An Industry Perspectiv

Cybersecurity

Steven B. Lipner

Senior Director of Security Engineering Strat

Trustworthy Computing

Microsoft Corporation

Redmond, WA

slipner@microsoft.com
Historical Perspective on Cyb

• We’ll build a system, prove it’s secure and we

(1975)

• We’ll have the government evaluate our prod

• We’ll build a secure firewall, run antivirus, loc

systems, and our systems will be protected (1

• We’ll issue patches and protect our users (19

• We’ll integrate security into our developmen

• We’ll integrate security into our developmen

patches, build a secure firewall, run antivirus

systems, have the government evaluate our p

devise new tools and techniques (2009)...

...and we’ll never be “finished”
Today’s Landscap

• (Many) vendors put significant effort int

products that can resist attack

• In the Internet environment there is a si

amount of well‐engineered malicious so

• The underlying problem is that software 

– and the attacker must search for a vul

the defender must find every vulnerabil

• Vulnerability refers to design and coding 

– Buffer overruns in C/C++ programs

– SQL injection errors in web applications

– And many others
SQL Injection
Realities of Cybersec

• Security, unlike other aspects of science 

engineering, is about attack and defense 

and defenders)

– We identify specific problems (vulnerabili

remove them

– Attacker’s job is to identify and exploit a n

that we didn’t think of – or didn’t remove

• Security is “in the weeds”

– Principles and models can help

– If the details aren’t correct, the defender 

• Invention of new classes of attack is fair
Approaches to Building Mo

Systems

• Secure by design – enumerate the points whe

might attack and ensure that there are count

– Exposed network communication ‐> encrypted pro

– Software that takes external input ‐> robust input 

code analysis and testing tools

• Secure by default

– Least privilege – run components so the effects of 

or bounded

– Frustrate attacks – non‐executable memory, addre

randomization

• Secure in deployment

– Ship systems in “locked down” configurations
NIST and Cybersecu

• NIST efforts in cybersecurity date to at least 1• NIST focus on security for unclassified/civil go

always collaborative with industry

– DES– Risk Management guidance

• Computer Security Act formalized NIST role – 

the government’s approach to cybersecurity

• Sometimes contentious relationship with nat

security/classified world

• Always valued by vendors and private sector

• Frequent owner of tasks from OMB and Cong
The Security Research Co

• Players on the cybersecurity “resear

– Academics and theoreticians

– Developers of secure products, securit

tools

– End user organizations (government an

– Vulnerability finders

• NIST widely respected by the comm

– Theoretical research programs

– Security development processes, conc

– Guidance programs– National Vulnerability Database
NIST Contribution

• Too numerous to list...• Unclassified/commercial encryption 

– From DES to FIPS‐140 to AES to SHA‐3

• Security management guidance

– FISMA standards and guidelines (but se

• National Vulnerability Database• Identity standards for strong user id

and authentication (PIV card/FIPS‐20

• Configuration standards (FDCC)
Perspectives on NIST a

Cybersecurity

• Computer security efforts at NIST are he

experience (1972‐2009)

– Best management

– No longer (badly) underfunded

– Collaborating across government

– Bringing real‐world perspective to problem

– Integrating outside expertise

• Cybersecurity extends across IT Lab

– Secure networking– Secure development

• Still more to do – important to maintain 

resourcing
Recommendation

• Integrate attacker perspective

– Initial FISMA guidance lost sight of this principle

– Updated version better

• Tackle important hard problems

– Measuring security

• Project is under way –may be impossible, but worth 

– Cloud security

– Electronic medical records

– Smart grid

– Operational security management – build on succ

– Trusted User Experience

– Building

a more authenticated/accountable Intern
Recommendation

• Maintain robust links to the security commun

– Recognize diversity of stakeholders

– Seek inputs on plans, programs, products

• Seek real

‐world perspective and balance

– Supply chain security– Security assurance case

• Speak up where your voice is needed

– Common Criteria for security evaluation needs active N