WIXLIB

System Security Engineering forProgram Protection and CybersecurityMelinda ReedOffice of the Deputy Assistant Secretary of Defensefor Systems Engineering18th Annual NDIA Systems Engineering ConferenceSpringfield, VA October 27, 201518th NDIA SE ConferenceOctober 26-29, 2015 Page-1Distribution Statement A – Approved for public release by DOPSR on 10/19/2015, SR Case # 16-S-0131 applies. Distribution is unlimited.

Ensuring Confidence inDefense Systems Threat:– Adversary who seeks to exploit vulnerabilitiesto:o Acquire program and system information;o Disrupt or degrade system performance;o Obtain or alter US capability Vulnerabilities:– All systems, networks, and applications– Intentionally implanted logic (HW/SW)– Unintentional vulnerabilities maliciouslyexploited (e.g., poor quality or fragile code)– Controlled defense information resident on, ortransiting supply chain networks– Loss or sale of US capability that provides atechnological advantage Access points are throughoutthe acquisition lifecycle Consequences:– Loss of data; system corruption– Loss of confidence in critical warfightingcapability; mission impact– Loss of US capability that provides atechnological advantage18th NDIA SE ConferenceOctober 26-29, 2015 Page-2 and across numerous supplychain entry points- Government- Prime, subcontractors- Vendors, commercial partsmanufacturers- 3rd party test/certificationactivitiesDistribution Statement A – Approved for public release by DOPSR on 10/19/2015, SR Case # 16-S-0131 applies. Distribution is unlimited.

Spectrum of Program ProtectionRisks to ConsiderQualityEscapeProduct defect/inadequacyintroduced eitherthrough mistake ornegligence duringdesign,production, andpost-productionhandling resultingin the introductionof deficiencies,vulnerabilities, anddegraded life-cycleperformance.ReliabilityFailureMission failure inthe field due toenvironmentalfactors unique tomilitary andaerospaceenvironmentfactors such asparticle strikes,device aging, hotspots, electromagnetic pulse,etc.FraudulentProductCounterfeit andother than genuineand new devicesfrom the legallyauthorized sourceincludingrelabeled, recycled,cloned, defective,out-of-spec, etc.MaliciousInsertionThe intentionalinsertion ofmalicious hard/softcoding, or defect toenable physicalattacks or causemission failure;includes logicbombs, Trojan ‘killswitches’ andbackdoors forunauthorizedcontrol and accessto logic and edextraction ofsensitiveintellectualproperty usingreverseengineering, sidechannel scanning,runtime securityanalysis,embedded systemsecurity weakness,etc.Stolen dataprovides potentialadversariesextraordinaryinsight into USdefense andindustrialcapabilities andallows them tosave time andexpense indeveloping similarcapabilities.DoD Program Protection focuses on risks posed by malicious actors18th NDIA SE ConferenceOctober 26-29, 2015 Page-3Distribution Statement A – Approved for public release by DOPSR on 10/19/2015, SR Case # 16-S-0131 applies. Distribution is unlimited.

Program Protection inDoDI 5000.02 DoD considers SSE a critical discipline of SE. To furtherestablish SSE, DoD has focused on integrating SSE into SEpolicy, contracts and workforce education. System Security Engineering is accomplished in the DoDthrough program protection planning (PPP) DoDI 5000.02 requires program managers to employ systemsecurity engineering practices and prepare a ProgramProtection Plan to manage the security risks to criticalprogram information, mission-critical functions andinformation Program managers will describe in their PPP:––––18th NDIA SE ConferenceOctober 26-29, 2015 Page-4Critical Program Information, mission-critical functions and criticalcomponents, and information security threats and vulnerabilitiesPlans to apply countermeasures to mitigate associated risksPlans for exportability and potential foreign involvementThe Cybersecurity Strategy and Anti-Tamper plan are includedDistribution Statement A – Approved for public release by DOPSR on 10/19/2015, SR Case # 16-S-0131 applies. Distribution is unlimited.

Program ProtectionIntegrated in PolicyDoDI 5000.02 Operation of the Defense Acquisition System–Regulatory Requirement for Program Protection Plan at Milestones A, B, C and FRP/FDDDoDI 5200.39 Critical Program Information (CPI) Identification and Protection WithinResearch, Development, Test, and Evaluation (RDT&E)––Assigns responsibility for Counterintelligence, Security, and System Engineering support for the IDand protection of CPIRescoped definition of CPIDoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems andNetworks–Establishes policy and responsibilities to minimize the risk that warfighting capability will be impaireddue to vulnerabilities in system design or subversion of mission critical functions or componentsDoDI 4140.67 DoD Counterfeit Prevention Policy–Establishes policy and assigns responsibility to prevent the introduction of counterfeit material at anylevel of the DoD supply chainDoDI 8500.01 Cybersecurity–18th NDIA SE ConferenceOctober 26-29, 2015 Page-5Establishes policy and assigns responsibilities to achieve DoD cybersecurity through a defense-indepth approach that integrates the capabilities of personnel, operations, and technology, and supportsthe evolution to network centric warfareDistribution Statement A – Approved for public release by DOPSR on 10/19/2015, SR Case # 16-S-0131 applies. Distribution is unlimited.

