Biznesa infrastruktūras un datu drošības juridiskie aspekti. Carlos Trigoso, EY Eiropas, Vidējo Austrumu, Indijas un Āfrikas reģiona vadības konsultāciju centra Informācijas drošības virziena vecākais projektu vadītājs.

1. Risk and Trust in Cloud Computing
Through Advanced Network Monitoring
Carlos Trigoso
EY EMEIA Advisory Centre - Information Security
February 5th, 2014

2. Content
► Introduction: Cyber Security
► A Network of Networks
► Multi-layered Advanced Monitoring
► Summing up: The essence of the EY approach
Page 2

3. Introduction: Cyber Security

4. Our view of Information Security
► Why: Risk and trust monitoring, reporting and auditing
(Pragmatic content of Security)
► How: Risk and trust boundary definition, Security
architecture or model (Semantic content of Security)
► Who: Risk sharing and trust allocation, defining functions
and roles in and out of the organisation (Structural content
of Security
► What: Risk avoidance and trust enforcement, access
control (Material content of Security)
Page 4

5. Getting ahead of cyber crime
► The message of the EY Security Practice is: “Anticipating
cyber attacks is the only way to be ahead of cyber
criminals.”
► It is not only because cyber threats are increasing in their
levels of persistence, sophistication and organisation; it is
also not only because of the increasing impact cyber
attacks can have on business organisations.
Page 5

6. Getting ahead of cyber crime
► Essentially, we know that organisations need to change
their way of thinking to stop being simply reactive to future
threats.
► Despite this, only 5% of organisations we surveyed have
a threat intelligence team with dedicated staff. This
applies to all economic sectors.
► We address the Security requirements of the Cloud
services and their environment, and talk about how
leading organisations can reach a state of readiness,
gaining confidence in their assessment of risks and
threats and anticipating and getting ahead of cybercrime.
Page 6

7. Looking beyond the borders
Page 7
• What is our “security
limit;” in other words:
with how many partners
should we work to
enhance overall
cybersecurity?
• How much can we do to
manage the risk in the
business ecosystem?
• Are we prepared to
accept a certain level of
risk from the business
ecosystem?

8. Company
one
Company
two
Collaboration
Climate
Collaboration within the ecosystem
Page 8

9. Security operations and threat intelligence
► In this new global context we think it is vital to have processes and
technologies supporting the goals of the organisation. These are most
effective when centralised, structured and coordinated around the
Security Operations Centre (SOC).
► 40% of the organisations we surveyed in 2014 do not have a
centralised security function of this kind, and those who have, are not
obtaining all the benefits they could from this capability.
► Centralising security functions is not enough, for, if we consider in
particular the cutting edge areas of industry, it is by far not clear how
to secure these new environments and technologies.
► If your organisation has a SOC, how would this function monitor and
enforce Security upon mobile platforms, networks, transport systems,
distribution grids and similar complex systems? In what follows we
address these challenges .
Page 9

10. Cloud adoption changes the Security landscape
Other
Suppliers
Governm
ent
Private
Consumer
s
Auxiliary
Suppliers
Suppliers
Contract
Manufacturers
Distribution
Contractors
Market
s
Transportation
Providers
Partners
Joint-Ventures
Research
Scientists
Product
Designers
Transportation
Retail
Industry
Experts
Corporate
Clients
Distribution
Service
Providers
Support
Services
Vendors
Employees
Financial
Institutions
Consultants
External
Audit
SAAS is adopted massively.
Problem: This extends the
reach of the business even
more, and low-security
solutions proliferate.
Software as
a service
Amazon
SalesForce
Platform as
a service
Infrastructure
as a service
Warehouse
Network
Page 10

11. Achieving Security, Trust and Auditability
1. Organization. Cloud services impact the organizational behaviors. Organizations
need to document roles and responsibilities associated with the use of cloud services and
train employees regularly on these protocols.
2. Technology. IT functions should design applications according to industry security
standards, encrypt the data, and implement role-based access and identity management
solutions.
3. Data. IT functions need to classify and inventory data, assign data owners and
securely purge data that is no longer required.
4. Operations. Business continuity management and resiliency program policies and
procedures should include periodic review and testing, change management and
formalised processes.
5. Audit and compliance. Organizations should plan and execute audits in a way
that minimizes business interruption. For maximum assurance, organizations should
engage a third party to perform the audit and certify the environment.
6. Governance. There are many cloud options from which organizations may choose,
from public cloud services, to building a private cloud, to a hybrid approach. Regardless of
the deployment path organizations pursue, governance processes are necessary.
Page 11

