January 24, 2019 | University of Maryland Riggs Alumni Center | College Park, MD
Click a block to view session details
The Honorable Phillip Bond
Dr. Scott Dade
As the nation's cyber warriors, US Cyber Command (USCYBERCOM) operates daily in cyberspace against capable adversaries, some of whom are now near-peer competitors in this domain. We have learned we must stop attacks before they penetrate our cyber defenses or impair our military forces; and through persistent, integrated operations, we can influence adversary behavior and introduce uncertainty into their calculations. Our forces must be agile, our partnerships operational, and our operations continuous. Superior strategic effects depend on the alignment of operations, capabilities, and processes, and the seamless integration of intelligence with operations. Now we must apply this experience by scaling to the magnitude of the threat, removing constraints on our speed and agility, and maneuvering to counter adversaries and enhance our national security.
This session will provide an overview USCYBERCOM's updated mission and the primary objectives for the Command. We will also cover industry/academia/USG interaction and how the development of partnerships will be a primary objective to develop enhanced operational capabilities. Most importantly, it will cover specifically how companies and individuals can present their technology to the Command and what the process is from their presentation through receiving a potential contract.
Dr. Blair Taylor
One of NSA's goals is to build the cybersecurity workforce. Towards that goal, the National Cybersecurity Program (NCCP) is a nationwide effort to develop effective engaging cyber curriculum modules that are publicly available for educational institutions looking to teach cyber. The NSA Cyber Cube (thecybercube.org) now includes over 100 peer-reviewed learning objects in high need topic areas including networking, risk management, cybersecurity laws and policies, cybersecurity principles, cyber threats and vulnerabilities, etc. This panel will discuss the Cyber Cube, which represents a vision for cybersecurity education that includes one-stop access to cybersecurity curriculum, faculty workshops and outreach, free summer camps (GenCyber), and other resources to build a cyber-prepared workforce.
Henry D. Vido
2018 proved that breaches are continuing and increasing, high value data is being stolen in large quantities, and defending against advanced attacks is getting even harder.
In this presentation, "Winter is coming: Preparing with a Red Team" I will be covering why red teams are needed in every sector and why it is important to continuously exercise your defenses.
I will be detailing some statistics about breaches in several sectors from 2018, tactics techniques and procedures (TTP's) attackers have available and are using today, and how a red team exercise can help organizations prepare for the future.
As the need for cyber security grows, many communities are implementing various strategies to establish themselves as a hub for cybersecurity innovation. Fort Meade in Anne Arundel County, Maryland serves as the focal point for much of the state's security innovation and cyber business. With hundred of technology businesses and a number of support organizations operating in the vicinity, the Fort Meade region is a compelling case study on how collaboration can nurture such a cyber ecosystem. This panel, which will feature representatives from such organizations as the Anne Arundel Economic Development Corporation, Cybrary and the For Meade Alliance, will highlight the economic development tools, educational initiatives and recruitment and training resources that allow the Fort Meade cyber region to retain its workforce and compete for and attract more talent and business to its ecosystem.
Mark S. Loepker
This presentation will summarize the Cyber Center for Education and Innovation, Home of the National Cryptologic Museum unique national value proposition to bring together cybersecurity education and invite collaboration. Discuss the Digital Curriculum Library of assured quality cybersecurity curriculum and sharing experiences through virtual technologies
Ms. Laura Baker, MBA, ARM, BS Marketing
Learn about how to motivate your community of business owners to adopt cybersecurity best practices with a fun cybersecurity competition. We have hackathons for programmers, competitions for K-12 and university students, and challenges for Technology professionals., but business owners and entrepreneurs are left out. Yet, those are the most vulnerable and greatly influence our community's economic development. Laura Baker, Executive Director of CyberWyoming, will outline how to develop, promote, recruit, and manage a cybersecurity competition for small businesses emphasizing motivation, recognition, and support for participants.
Cyber security is a critical all-hands issue which continues to escalate in importance as technologies spins up and bad actors are more emboldened.
Over the summer, CyberHawaii was informed that U.S. Indo Pacific Command was interested in significantly enhancing its mission assurance, and in particular, to be able to defend against cyber-attack networks and systems owned and operated by critical infrastructures that support DOD facilities in Hawaii. The 5 critical infrastructure sectors are Energy, Telecom, Port & Maritime Transportation, Oil & Gas, Water & Sewer comprising 16 entities in our community.
The overall objective is to establish a cross-sector, shared cyber threat situational awareness and response capability across these 5 sectors to decrease risk and increase resiliency against a prolonged attack against Hawaii and DOD installations/activities based in Hawaii. The Defensive Cyber Industry Consortium (DCIC) was established and kicked-off as a public-private partnership with USINDOPACOM's Defensive Cyber Coordination Center (DCCC)/Joint Cyber Center (JCC). With the State of Hawaii, as represented by the Adjutant General supported by the Department of Homeland Security, CyberHawaii was invited to facilitate between the private sector/municipal entities and the state, federal and DOD agencies to support the establishment of the DCIC.
