Cyber Security Summit: Addressing Cyber Security Risk October 10, 2017

July 13, 2023

22 Less than a minute

62 Slides6.21 MB

Save Document

Cyber Security Summit: Addressing Cyber Security Risk October 10, 2017 National Rural Electric Cooperative Association (NRECA) & American Public Power Association (Public Power) Dr. Cynthia Hsu Cybersecurity Program Manager NRECA

CHALLENGES Ransomware/Malware Hardware Trojans Software Development Life Cycle (SDLC) International Supply Chain Us

97.25 % The percentage of phishing emails that contained ransomware in Q3 2016 (PhishMe 2016 Q3 Malware Review) https://phishme.com/ransomware-delivered-97-phishing-emails-end-q3-2016-supporting-booming-cybercrimeindustry//

HARDWARE TROJANS Modifications to circuitry by adversaries to exploit hardware or to use hardware mechanisms to gain access to data or software running on the chips A Survey of Hardware Trojan Taxonomy and Detection. 2010. M. Tehranipoor & F. Koushanfar. IEEE Design and Test of Computers

HARDWARE TROJANS Designed to disable or destroy a system at some future time, or leak confidential information and secret keys covertly to an adversary. A Survey of Hardware Trojan Taxonomy and Detection. 2010. M. Tehranipoor & F. Koushanfar. IEEE Design and Test of Computers

HARDWARE TROJANS GLOBALIZATION in the semiconductor design and fabrication process integrated circuits (ICs) are becoming increasingly vulnerable to malicious activities and alterations A Survey of Hardware Trojan Taxonomy and Detection. 2010. M. Tehranipoor & F. Koushanfar. IEEE Design and Test of Computers

A Survey of Hardware Trojan Taxonomy and Detection. 2010. M. Tehranipoor & F. Koushanfar. IEEE Design and Test of Computers

INTELLIGENCE ADVANCED RESEARCH PROJECTS ACTIVITY (IARPA) OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE “In 2007, a Syrian radar failed to warn of an incoming air strike; a backdoor built into the system’s chips was rumored to be responsible.” http://spectrum.ieee.org/semiconductors/design/stopping-hardware-trojans-in-their-tracks

http://www.dmea.osd.mil/TAPO/foundryServices.html

INSECURE SOFTWARE DEVELOPMENT 1) Poor software design 2) Reliance on open source software as a base, vulnerabilities multiply into hundreds or thousands of software products built on that base and persist over time 3) Commercial Off The Shelf (COTS) products that rely on foreign and nonvetted domestic suppliers

SOFTWARE DEVELOPMENT LIFE CYCLE (SDLC) Vendors sometimes neglect security and validation of software during rapid development. 2013 5,186 vulnerabilities 2017 9,202 reported by August 17 National Institute of Standards and Technology

SOFTWARE DEVELOPMENT LIFE CYCLE (SDLC) Vendors sometimes neglect security and validation of software during rapid development. 2013 5,186 vulnerabilities 2017 10 11,329 reported by October National Institute of Standards and Technology

95,613 Common Vulnerabilities and Exposures (CVE) https://nvd.nist.gov/general/nvd-dashboard

EQUIFAX 140 million US consumers

AQUIRE https://www.us-cert.gov/bsi/articles/best-practices/acquisition/asystemic-approach-assessing-software-supply-chain-risk

IMPROVING THE CYBER AND PHYSICAL SECURITY POSTURE OF THE ELECTRIC SECTOR

Up to 7.5 million over three years 2.5 million per year