12. Information Security challenges
Cyber Attacks
► Larger attack surface compared to traditional IT System
due to potentially millions of networked end-points in the
“wild” i.e. meters in households
► Linking industrial control systems to IP based data
networks creates potentially insecure entry points to the
grid
► Critical operations such as remote disconnect and
firmware upgrades could be compromised creating
widespread damage
Security vulnerabilities
discovered post installation
could have significant financial
and operational consequences
Sophisticated malware attacks
on process control systems
(e.g. Stuxnet) could severely
impact power generation and
distribution systems
Widespread availability of supply
could be impacted through
unauthorised generation/replay
of critical commands
FINANCIAL
IMPACT
OPERATIONAL
IMPACT
LOSS OF
CONSUMER TRUST
LOSS OF ENERGY
SUPPLY
REGULATORY
FINES
ICO
INVESTIGATIONS
Impacts
SHARE VALUE
DROP
► Uncertainty on ownership and third party access to
personal energy usage data
► Secure capture, storage and transmission of large
amounts of granular consumption data. The more
granular the data the greater the insight into
behavioural patterns of consumers
Data Privacy
► Uncertainty on ownership and third party access
to personal energy usage data
► Secure capture, storage and transmission of large
amounts of granular consumption data. The more
granular the data the greater the insight into
behavioural patterns of consumers
Lack of robust data governance
framework could results in
failure to meet contractual and
regulatory requirements
Personal data leakage due to
insecure data lifecycle process
(creation, transmission,
storage, destruction)
BREACH OF
CONTRACT
RisksThreats
Page 12

13. Understand your threat environment and establish
early detection
► A cyber-threat capability should be able to
address the following questions:
► What is happening out there that the organisation needs to learn from?
► How can the organisation become “hardened” against attack?
► How are other organisations dealing with threats and attacks?
► How can the organisation help others deal with these threats and attacks?
► Is the organisation able to distinguish a random attack from a targeted one?
► What would be the economic cost of an attack?
► How would the customers be impacted and what would the legal and
regulatory consequences be?
► The emphasis of Security has changed to
Threat Intelligence!
Page 13

14. Taking action and getting ahead
► Your organisation may already have strong IT policies, processes and
technologies, but, is it prepared for what is coming? To address this
you should take action:
► 1. Design and implement a cyber threat intelligence strategy to support
strategic business decisions and leverage the value of Security.
► 2. Define and encompass the organisations extended cybersecurity
ecosystem including partners, suppliers, services and business
networks.
► 3. Take a cyber-economic approach, understanding your vital assets
and their value, and consequently investing in their protection.
► 4. Using forensic data analytics and cyber threat intelligence to take
analyse and anticipate where the likely threats are coming from and
when, increasing your readiness.
► 5. Ensure everyone understands the need for strong governance, user
controls and accountability.
Page 14

15. A Network of Networks

16. A Network of Networks (1)
► Together with the Grid (e.g. Smart Meter) and other mobile and
Internet-connected systems, the Cloud ecosystem is a “Network of
Networks” (or a System of Systems).
► Focusing on this reality, our proposed approach is to consider the
Cloud services and infrastructures as one more aspect of much wider
and complex network.
► When taking this point of view, we see the need to shift the
emphasis from the Cloud services a cleanly defined system, with
clear boundaries and input/output points, and take instead as our
object of protection the networks themselves, i.e. the interactions
between the users/owners of the applications and the numerous other
actors in the ecosystem.
► Security becomes then the security of those interactions and is not
limited to the Cloud service or data centre as a “thing.”
Page 16

17. A Network of Networks (2)
The Network of Networks is the full-blown Internet of People and Things,
where every machine-to-machine connection is actually mediated human
interaction.
Page 17

18. A Network of Networks (3)
These Networks, are simultaneously networks of collaboration, but also
networks of opposition and threat. There is no “inside” or “outside” in this
discontinuous, porous space.
Page 18

19. A Network of Networks (4)
► Traditional, proven Risk Management models are essential for the
Security function in an organisation; but their own origin and wisdom
are still focused in a world where the organisation owns and
possesses most if not all of the data assets flowing through the
systems.
► Different to this, in a network of networks (consider for example an
extended network of partners, suppliers and collaborators) data
assets are in possession, are governed and managed by different
actors with different policies and assurance requirements.
► Let’s not forget too that these actors have sometimes very different
interests and business objectives within the collaboration.
► In the whole, the Risk “Landscape” of the organisation is only a part of
a potentially contradictory and opaque “universe” of actual and
potential threats. It is not only that the boundary of the enterprise is
disappearing: the risk landscape also becomes unbounded.
Page 19