What Are We Protecting?Program Protection PlanningDoDI 5000.02DoDM 5200.01, Vol. 1-4DoDI 5200.39TechnologyDoDI 8500.01DoDM 5200.45DoDI 8510.01DoDI 5200.44DoDI 5230.24ComponentsInformationWhat: A capability element that contributesto the warfighters’ technical advantage (CPI)What: Mission-critical elements andcomponentsWhat: Information about applications,processes, capabilities and end-itemsWho Identifies: System Engineers withCI/Intel and Security SME supportWho Identifies: System Engineers, LogisticiansWho Identifies: AllID Process: Criticality AnalysisID Process: CPI identification, criticalityanalysis, and classification guidanceThreat Assessment: Foreign collection threatinformed by Intelligence andCounterintelligence (CI) assessmentsThreat Assessment: Defense IntelligenceAgency Threat Analysis CenterThreat Assessment: Foreign collection threatinformed by Intelligence andCounterintelligence assessmentsCountermeasures: Anti-Tamper,Classification, Exportability Features,Security, etc.Countermeasures: SCRM, Cybersecurity, Anticounterfeits, software assurance, TrustedFoundry, etc.Countermeasures: Cybersecurity,Classification, Export Controls, Security, etc.Goal: “Keep secret stuff in”by preventing the compromise and loss of CPIGoal: “Keep malicious stuff out”by protecting key mission componentsGoal: “Keep critical information from gettingout” by protecting data from our adversariesID Process: CPI IdentificationProtecting Warfighting Capability Throughout the LifecyclePolicies, guidance and white papers are found at our initiatives site: http://www.acq.osd.mil/se/initiatives/init pp-sse.html18thNDIA SE ConferenceOctober 26-29, 2015 Page-6Distribution Statement A – Approved for public release by DOPSR on 10/19/2015, SR Case # 16-S-0131 applies. Distribution is unlimited.

Systems Security EngineeringIntegrates Program Protection PlanningConcept StudiesDesign DefinitionSRRSystem Definition(Functional Baseline)Preliminary Design (Allocated Baseline)Design DefinitionDesign DefinitionSE Baselines*CriticalityAnalysisDetermine criticalcomponentsbased on criticalmission threadsAnalyzecomponentvulnerability tomalicious exploitIdentify potentialcomponentsuppliersCPI AnalysisIdentify capabilityelementsproviding a UStechnologicaladvantageAssess the riskassociated witheach CPI(exposure,consequence yCategorizesystem (C,I,A)Identifycontrolbaselines andoverlays, thentailorTrace controlstorequirementsDetailed Design (Product Baseline)Program Protection PlanDetermine candidate protectionmeasures to address vulnerabilities:anti-tamper, cybersecurity, hardware/software assurance, physicalsecurity, operations security, supplychain, system security, and trustedsuppliersDetermine foreign involvementexpectations and impacts onprotection measuresConduct engineering risk/costtrade-off analysis to selectprotection measuresThreats and Vulnerabilities AssessmentIdentify supply chainthreats and vulnerabilitiesIdentify foreigncollection threats andvulnerabilitiesIdentify personnel, physical, operationalthreats and vulnerabilities18th NDIA SE ConferenceOctober 26-29, 2015 Page-7Identify acquisitionmitigations (e.g.,blind buy, rotection measures areidentified and integratedinto technical baselines,iteratively informed by andinforming the maturingdesign.ContractorRespond to acquisition andsecurity requirementsContinually assess securityrisks during design reviewsand system implementationConduct early defenseexportability featuresplanning and designTest and EvaluationAssess hardware andsoftware vulnerabilitiesEvaluate Anti-TamperprotectionsVerify securityrequirements (Contractor,DT&E, OT&E)Distribution Statement A – Approved for public release by DOPSR on 10/19/2015, SR Case # 16-S-0131 applies. Distribution is unlimited.

CPI Policy Updates CPI and AT Policy Updates– DoDI 5200.39, Critical Program Information (CPI)Identification and Protection Within Research,Development, Test, and Evaluation (RDT&E):Revises the CPI definition, requires CPI identificationearly and throughout the program, and emphasizeshorizontal identification and protection– DoDD 5200.47E, Anti-Tamper: Designates theSecretary of the AF as the Executive Agent for AntiTamper and establishes requirements for ATplanning, implementation, and evaluation. Revised definition of CPI has been scoped to focus only onthose elements that provide a capability advantage and resideon the end-item (system or supporting systems)– “U.S. capability elements that contribute to the warfighters’ technicaladvantage, which if compromised, undermines U.S. military preeminence.U.S. capability elements may include, but are not limited to, softwarealgorithms and specific hardware residing on the system, its trainingequipment, or maintenance support equipment.”18th NDIA SE ConferenceOctober 26-29, 2015 Page-8Distribution Statement A – Approved for public release by DOPSR on 10/19/2015, SR Case # 16-S-0131 applies. Distribution is unlimited.