Advertisement

An Approach to Organizational Cybersecurity

  • Jose Romero-MarionaEmail author
  • Roger HallmanEmail author
  • Megan Kline
  • Geancarlo Palavicini
  • Josiah Bryan
  • John San Miguel
  • Lawrence Kerr
  • Maxine Major
  • Jorge Alvarez
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10131)

Abstract

Large organizations must plan for Cybersecurity throughout their entire network, taking into account network granularity and outside subcontractors. The United States Department of Defense (DoD) has large networked systems that span the globe, crossing multiple intra-organizational systems. This larger network includes Information Systems typical of enterprise networks, SCADA Systems monitoring critical infrastructure, newer Cyber-physical systems, and mobile networks. With increased connectivity within the DoD and to external organizations, Cybersecurity is seen as a critical organizational need. There is not currently a standard evaluation process to gauge whether various Cybersecurity technologies adequately meet the needs of either the DoD at large or the context of lower-tier organizations. We introduce the DoD-Centric and Independent Technology Evaluation Capability (DITEC), an enterprise-ready evaluation tool that offers a repeatable evaluation process, the ability to take prior product evaluations into account during the acquisition process, and tools to assist security non-experts in understanding which technologies meet their specific needs. This work describes DITEC and the Cyber-SCADA Evaluation Capability (C-SEC), an implementation of DITEC in a Cyber-Physical context.

Keywords

Critical Infrastructure Enterprise System Software Define Networking Security Technology Industrial Control System 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