20. ► A standard approach to risk management assumes that the trust boundary is
already defined. Is this correct? What is the risk incurred by the different
participants?
► What is missing in the risk-focused and techno-centric approach is everything
related to the management of trust, i.e. the new functions and processes, the
new policies and structures required to expand the risk boundary.
► Four key questions (areas) need to be addressed to complete the Security
discourse:
► Who owns the data and who authorises, validates access to it?
(Verification of Trust)
► What is the structure of the network and what security zones should
exist? (Definition of Trust)
► What roles/functions exist in these zones and how is trust allocated?
(Allocation of Trust)
► These are then complement by the risk-focused area (Enforcement of
Trust)
Page 20
A Network of Networks (5)

21. A Network of Networks (6)
► In the Cloud (and shared infrastructure) environment, a new Risk and
Trust space is defined:
► New functions are adopted by the business (for example:
operating incrementally as service providers)
► New partners are introduced (for example: application providers
and data processors)
► New relationships with the client are necessary (for example:
enabling the client to select products and services online)
► The information networks and technologies are extended (for
example: establishing mobile connections and access for
maintenance and support purposes)
► Previously physically isolated systems are linked under the Cloud
services (for example: network gateways for authentication)
Page 21

22. A Network of Networks (7)
The fundamental insight:
Page 22
The Target of Protection, the object of security is the
network of networks, not the particular cloud-
connected system. The services “exist” in a much
wider network. So all Information Security measures
and technologies need to be aligned with this goal
in mind.

23. Multi-Layered Advanced Monitoring

24. Building trust in the cloud is attainable by leveraging a
risk-based framework
We have reached the technology tipping point of adoption of
the cloud; what once was an emerging technology filled
with promises of efficiency, agility and interoperability has
become the norm.
Early adopters have gained unquestioned competitive
advantages due to the ease and acceleration of
implementing cloud technologies.
However, there is still one lingering question asked by
boards, business executives and IT professionals alike:
can we trust the cloud?
By focusing on access and data control consumers and
providers can strive for a secure, trusted and audit-ready
environments.
The following slides show how to address this challenge.
Page 24

25. Cyber Threat: the Regin Malware
http://www.symantec.com/en/uk/outbreak/?id=regin&om_sem_cid=biz_sem_s215343999763367|pcrid|53538324323|pmt|e|plc||pdv|c

26. The rise of Cyber Threat
Information security is changing at a rapidly accelerating rate. In today’s
world of ’always on’ technology and not enough security awareness on
the part of users, cyber attacks are no longer a matter of “if” but “when.”
With the understanding that attacks can never be fully prevented,
companies should advance their detection capabilities so they can
respond appropriately.
• Point solutions, in particular — antivirus, IDS, IPS, patching and encryption — remain a
key control for combatting today’s known attacks. However, they become less effective
over time as hackers find new ways to circumvent controls.
So how do organizations build controls for the
security risks they don’t even know about yet?
Page 26

27. How can a Security Operations Centre help?
Organizations may not be able to control when information security
incidents occur, but they can control how they respond to them.
Expanding detection capabilities is a good place to start.
A well-functioning Security Operations Centre (SOC) can form the heart
of effective detection. It can enable Information Security functions to
respond faster, work more collaboratively and share knowledge more
effectively.
EY not only recommends the SOC approach for
common IT operations, but also for Operational
Technology Security, considering that these two areas
are converging and require an articulated approach.
Page 27

28. Page 28
How we think about threat intelligence
… rather than the instigating event and reaction.
Threat Actor
Precursor
Event
Pattern of
Response
Consequence
Precursor
Event
Pattern of
Response
Consequence
• missing patch exploited
• malware injected
• data exfiltrated
Vulnerability Intelligence focuses efforts on studying the consequence …
… rather than the instigating event and reaction.

29. How do I monitor?
What do I monitor? Where do I monitor?
Four key considerations for Security monitoring
► Targets
► System/operating system
► Identity/accounts
► Network traffic
► Application/database
► Data/file
► Transactions
3
21
► Environment
► Host-based
► Network-based
► Internal
► External
► Infrastructure
► Algorithms
► Action/behavior based
► Heuristics
► Anomaly
► Attribute based
► Signature
► Approach
► Real-time/near real-time
► Post-event analytics
► Batch data processing
How do I monitor?4
Page 29

