ISOG-­‐J	  Seminar	  Tokyo	  13	  Oct	  2010	  V1.1	  Cybersecurity	  informa1on	  security	  exchange	  framework	  (CYBEX):	  importance	  and	  current	  developments	  Tony	  Rutkowski,	  tony@yaanatech.com	  Rapporteur	  for	  Cybersecurity	  Group,	  ITU-­‐T	  Q4/17	  Addi1onal	  roles	  include:	  global	  eWarrant	  Rapporteur,	  ETSI	  TCLI;	  U.S.	  NSTAC	  Cybersecurity	  Expert;	  Dis1nguished	  Senior	  Research	  Fellow,	  Georgia	  Ins1tute	  of	  Technology	  	  	  Outline	  • Why	  the	  CYBEX	  ini1a1ve	  is	  important	  • Major	  developments	  shaping	  the	  work	  • Speciﬁc	  capabili1es	  – Systems	  Assurance	  and	  Incident	  Response	  – Cybersecurity	  Informa1on	  Exchange	  Framework	  – Iden1ty	  Management	  • Major	  implementa1on	  challenges	  – Extent	  and	  evolu1on	  of	  the	  standards	  – Discovery	  and	  trust	  capabili1es	  – Achieving	  implementa1ons	  and	  widespread	  use	  CYBEX:	  origins	  • A	  common	  realiza1on	  that	  – Talking	  about	  cybersecurity	  accomplished	  nothing	  – The	  incidents	  were	  scaling	  exponen1ally	  – Trusted	  exchange	  of	  cybersecurity	  informa1on	  was	  essen1al	  to	  any/all	  capabili1es	  – Many	  diﬀerent	  communi1es	  were	  developing	  cybersecurity	  informa1on	  exchange	  schema	  – No	  global	  framework	  and	  consensus	  existed	  to	  bring	  together	  communi1es	  and	  schema	  • Ins1tu1onal	  triggers	  – ITU-­‐T	  began	  a	  new	  4	  year	  cycle	  with	  a	  mandate	  to	  do	  something	  about	  cybersecurity	  – Par1cipants	  found	  there	  were	  common	  global	  interests	  in	  tackling	  cybersecurity	  informa1on	  exchange	  challenges	  • LAC,	  NICT,	  and	  other	  Japanese	  experts	  and	  organiza1ons	  • Government	  and	  industry	  en11es	  in	  APEC	  region,	  U.S.,	  and	  Europe	  Agreement	  on	  a	  cybersecurity	  model:	  informa1on	  sharing	  dependencies	  Contractual	  service	  agreements	  and	  federa3ons	  Intergovernmental	  agreements	  and	  coopera3on	  Legal	  Remedies	  Tort	  &	  indemniﬁca3on	  Regulatory/	  administra3ve	  law	  Criminal	  law	  Provide	  basis	  for	  legal	  remedies	  Inves3ga3on	  &	  measure	  ini3a3on	  Provide	  basis	  for	  ac3ons	  Forensics	  &	  heuris3cs	  analysis	  Reputa3on	  sanc3ons	  Patch	  development	  Resilient	  infrastructure	  Real-­‐3me	  data	  availability	  Measures	  for	  threat	  detec3on	  Measures	  for	  thwar3ng	  and	  other	  remedies	  Informa3on	  exchanges	  Measures	  for	  protec3on	  Legal	  remedies	  may	  also	  ins3tute	  protec3ve	  measures	  Data	  reten3on	  and	  audi3ng	  Provide	  data	  for	  analysis	  Blacklists	  &	  whitelists	  Encryp3on/	  VPNs	  esp.	  for	  signalling	  Iden3ty	  Management	  Rou3ng	  &	  resource	  constraints	  Deny	  resources	  Vulnerability	  no3ces	  Provide	  awareness	  of	  vulnerabili3es	  and	  remedies	  Network/	  applica3on	  state	  &	  integrity	  Pladorm	  coherency	  appeared	  possible	  Providing	  outreach	  among	  standards	  bodies	  seemed	  possible	  ISO	  CAB	  forum	  FIRST	  ITU-­‐T	  MITRE	  CCDB	  CNIS	  NIST	  ETSI	  3GPP	  TCG	  IEEE	  IETF	  ITU-­‐R	  APWG	  OASIS	  WiFi	  Forum	  APP	  Dev	  Forums	  OMA	  IMS	  forum	  Cable	  Labs	  Major	  related	  ins1tu1onal	  developments	  • U.N.	  15	  July	  document	  among	  15	  major	  powers	  on	  reducing	  “ICT	  conﬂict”	  (a/k/a	  cyberwar)	  • Exercise	  of	  cybersecurity	  authority	  by	  regulatory	  bodies	  – e.g.,	  Korea,	  FCC	  in	  U.S.	  

