Japan Computer Emergency Response TeamCoordination Center

電子署名者 : Japan Computer Emergency Response TeamCoordination Center
DN : c=JP, st=Tokyo, l=Chiyoda-ku,
email=office@jpcert.or.jp, o=Japan Computer Emergency
Response Team Coordination Center, cn=Japan Computer
Emergency Response Team Coordination Center
日付 : 2014.11.17 09:09:07 +09'00'

Cyber Green
Improving Cyber Healththrough
Measurement and Mitigation
Yurie ItoDirector
JPCERT Coordination Center

CYBER GREEN

Question: Would you build your national critical systems and cybersecurity measures on;

A: global internet ecosystems
being Infected, vulnerable, andwith high ratio of malicious
traffic2

Copyright©2014JPCERT/CC All rights reserved.

B: global internet ecosystems
being cleaned, patched, andwith less malicious traffic

Background / Motivation

Increasing dominance of cyber in communications,business, utilities
Cyber risks continue to increase
Fundamental to success will be the ability tomeasure risks to motivate action and to getactionable information to those who can act—This will require increased efficiency of data sharing

Transparency into the sources and presence ofcyber risk necessary to improve the ecosystem

3

Copyright©2014JPCERT/CC All rights reserved.

Applying Public Healthcare model to Cyber space

Presence ofMalware /Botnets
Infectionrisks
Threat vector;
Amount of swamp
water / mosquitos
counts4

Number ofIncidents

Incidents;
Patients disease
countse.g. Malaria Patients
countsCopyright©2014JPCERT/CC All rights reserved.

OS Update, server
misconfigurations,Education…
Conditions;
Number of Obesity,smokers, faminelevel

Applying Root-Cause Analysis to Internet HealthSymptom

Cause

Root Cause

Malaria

Mosquito(transmission vector)

Swamps (mosquito breedinggrounds)

DDoS

AmplifiersMisconfigured servers
Lack of access control lists at
the application layer
Source IP spoofing is possible

Bots

Lack of patches hosts
Misconfigured servers
No AV on endpoints

5Copyright©2014JPCERT/CC All rights reserved.

Introduction: The Cyber Green & Its Mission• What is the Cyber Green?
• Cyber Green core focus is on tapping the collaborative
potential of stakeholders in cyberspace through promoting
the concept of “cyber health.”• How will Cyber Green Accomplish its Mission• Cyber Green will establishing a reliable platform forgenerating cross-comparable statistics and information
sharing mechanisms to enabling operational cyber
remediation efforts, and providing insight into systemic risk
conditions in the cyber ecosystem.

6Copyright©2014JPCERT/CC All rights reserved.

Defining Cyber Health• “Cyber Health” is defined as, “a condition of cyber systems andnetworks that are not only free from infection from malware
and botnets but also contributes more broadly to the overall
trust and usability of the cyberspace for the well-being of all.”• This definition helps to clarify what a healthy cyber ecosystem is,and will provide future Cyber Green stakeholders a consistentdefinition that will enable effective participation.
Yurie Ito, “Managing Global Cyber Health and Security through Risk Reduction.” July 18,2011.

7

Copyright©2014JPCERT/CC All rights reserved.

Key Internet Health Risk Indicators
Percent infected population—Bots membership via sinkholes—Bin by specific botnet… etc

Percent vulnerability—Specific vulnerabilities client side / Server side
—Detected misconfigurations …. etc

Percent malicious traffic—Spam, DDoS, attack, ….etc—Realized events, wasted capacity

Goal is to drive these values to 08

Copyright©2014JPCERT/CC All rights reserved.

Data Sources
Third party risk condition data
Reliable, global data sources
Look for high confidence data
Accept redistribution restrictions
Free of any fees
Import regularly (daily, etc) measurement into the system

9Copyright©2014JPCERT/CC All rights reserved.

Cross-Comparable Statistics
Cyber Green will make available high-confidence,comparable, and actionable information to stakeholders.

10Copyright©2014JPCERT/CC All rights reserved.

cross-Counting Strategy
By unique IP seen in a 24 hour window—Commonly done—Admit problem can’t be solved (yet)Look for trend lines
Normalize using regular means

11

Copyright©2014JPCERT/CC All rights reserved.

Data Normalization

Permits comparison across time
Permits comparison across space
By IP address (IPv4, IPv6) – ARIN, etc
By population – global sources
By Internet-connected population – OECD
By Internet subscriptions – ITU
By website count – internal data
By Internet connected device – unknown

12

Copyright©2014JPCERT/CC All rights reserved.

Correlations to Look For
By ICT budget – in progress from OECDBy pirated software rates – from BSA
By CERT bulletins released – internal data

13

Copyright©2014JPCERT/CC All rights reserved.

Planned activities and Goals for 201414

Copyright©2014JPCERT/CC All rights reserved.

Key stakeholders
The CERT community of organizations
Organizations, both commercial and non-profit, that aresources of data relate to cyber risk
Research organizations and individuals specificallyfocusing on measurement of cyber health and risk factors
Advisors knowledgeable in organizational models, data
gathering, analysis and measurement related to publichealth15

Copyright©2014JPCERT/CC All rights reserved.

Expected impact
Cyber Health and Environmental NormGlobal approach and coordination
Long term impact to improving the cyber space resiliency
and health
Capacity building
Metrics - Common language to policy

16

Copyright©2014JPCERT/CC All rights reserved.

Join the Cyber Green Initiative!
- Global internet healthiness initiative
Cyber Green Training / Capacity Building
Access;—Tools—Access to the Cyber Green platform—Get risk condition data
—Remediation best practices to risk factors—Statistics report

17

Copyright©2014JPCERT/CC All rights reserved.

Towards the Safe, Clean and Reliable
Internet Ecosystem
Yurie Itoglobal-cc@jpcert.or.jp

18Copyright©2014JPCERT/CC All rights reserved.