DCIC is intended as a national pilot which, if successful, would be replicated to other combatant commands. As a team, resources are being gathered to increase capabilities of the private sector companies and municipal utilities; the State's Fusion Center will be the base and hub of the DCIC.
Cyber Hawaii proposes a panel discussion to include representatives of INDOPACOM, DHS, and Hawaii private sector entities discussing the criticality as well as the challenges of such a public-private, cross-sector cyber security initiative - where we are in the process, what steps we have laid out for each partner, and the importance of keeping the group together and moving forward.
Cyber Hawaii is committed to a whole of community approach to building a cyber secure and resilient Hawaii thru information sharing, supporting cyber education and workforce pathways for students interested in cyber security careers, and developing tools and related training to assist our small-mid sized business and nonprofit community be more aware and secure.
Dr. Carol Woody
Discuss a unique government/industry/academic partnership for dual model apprenticeships to address cybersecurity skills shortage. Dual here means that in addition to time spent in classroom instruction, apprentices receive relevant practical training and experience at a partnering company, while receiving a salary to gain work.
In 2017, Kentucky became the second state in the US to adopt the federal cyber engineering pathway curricula designed by the National Integrated Cyber Education Research Center for 9-12th graders within its school districts. ISC2 reveals a worldwide skills gap of 2.9 million. Kentucky alone had more than 2115 unfilled positions last year in cybersecurity.
Through efforts of TALK, the Technology Association of Louisville, KY, Jefferson County Public Schools, and state government, the much-needed cyber engineering pathway was put in place with in classroom curricula, teach training, as well as after-school programming. Average annual p ay for an entry level cybersecurity analyst across the U.S. is $90,271 a year.
Dr. Rob Williams
Cybersecurity is an urgent national priority made clear by regular reports of new cyber-attacks on institutions and infrastructures. Equally urgent is the need to grow a cyber workforce to counter this threat. Veterans are an obvious talent pool that should be tapped given their demonstrated desire to serve and their possession offer of a security clearance. However, unless they have worked in cybersecurity, many may not be aware of the options or feel the process is too intimidating. Given the desire to reach as many veterans as possible globally, Discovery Lab's Global (DLG), a nonprofit, utilizes nonproprietary virtual reality technology to create a 3D virtual Cybersecurity Campus for education and training to help veterans explore cybersecurity as a career from home. Veterans participate from across the country as avatars in an NSA-funded pilot. The presentation will detail the NSA-funded pilot and how virtual reality can support cybersecurity workforce development for veterans.
Today's threat environment is one of continuous, unrelenting change. Risk management frameworks become obsolete before they can be approved and published by governing bodies. Yesterday's "best practice" is today's vulnerability. How can management be both accountable AND change rapidly enough to counter the threat? Consider that the number of active IP devices on the Internet will be three times the global population by 2021. Consider further that remote sensing, command, and control devices are switching to cellular networks for communication. Finally, consider that by the early 2020's, this cellular network will be 5G, with a potential for very low latency and 20 Gbps bandwidth. Therefore, our critical national infrastructure is going to continue evolving to become more ubiquitous, diffuse, accessible and our security boundaries will become nearly impossible to define
Categories and Subject Descriptors
Security and Protection
Infrastructure, Cybersecurity, Data Integrity
Key Point #1: Design the security first.then build the system to use it. It's not enough to build your system and then slap Transport Layer Security on it. You need a comprehensive risk and threat analysis. You need to dig for vulnerabilities. You need to address them in your concept of operations.
Key Point #2: Embrace failure. The objective is NOT to build something that never fails. The objective is to build something that fails quickly and loudly so that you can find it's weak points early on and fix them.
Key Point #3: Treat every network as hostile, especially your own. There is no such thing as a trusted network any longer. Every network is hostile, every user is malicious, and all network traffic is monitored. Your system should assume that, and you should design it accordingly.
Key Point #4: A dependable IoT system requires bulletproof configuration management. It's not enough for you to know the configuration of every device in the system. Your ability to modify that configuration should be designed so that it is done out of band, that it is encrypted, that the system has a built-in default roll-back to "last-known-good" configuration.
Key Point #5: You can best manage risk quantitatively, and you can only do that if you know how to analyze your data. The "present" is a standing asymptotic wave function between the "past" and the "future." In the past, everything has undergone a quantum-like collapse of probabilities into certainty. The future, still approaching, is a cloud of possible outcomes each weighted with a probability. Your ability to manage that cloud of possible outcomes is dependent on your ability to filter out the undesirable outcomes to leave only the most desirable outcomes. To do that, you need to identify those measurements you've collected in the past that are the leading indicators of what is about to happen in the future. This is the underpinning of predictive analytics. Get some from a data scientist near you.
Key Point #6: Infrastructure protection is a contact sport, you are going to have to get your hands dirty. It requires a continuous situational awareness of the current threat vectors, your current system state, and continuous thoughtful probing of your attack surface. It is not enough to define a policy and process and revisit them once a year. You must continuously evaluate new approaches to achieving similar goals. A doctrinal approach is not adaptable enough to survive in the long run.