• High	  Level	  Cybersecurity	  Strategies	  (USTIC,	  Japan,	  UK,	  China,	  Korea)	  • Cybersecurity	  as	  an	  issue	  at	  ongoing	  ITU	  Plenipoten1ary	  Conference	  • Enhanced	  Common	  Criteria	  Development	  Board	  (CCDB)/NATO	  ac1vity	  • New	  real-­‐1me,	  data	  reten1on,	  and	  mobile	  forensics	  mandates	  oﬀshore	  • Judicial	  eDiscovery	  mandates	  (e.g.,	  FRCP	  Rule	  26)	  in	  US	  and	  oﬀshore	  Major	  related	  infrastructure	  developments	  • Applica1on	  based	  infrastructure	  – Mobile	  pladorms	  driving	  a	  world	  of	  a	  million	  applica1ons	  – Poses	  major	  challenges	  (what	  is	  a	  good	  applica1on	  versus	  malware)	  • Locator/ID	  Separa1on	  Protocol	  (LISP)	  – Re-­‐architects	  IP	  based	  public	  infrastructures	  – Should	  solve	  signiﬁcant	  ICT	  security	  related	  challenges,	  especially	  alribu1on	  • Asia-­‐Paciﬁc-­‐centricity	  – Region	  has	  world’s	  largest	  and	  fastest	  growing	  infrastructure	  and	  strong	  economies	  – Pursuing	  technology	  implementa1ons,	  network	  innova1ons,	  venue	  leadership	  • Mobile/nomadic-­‐centricity	  – Stressing	  mobile	  standards/collabora1ve	  forums	  	  – Include	  mul1ple	  IdM/cyber	  security	  challenges	  CYBEX	  is	  a	  substan1ve	  ongoing	  global	  Cyber/ICT	  security	  ini1a1ve	  •Aimed	  at	  achieving	  meaningful	  security	  – "lock	  down"	  the	  integrity	  of	  ICT	  systems,	  – watch	  for	  undesired	  incidents,	  and	  	  – capture,	  analyze,	  and	  process	  the	  forensics	  from	  those	  incidents	  to	  reduce	  vulnerabili1es,	  thwart	  alacks,	  and	  ins1tute	  legal	  ac1on	  if	  appropriate	  ••••The	  trusted	  exchange	  of	  informa1on	  is	  essen1al	  to	  accomplish	  these	  three	  tasks.	  	  	  The	  Cybersecurity	  Informa1on	  Exchange	  Framework	  (CYBEX)	  ini1a1ve	  aimed	  at	  iden1fying	  the	  emerging	  set	  of	  speciﬁca1ons	  for	  the	  global	  pladorms	  for	  achieving	  these	  trusted	  exchanges	  Most	  of	  the	  work	  has	  been	  accomplished	  within	  exis1ng	  systems	  assurance,	  incident	  response,	  and	  intelligence/surveillance	  communi1es	  Pro-­‐ac1ve	  outreach	  is	  part	  of	  the	  ini1a1ve	  – Constant	  alempt	  to	  survey	  what	  is	  occurring	  in	  all	  other	  forums	  and	  bringing	  important	  capabili1es	  into	  the	  framework	  – Constant	  analysis	  of	  what	  is	  missing	  or	  needed	  •Unique	  –	  no	  comparable	  ac1vity	  exists	  CYBEX	  Exchange	  Model	  Cybersecurity	  En11es	  Cybersecurity	  Informa1on	  acquisi1on	  (out	  of	  scope*)	   structuring	  cybersecurity	  informa3on	  for	  exchange	  purposes	   iden3fying	  and	  discovering	  cybersecurity	  informa3on	  and	  en33es	   reques3ng	  and	  responding	  with	  cybersecurity	  informa3on	   exchanging	  of	  cybersecurity	  informa3on	  over	  networks	   assuring	  cybersecurity	  informa3on	  exchanges	  Cybersecurity	  En11es	  Cybersecurity	  Informa1on	  use	  (out	  of	  scope*)	  *	  Some	  specialized	  cybersecurity	  exchange	  implementa1ons	  may	  require	  applica1on	  speciﬁc	  frameworks	  specifying	  acquisi1on	  and	  use	  capabili1es	  CYBEX	  Ontology	  Incident	  Handling	  Domain