30. Multi-Layered Advanced Monitoring (1)
► As the Cloud, Grid and Mobile initiatives change the Security
landscape of our clients in all sectors, EY promotes a comprehensive
approach to this space.
► Our Security Operations Centre and Cyber Security approaches
become more and more relevant as our clients adopt Cloud, Grid,
Connected and Mobile business models.
► A decisive part of this direction is the enablement of Threat
Management processes and technologies which operate within the
SOC framework and become the eyes and the brains of our client’s
Security stance.
► Now, centralising security functions is not enough. If your organisation
does have a SOC, how would this centre monitor the extended
environment and discover or anticipate threats?
Page 30

31. Multi-Layered Advanced Monitoring (2)
► To do so, several conceptual and technical changes are necessary to
implement a satisfactory Threat Management system.
► Let’s first recapitulate the conditions of such a solution:
► The environment is articulated in for form of a network of networks or multi-start
pattern.
► In this space there are both known and unknown devices, as well as both managed
and unmanaged entities whose actions are impossible to predict
► Apparently well-behaved devices are opaque: anomalous behaviour cannot be
determined by means of conventional testing of components (*)
► Attacks “from the inside” are equivalent to “attacks from the outside” of the
networks
► There is no definite network perimeter
► Risk analysis, based on historical data is not relevant to determine future events or
security measures
► There is no frequency data that can be extrapolated to anticipate attack trends
► Attack events are not self-contained, as for example the case when simulated
attacks are only a cover for the real objectives of the attacker
Page 31

32. Multi-Layered Advanced Monitoring (3)
► Under these conditions, several requirements arise for any Threat
Management solution (comprising organisational and technical
processes):
► A shift is necessary both at technical and procedural level, moving from event
monitoring (i.e. the capture of known events which assert the status of a
system) to pattern monitoring i.e. the analysis and synthesis of behaviour of
systems at network level (interactions of systems)
► The concept of Continuous Monitoring needs to be applied but going beyond
the customary scope of performance and compliance processes, to adopt
criteria of known and desirable patterns, versus unknown and undesirable
patterns of interaction.
► Instead of predictive threat modeling, based on supposed event frequencies
and expert opinion, each network needs to be surveyed by looking primarily
onto the traffic between the nodes, the protocols in use and the patterns of
communication or transaction.
Page 32

33. Multi-Layered Advanced Monitoring (4)
► This solution class requires what can only be understood as a deeper
and more systematic analysis of the business operations and the
networks it lives in. Essential steps include:
► A catalogue or inventory of the protocols used. The solution must implement an active protocol detection
capability to validate any traffic. (*)
► An inventory of network, platform and device admissible commands that can be sent over the agreed protocols
► A detailed matrix of access routes specifying user and device types, application and system targets, credentials,
data types, traffic patterns, transaction levels, business criticality, assurance requirements and service levels
► A baseline or model of desirable traffic and interaction patterns at network level
► A sensor or agent architecture to filter traffic where possible (in the standard way of systems management)
► A network protocol and packet-level filtering service to analyse traffic at key points of entry and exit of the sub-
networks
► Behavioural analysis tools capable of storing and processing data in real time across the collaboration network
including partner networks when possible (collaborative security)
► As Security mechanisms should not become a single point of failure, advanced concepts of signal intelligence
need to be applied, for example implementing “signal comparison” of filtered and unfiltered traffic.
► Any behavioural change in the network must trigger immediate redundant communications and services in a
fashion similar to safety-orientated mechatronics or avionics systems.
► On the process side, the baseline of communications must be recalibrated periodically within the framework of
collaborative security.
Page 33

34. Typical Protection Domains
Internet
Data
Center
Global
WAN
Monitoring
Network
Core
Network
Remote
VPN
Access
Gateway
ICT
Data Center
E-Government
Applications
Gov.
Agencies
Data Link
Encrypted
connections
Out-of-band
Management
Network
Remote
Network
Insider threats
Man-in-the
Middle
Internet
threats
Insider
threats
Remote
Network
Network
Operations
Center
Main Threat Cases
• Traditional External Threat -
As worms evolved faster than
defense mechanisms like anti-virus
solutions, firewalls and intrusion
detection systems, their ability to
penetrate an infrastructure and
propagate rapidly was increasing.
• Man-in-the Middle threats –
risk of interception of sensitive
information or communications
• Insider threats - leak risks
whenever a sensitive file or
database was accessed and then
subsequently sent to an external
location.
• Moreover, APT pose significant
threats to MICT. The risk of an
attack by the APT is high –
therefore MICT requires advanced
threat detection and remediation
capabilities.
Insider
threats
Page 34

