates• Rogue base stations

Alberta school employee charged with luring, exploitation by cellphone

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

InfrastructureThreat

MobileLandscape User Threat• Ease of use is valued

over security• Vulnerabilities are widespread• Attacks are cheap and easy

Page 4: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

4

Establishing a Balance

UserExperienceSecurity

• Security must be integrated into components.

• User interfaces must be intuitive and familiar.

• Solutions should support commercial functionality.

• Solutions should be cost effective.

• Solutions should align with commercial product lifecycles and standards.

Page 5: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

5

• Virtualization• Protected Storage• Thin Clients

• Memory Use• Isolation• Caching

2011

2012

2012

EEE Components

Page 6: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

6

Fishbowl Architecture

• Two Layers of Encryption (VoIP and VPN)

•Gateway connection to Enterprise Infrastructure

•Backend services secured in a SCIF

• Delivers Secure Voice Capability

• Dependant on carrier QoS

•Hardened Handsets

Back EndCore Services

Remote Maintenance/Support

Page 7: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

7

Uncontrolled Carrier Infrastructure

Traffic Engineering(Via APN/MVNO)

APNGatewayPreferred Devices

•Supports Enterprise Management•Supports Separation•Secure Application Delivery•Supports Thin Client Architecture •Incorporates Certificate Stores•Standards based design

Preferred Carrier Transport•Provides Quality of Service•Limits traffic exposure through engineering•Supports global coverage•Controls access to end user device and cellular metadata

Preferred Unified Communications Infrastructure •Provides Unified Communications Services•Supports Thin Client / Cloud computing Architecture •Standards based design

EnterpriseInfrastructure

Long-term Preferences

Outer Tunnel

Suite B IPsec with IKEv2 RFC 4869

Inner Tunnel

(VoIP) TLS-SRTP ?

(Data) TLS

Page 8: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

8

Why is this so hard (OS…OEM)?

IKEv2AES 128 CBCAES 256 CBCECDSA (P-256, P-384)ECDH (P-256, P-384)SHA2 (256 and 384)

IPsecAES 256 GCMAES 128 GCM

8

Page 9: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

9

Why is this so hard (Voice App)?

SDESTLS Version?Client AuthSuite BInteroperability

DTLSVersion?Suite BSBCsUC servers

9

Page 10: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

10

Why is this so hard?

SIP TrunkingTLSInteroperability

3G QoS

10

Page 11: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

11

Requirements

OSAppsInfrastructure

www.iad.gov

11

Page 12: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

12

Apply

Securing mobility requires a new way of thinking:Commercial standards, platforms, and applications must be leveraged.Solutions and services must be composable to achieve desired security.Commercial infrastructure may be integrated and hardened through the use of an MVNO.Strong partnerships between government and industry must be established to achieve preferred capabilities.Solutions must evolve to keep pace with emerging technologies.

Page 13: NSA’s Secure Mobility Program - RSA Conference xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Infrastructure Threat Mobile Landscape • Ease of use is valued User Threat

13

Questions?

Stereotype Threat: Undermining the Persistence of Racial ... 2009... · Stereotype Threat 1 Running head: STEREOTYPE THREAT . Stereotype Threat: Undermining the Persistence of Racial

proposed-international-airport-poses-threat- threat to the

INFORMATION SYSTEMS NSA’S PERSPECTIVES ON XBRL, PREPARING FOR XBRL, LESSONS LEARNT Víctor Morilla Project Manager CROSS-SECTOR XBRL SEMINAR Madrid, May

Introduction to Cybersecurity Digital Signatures · Digital Signatures •Basic Definitions ... - NSA’s Prism Program ... - High Traffic-Analysis Resistance

Commercial Solutions for Classified CSfC Threat Prevention · integrator has access to all elements of the solution. The NSA’s list of TIs can be found on the NSA CSfC Website

Under the Radar: NSA’s Efforts to Secure Private ...jnslp.com/wp-content/uploads/2015/03/NSA’s-Efforts-to-Secure... · * Professor of Cybersecurity Policy, Worcester Polytechnic

Privacy, Transparency, and Accountability in the NSA’s

Cybercore Threat Analysis I - Fact Sheets Threat... · 2020. 12. 3. · THREAT ANALYSIS Similarly, control systems threat analysts must maintain a strategic perspective of the threat

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ...plantas-medicinais.weebly.com/uploads/7/6/9/6/... · Página 2 - 22 HOMENAGEM É um bom trabalho, pelo que lhe envio os

NAREIT: REITWeek 2016content.stockpr.com/.../pdf/2016+06_REITWeek_Final.pdf · NSA’s unique strategy has successfully attracted seven of the most prominent operators with the common

Dissecting the NSA’s Six-Phase Playbook for Hacking NetworksDissecting the NSA’s Six-Phase Playbook for Hacking Networks 2 Phase One Initial Reconnaissance “Our key to success

Identity of the Threat and Methodology; Insider Threat

6 FROM THREAT TO THREAT FROM THREAT TO THREAT 174 In chapters 3 and 4we described how the U.S.government adjusted its existing agencies and capacities to address the emerging threat

2016 THREAT ENVIRONMENT - NIST · Questions? • [email protected] ... 2016 Threat Environment: ... FireEye Keywords: 2016 Threat Environment:

NSA’s Classified Materiel Conversion (CMC) Branch

VOLTTRON™ Threat Profilesoftware system and recommends mitigation controls. Services include threat models, threat findings, and threat profiles. Secure Software Development –

group-ib.com Threat Detection System Group−IB THREAT ... · group-ib.com How Threat Intelligence Works • Your security systems continuously detect threats. • Threat Intelligence

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

EU Threat Landscape Threat Analysis in Research ... - Europa

The NSA’s New SIGINT Annex

Opt out of PRISM, the NSA’s global data surveillance program - PRISM Break

Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

コンピュータシステム基礎9Ú9Ý9Ú9Ý n xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 9Ý9Ú9Ý9Ú9Þ o é-+ û xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Idol Threat: Not an Idle Threat

Threat monitor Threat Intelligence Report Q1 2020

Access to innovation: NSA’s Technology Transf er … to innovation: NSA’s Technology Transf er Program. GUES Editor’s column Marian J. Roche T The National Security Agency’s

Certified Threat Intelligence Analyst - EC-Council · Certified Threat Intelligence Analyst 1 Certified IA Threat Intelligence Analyst C T CERTIFIED THREAT ... It describes building

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

CORONAVIRUS: OPINION AND REACTION...Germany Japan Russia Very high threat High threat Moderate threat Low threat Very low threat Don't know (Your country) What level of threat do you

Counter Threat Unit™ Threat Intelligence

定価（本体2,600円税）発行電子開発学園出版局 …9Ú9Ý9Ú9Ý n xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 9Ý9Ú9Ý9Ú9Þ o é-+ û xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Under the Radar: NSA’s Efforts to Secure Private-Sector ...goodtimesweb.org/surveillance/2014/NSA-Efforts-to-Secure-Private... · 1 Under the Radar: NSA’s Efforts to Secure Private-Sector

Infoblox Deployment Guide - Threat Insight...Troubleshooting & FAQ Threat Insight..... 55 Unable to download Threat Analytics Module and Whitelist Set.....55 Threat Analytics service