Knowledge	  Accumula3on	  Domain

Warning	  Database

Vulnerability	  KB	

CoordinatorIncident	  Database
Response	  Team

Cyber	  Risk	  KBThreat	  KBAlack	  KB	 Mis-­‐use	  KB	

Researcher

Event	 Incident	 Alack	

Countermeasure	  KBIT	  Asset	  Management	  Domain

Assessment	  Rule	
Detec1on	  /	  Protec1on	  Rule	

Administrator

Asset	  Database
Internal	  Asset	  DB	External	  Asset	  DB	

Network	  Operator

Registrar

Product	  KBVersion	  KB	Conﬁgura1on	  KB	

Vendor

Informa1on	  Exchange	  Structuring	  Vulnerability/State Exchange Cluster
Knowledge	  Base	  Platforms

Weaknesses

Event/Incident/Heuristics
Exchange Cluster

Vulnerabilities
andExposures

EventExpressions

MalwarePatterns

State	  SecurityState
MeasurementConfiguration
Checklists

Incident
andAttackPatterns

Assessment
Results

Evidence Exchange Cluster

Terms andconditions

Handover ofreal time
forensics

Handover ofretaineddata
forensics

Electronic
Evidence
Discovery

Extensionsfor:
DPI
Traceback
Smartgrid
Phishing

XCCDF

OVAL

eXensible
Configuration
Checklist
Description
FormatCPE

CommonPlatform
Enumeration

CVSS

Open
Vulnerability
andAssessment
Language

CCE

CommonConfiguration
Enumeration

CWSS

CommonVulnerability
Scoring
System

ARF

Assessment
Result Format

CommonWeakness
Scoring
SystemCVE

CWE

CommonVulnerabilities
andExposures

CommonWeakness
Enumeration

IODEF

CAPECIncident
ObjectDescription
Exchange
FormatInforma1on	  Exchange	  Schema	  Common
Attack Pattern
Enumeration
andClassification

Application
Specific
Extensions

CEE

CommonEventExpression

XCCDF

OVAL

eXensible
Configuration
Checklist
Description
FormatCPE

CommonPlatform
Enumeration

CVSS

Open
Vulnerability
andAssessment
Language

ARF

CCE

CommonConfiguration
Enumeration

Assessment
Result Format

CommonWeakness
Scoring
SystemCVE

CWE

CommonVulnerabilities
andExposures

CommonWeakness
Enumeration

IODEF

CAPEC

Incident
ObjectDescription
Exchange
FormatInforma1on	  Exchange	  Schema	  -­‐	  Malware	  CWSS

CommonVulnerability
Scoring
SystemCommonAttack Pattern
Enumeration
andClassification