References

  1. Axelrod, C.W.: Enforcing security, safety and privacy for the internet of things. In: 2015 IEEE Long Island Systems, Applications and Technology Conference (LISAT), pp. 1–6. IEEE (2015)Google Scholar
  2. Bunge, J.: Agriculture giants boost cybersecurity to shield farm data (2015)Google Scholar
  3. Chang, V., Kuo, Y.-H., Ramachmandaran, M.: Cloud computing adoption framework: a security framework for business clouds. Future Gener. Comput. Syst. 57, 24–41 (2016)CrossRefGoogle Scholar
  4. Cruz, T., Barrigas, J., Proena, J., Graziano, A., Panzieri, S., Lev, L., Simões, P.: Improving network security monitoring for industrial control systems. In: 2015 IFIP/IEEE International Symposium on Integrated Network Management (I), pp. 878– 881. IEEE (2015)Google Scholar
  5. Dalesio, E.P.: Duke energy executive says utility battles off steady cyberattacks. Charlotte Obs. (2015)Google Scholar
  6. Dalesio, E.P.: Duke Energy Corp. CEO Lynn Good says the volume of cyberattacks on the country’s largest electric company is astonishing. Charlotte Obs. (2016)Google Scholar
  7. DoD: Cybersecurity/Information Assurance (IA). United States Department of Defense, Defense Contract Management Agency (2014)Google Scholar
  8. Drias, Z., Serhrouchni, A., Vogel, O.: Taxonomy of attacks on industrial control protocols. In: 2015 International Conference on Protocol Engineering (ICPE) and International Conference on New Technologies of Distributed Systems (NTDS), pp. 1–6. IEEE (2015)Google Scholar
  9. ESET: ESET finds connection between cyber espionage and electricity outage in Ukraine. Technical report (2016)Google Scholar
  10. Fink, G.A., Zarzhitsky, D.V., Carroll, T.E., Farquhar, E.D.: Security and privacy grand challenges for the internet of things. In: 2015 International Conference on Collaboration Technologies and Systems (CTS), pp. 27–34 (2015)Google Scholar
  11. Hallman, R., Romero-Mariona, J., Kline, M., San Miguel, J.: DITEC user priority designation (UPD) algorithm: an approach to prioritizing technology evaluations. Technical report, DTIC Document (2014)Google Scholar
  12. Hentunen, D.: Havex hunts for ICS/SCADA systems (2014)Google Scholar
  13. Hsu, A.P.T., Lee, W.T., Trappey, A.J.C., Trappey, C.V., Chang, A.C.: Using system dynamics analysis for performance evaluation of IoT enabled one-stop logistic services. In: IEEE International Conference on Systems, Man, and Cybernetics (SMC), pp. 1291–1296 (2015)Google Scholar
  14. Hultquist, J.: Sandworm team and the Ukrainian power authority attacks (2016)Google Scholar
  15. ICS-CERT: ICSB-11-327-01-Illinois Water Pump Failure Report, United States Department Of Homeland Security (DHS) Industrial Control Systems Cyber-Emergency Response Team (ICS-CERT). Technical report (2011)Google Scholar
  16. ICS-CERT: ICS-CERT alerts, United States Department of Homeland Security (DHS) Industrial Control Systems Cyber-Emergency Response Team (ICS-CERT) (2016)Google Scholar
  17. Jajodia, S., Noel, S., Kalapa, P., Albanese, M., Williams, J.: Cauldron mission-centric cyber situational awareness with defense in depth. In: Military Communications Conference 2011, MILCOM 2011, pp. 1339–1344 (2011)Google Scholar
  18. Jing, Q., Vasilakos, A.V., Wan, J., Lu, J., Qiu, D.: Security of the internet of things: perspectives and challenges. Wirel. Netw. 20(8), 2481–2501 (2014)CrossRefGoogle Scholar
  19. Kerr, L., Hallman, R., Major, M., Romero-Mariona, J., Bryan, J., Kline, M., San Miguel, J., Coronado, B.: TMT: technology matching tool for SCADA network security. In: 2016 Cybersecurity Symposium. University of Idaho, Springer, Heidelberg (2016, in press)Google Scholar
  20. Krebs, B.: DHS blasts reports of Illinois water station hack (2011)Google Scholar
  21. Meltzer, D.: Securing the industrial internet of things. ISSA J., 24–30 (2015)Google Scholar
  22. Moral-García, S., Moral-Rubio, S., Rosado, D.G., Fernández, E.B., Fernández-Medina, E.: Enterprise security pattern: a new type of security pattern. Secur. Commun. Netw. 7(11), 1670–1690 (2014)CrossRefGoogle Scholar
  23. NIST: Cybersecurity Framework. National Institute for Standards and Technology, 100 Bureau Drive Gaithersburg, MD 20899 (2015)Google Scholar
  24. Ponemon, I.: Fourth annual benchmark study on patient privacy and data security. Technical report (2014)Google Scholar
  25. Ponemon, I.: Sixth annual benchmark study on privacy & security of healthcare data. Technical report (2016)Google Scholar
  26. Ramachandran, M., Chang, V., Li, C.-S.: The improved cloud computing adoption framework to deliver secure services. In: Proceedings of ESaaSA 2015-2nd International Workshop on Emerging Software as a Service and Analytics, in conjunction with the 5th International Conference on Cloud Computing and Services Science-CLOSER 2015, pp. 73–79. Scitepress (2015)Google Scholar
  27. Romero-Mariona, J.: DITEC (DoD-centric and independent technology evaluation capability): a process for testing security. In: 2014 IEEE Seventh International Conference on Software Testing, Verification and Validation Workshops (ICSTW), pp. 24–25 (2014)Google Scholar
  28. Romero-Mariona, J., Hallman, R., Kline, M., San Miguel, J., Major, M., Kerr, L.: Security in the industrial internet of things - the C-SEC approach. In: Proceedings of the International Conference on Internet of Things and Big Data, pp. 421–428. INSTICC, SCITEPRESS Science and Technology Publications (2016)Google Scholar
  29. Romero-Mariona, J., Kline, M., Miguel, J.S.: C-SEC (cyber SCADA evaluation capability): securing critical infrastructures. In: 2015 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), pp. 38–38. IEEE (2015)Google Scholar
  30. Symantec: Dragonfly: western energy companies under sabotage threat. Technical report (2014)Google Scholar
  31. TrendMicro: Report on cyber-security and critical infrastructure in the americas. Technical report, Organization of American States (2015)Google Scholar
  32. Wyant, S.: Monsanto confirms security breach at precision planting unit (2014)Google Scholar
  33. Yu, T., Sekar, V., Seshan, S., Agarwal, Y., Xu, C.: Handling a trillion (unfixable) flaws on a billion devices: rethinking network security for the internet-of-things. In: Proceedings of the 14th ACM Workshop on Hot Topics in Networks, HotNets-XIV, pp. 5:1– 5:7. ACM (2015)Google Scholar
  34. Zetter, K.: Exclusive: comedy of errors led to false water-pump hack report (2011)Google Scholar
  35. Zhu, B., Sastry, S.: SCADA-specific intrusion detection/prevention systems: a survey and taxonomy. In: Proceedings of the 1st Workshop on Secure Control Systems (SCS) (2010)Google Scholar

Copyright information

© Springer International Publishing AG (outside the USA) 2017

Authors and Affiliations

  • Jose Romero-Mariona
    • 1
    Email author
  • Roger Hallman
    • 1
    Email author
  • Megan Kline
    • 1
  • Geancarlo Palavicini
    • 1
  • Josiah Bryan
    • 1
  • John San Miguel
    • 1
  • Lawrence Kerr
    • 1
  • Maxine Major
    • 1
  • Jorge Alvarez
    • 1
  1. 1.SPAWAR Systems Center PacificSan DiegoUSA

Personalised recommendations