35. SoC Monitoring Architecture
Internet
Data
Center
Global
WAN
Monitoring
Network
Core
Network
Remote
VPN
Access
Gateway
ICT
Data Center
E-Government
Applications
Gov.
Agencies
Out-of-band
Management
Network
Remote
Network
Remote
Network
Security
Operations
Center
Events
Database
 SOC requires a Highly Scalable
and Intelligent Technology
Platform with Real-Time Event
Correlation to Effectively
Mitigate Business Risk.
 Collect event data from various
devices and applications, VOIP
as well as other
communications solutions;
 Process and archive streaming
data from a globally dispersed
network of thousands of event
sources “real-time”;
 Correlate this event data in
order to identify and prioritize
threats across the organization;
 Provide a centralized easy-to-
understand view of these
threats and automated
response workflow;
 Achieve event data for
compliance purposes and
forensic analysis
 Need full-packet capture - to
allow data mining and
retrospective analysis and
nvestigations
Network
Operations
Center
Page 35

36. Summing Up: The essence of the EY approach

37. Our view of Information Security
► Why: Risk and trust monitoring, reporting and
auditing (Pragmatic content of Security)
► How: Risk and trust boundary definition, Security
architecture or model (Semantic content of Security)
► Who: Risk sharing and trust allocation, defining functions
and roles in and out of the organisation (Structural content
of Security
► What: Risk avoidance and trust enforcement, access
control (Material content of Security)
Page 37

38. A “data-centric” (data “flow”) Security approach
Page 38
• 1 Data Ownership
• 7 Reporting
• 2 Assurance Levels
• 3 Data Classification
• 4 Zoning Model
• 6 Interfaces & Protocols
• 8 Audit & Verification
• 5 Access Rights
Note
The root of Cloud,
Grid and Mobile
Security is Data
ownership.
Determining the
assurance and data
classification levels
precede the zoning
and access model

39. Getting started in Threat Intelligence
• Security services begin with a Situational Awareness assessment.
• Evaluate an organisation’s potential threat actors
• Establish a framework of collaborative security
• Map available controls to detect and complicate potential events
• Baseline the interactions and network flows with and in the
collaboration environment
• Catalogue the entry and exit points, as well as the allowed access
routes and commands
• Define a strategy to enhancing Threat Intelligence capabilities for
the organisation’s unique threat landscape
• Provide a current capability and roadmap to the desired Threat
Intelligence capabilities required by each organisation
Page 39

40. Our relevant Security & Data Protection services
Security Architecture & Design
► Develop end-to-end security principles and requirements based
on your risk acceptance levels. Ensure security is embedded into
the design of your smart metering / grid system.
► Specialist advice in areas such as:
► Crypto key management
► Access control / Authentication
► Protection and monitoring of critical commands (e.g. remote
disconnection of supply, device firmware upgrades, remote
administration, Pre-pay top-up etc.)
Privacy & Data Protection
► Perform Privacy Impact Assessment (PIA) on your smart
metering activities, looking at areas such as:
► Granularity & frequency of energy consumption data
► Third party access to energy consumption date
► Retention of data across your systems
► Aggregation and/or anonymisation of data
► Develop a privacy framework and associated controls to ensure
you comply with your data protection regulatory obligations.
Penetration Testing
► Deep technical security expertise (working with specialist
partners as required) we offer a range of services to help
discover potential vulnerabilities through security penetration
testing.
► Covering both software and hardware testing, including:
► Meter communication interfaces
► On-board firmware
► Meter hardware chipsets & circuit board components
► ease of extraction of crypto keys and on-board log data from
storage
Cyber Threat Monitoring and Management
► SOC design and implementation
► Continuous Monitoring of enterprise and ecosystem networks
► Proactive cyber-attack detection
Cyber Security Assessment & Governance
► Focused assessment of security controls in place (or planned) as
part of your smart metering or smart grid implementation. We can
tailor the assessment based on your requirements. Our expertise
covers areas such as:
► Smart meters
► Communication hubs
► Home Area Networks
► Wide Area Networks
► Concentrators
► Develop security governance framework including review and re-
adjustment of security controls.
► Head-Ends
► Administration terminals
► Back-end systems storing/
handling consumption data
► Incident Response
► Cyber Threat and Attack investigations
► Information Security Analytics
Page 40

41. EY | Assurance | Tax | Transactions | Advisory
Ernst & Young LLP
© Ernst & Young LLP. Published in the UK.
All Rights Reserved.
The UK firm Ernst & Young LLP is a limited liability partnership registered in England and Wales
with registered number OC300001 and is a member firm of Ernst & Young Global Limited.
Ernst & Young LLP, 1 More London Place, London, SE1 2AF.
ey.com