MAEC

MalwareAttribution
Enumeration
andCharacterization

Application
Specific
Extensions

CEE

CommonEventExpression

XCCDF

OVAL

eXensible
Configuration
Checklist
Description
FormatCVSS

Open
Vulnerability
andAssessment
Language

CWSS

CommonVulnerability
Scoring
SystemCommonWeakness
Scoring
SystemSCAP

Security
Automation
Tools

CPE

CommonPlatform
Enumeration

CCE

CommonConfiguration
Enumeration

ARF

Assessment
Result Format

CVE

CommonWeakness
Enumeration

IODEF

CAPEC

Incident
ObjectDescription
Exchange
FormatInforma1on	  Exchange	  Schema	  –	  	  SCAP	  Applica1on	  CWECommonVulnerabilities
andExposuresCommon
Attack Pattern
Enumeration
andClassification

Application
SpecificExtensions

CEE

CommonEventExpression

Informa1on	  Exchange	  Trust	  capabili1es	  Discovery of parties, standards,schema, enumerations, instances andother objects

CommonNamespace

Identity Assurance Cluster

TrustedPlatforms

Authentication
Assurance
Methods

Authentication
Assurance
LevelsDiscovery
enablingmechanisms

Requestanddistribution
mechanisms

Exchange Cluster

TrustedNetwork
Connect

Interaction
Security

Transport
SecurityCYBEX	  Implementa1on	  Weaknesses,
Vulnerabilities &State
Information

Exchange
Policies

Exchange
Policies

Exchange
Requests

ExchangeRequests+	  Events,Incidents, &Heuristics
Information

Incident
Detection
SchemaSecurity
Automation
SchemaTrustedNetwork
Connect

TrustedPlatform
Modules

Tools

Tools

Software,systems,services,
networks+	  Evidence
Information

So	  where	  do	  we	  go	  from	  here:	  the	  challenges	  • An	  en1re	  ITU-­‐T	  Recom-­‐	  menda1on	  X-­‐series	  has	  	  been	  allocated	  • Recs.	  X.cybex,	  X.cve,	  X.cvss	  should	  be	  approved	  in	  December	  • Future	  of	  IODEF	  remains	  a	  ques1on	  mark	  • Many	  addi1onal	  CYBEX	  pieces	  are	  in	  various	  stages	  of	  prepara1on	  for	  adop1on	  during	  2011-­‐2013	  and	  subsequent	  maintenance	  • A	  global	  structured	  website	  of	  cybersecurity	  organiza1ons	  has	  been	  created	  on	  ITU-­‐T	  website	  • Substan1al	  challenges	  remain…	  	  Challenge:	  Extent	  and	  evolu1on	  of	  CYBEX	  Recommenda1on	  • Is	  the	  framework	  currently	  complete?	  
• What	  standards	  should	  be	  included	  in	  the	  framework?	  What	  are	  the	  criteria	  for	  inclusion?	  
• Which	  standards	  get	  published	  as	  ITU-­‐T	  Recommenda1ons	  and	  which	  do	  not?	  
• How	  do	  ITU-­‐T	  published	  versions	  maintain	  “sync”	  with	  authorita1ve	  community	  versions?	  
• How	  do	  regional	  and	  na1onal	  variants/schemas	  become	  included?	  
• How	  should	  Security	  Content	  Automa1on	  Protocol	  (SCAP)	  schema	  be	  treated?	  
– Presently	  included	  in	  an	  appendix	  as	  examples	  • How	  does	  CYBEX	  deal	  with	  “sou”	  standards,	  e.g.,	  other	  ITU-­‐T,	  	  ITU-­‐D,	  ISO	  SC27	  	  – Presently	  referenced	  in	  an	  appendix	  Challenge:	  Discovery	  and	  trust	  capabili1es	  • Cybersecurity	  object	  discovery,	  trust,	  and	  related	  exchange	  policy	  mechanisms	  are	  compartmentalized,	  incoherent,	  and	  frequently	  primi1ve	  • 	  Iden1ty	  Management	  for	  cybersecurity	  has	  complex	  assurance	  rela1onships	  Ongoing	  relevant	  cybersecurity	  IdM	  developments	  •eDiscovery	  ––

•Resolvers	  ––

•Joint	  ITU-­‐T	  and	  ISO	  X.eaa	  speciﬁca1on	  currently	  being	  discussed	  ENISA	  trust	  interoperability	  protocol	  may	  be	  underway	  in	  OASIS	  Cloud/Smartgrid	  Iden1ty	  –•New	  joint	  ISO	  ITU-­‐T	  speciﬁca1on	  ITU-­‐T	  X.673	  |	  ISO/IEC	  29168-­‐2	  provides	  for	  DNS	  based	  ability	  to	  resolve	  OIDs	  to	  informa1on	  addresses	  Handles	  system	  proceeding	  in	  ITU-­‐T	  Trust	  interoperability	  ––

•Trusted	  discovery	  of	  iden1ﬁer	  meta	  informa1on	  is	  essen1al	  in	  distributed	  systems	  Bob	  Kahn	  has	  been	  leading	  eﬀort	  in	  ITU-­‐T	  to	  develop	  a	  X.discovery	  speciﬁca1on	  Mul1ple	  global	  ini1a1ves	  underway	  to	  develop	  speciﬁca1ons	  for	  cloud	  and	  Smartgrid	  Iden1ty	  (ITU-­‐T,	  OASIS,	  3GPP,	  CEN,	  ISO,	  NIST,	  etc)	  Pladorm	  trust	  –Trusted	  Pladorm	  Module	  and	  Trusted	  Network	  Connect	  now	  included	  in	  CYBEX	  standard	  –Distribu1on	  channel	  trust	  •
••
•

•
•
•

Should	  Virtual	  TPMs	  be	  included?	  

OID	  based	  NID	  standards	  emerging	  as	  a	  major	  object	  ID	  pladorm	  for	  distribu1on	  chain	  trust	  Handles	  based	  DOIs	  a	  second	  order	  choice	  What	  others	  exist?	  

No	  apparent	  consensus	  on	  use	  of	  cyber	  security	  object	  iden1ﬁers	  NICT	  contribu1ons	  have	  been	  seminal	  in	  exploring	  naming	  and	  discovery	  op1ons	  CNIS	  (Cyber-­‐security	  Naming	  and	  Informa1on	  Structures	  Group)	  is	  emerging	  as	  a	  signiﬁcant	  new	  forum	  for	  trea1ng	  CYBEX	  informa1on	  iden1ﬁers	  Challenge:	  Achieving	  implementa1on	  and	  widespread	  use	  • Much	  public	  and	  industry	  dialogue	  is	  primi1ve,	  frac1ous,	  and	  poli1cally	  conten1ous	  at	  best	  –	  especially	  in	  the	  West	  – See,	  e.g.,	  FCC	  Cybersecurity	  Roadmap	  proceeding	  in	  Docket	  10-­‐146	  • Meaningful	  pladorms	  (e.g.,	  CYBEX),	  like	  the	  systems	  involved,	  are	  complex	  • Best	  ini1al	  implementa1on	  avenues	  are	  within	  coherent	  bounded	  communi1es	  – ISOG-­‐J	  – Na1onal	  government	  networks	  – Common	  Criteria	  Control	  Board	  – NATO	  • SCAP	  implementa1ons	  should	  proliferate	  – How	  to	  enumerate	  and	  discover?	  

• Analy1cal	  “bridging”	  pladorms	  are	  emerging	  – Deep	  Packet	  Inspec1on	  – Applica1on/pladorm	  behavior	  signature	  enumera1ons	  • Ul1mately	  carefully	  designed	  mandates	  by	  na1onal	  regulatory	  authori1es	  seem	  likely	  to	  emerge	  Exemplar:	  	  6th	  IT	  Security	  Automa1on	  Conference,	  Bal1more,	  27-­‐29	  Sep	  2010*	  Emerging	  NIST	  view	  of	  CYBEX	  as	  SCAP	  A	  familiar	  ensemble	  A	  signiﬁcant	  dependency	  Credit:	  Overview	  by	  Paul	  Cichonski,	  BAH-­‐NIST	  *See:	  hlp://scap.nist.gov/events/2010/itsac/presenta1ons/index.html	  Exemplar:	  	  Japan	  Vulnerability	  Notes