hi i'm sunil yu and i'm the creator of
the cyber defense matrix the cyber
defense matrix is a model that i created
to help navigate the cyber security
landscape and i think it has some
applicability for some of the challenges
that we see in healthcare
a little bit about me before we get
started
so i'm currently the cso and head of
research at jupiter 1. jupiter 1 is a
startup that is building a cloud-native
cyber asset management and governance
solution
before jupiter 1 i was the chief
security scientist at bank of america
and while there i had the opportunity to
serve in a couple different roles
one of them was to be a mad scientist
where i had a chance to build a lot of
interesting and new crazy capabilities
aside from building capabilities i also
was the
main person that was in charge of
looking at new startups and testing
those capabilities to see whether or not
all the claims that they make actually
whether they actually work
and then lastly i was i had a chance to
be a red team lead lead where i got a
chance to break a lot of things
now in my role as a product evaluator of
a lot of different startups
i faced a
an immediate challenge which was just
trying to dissect through all the
buzzwords that they throw at me to
understand one what they do and two to
see whether or not it actually meets the
need that i have
well one of the one of the
responsibilities i had as the chief
security scientist was to
develop the technology roadmap for the
organization
well to be able to do that you have to
understand where you have gaps right
but when you just stare at a bunch of
buzzwords like you see here it's hard to
find a gap because what you see is all
there is
if i were to ask you what's missing out
of here you would have a hard time just
because
it requires you to have to dissect every
word here and understand what what might
be missing
so i needed a better more structured
approach and as a as
in my attempt to come up with a more
structured approach
i came up with again something i call
the cyber defense matrix the cyber
defense matrix uh
at its core consists of two dimensions
on one dimension it's the things that i
care about these five asset classes
devices applications networks data and
users
on the other dimension it's the five
functions of the nist cybersecurity
framework identify
protect detect respond and recover
when we bring these two dimensions into
a 5x5 grid
we get what i call the cyber defense
matrix
and the cyber defense matrix provides a
50 000 foot strategic view of the entire
cyber security landscape it provides a
view that helps us understand where we
might have gaps in our program where we
need to go
where some of the where our capabilities
fall
all the things that we need to do to run
a mature and robust cyber security
program
what you also see on the bottom is
something that
i've conjecture or assert
depicts the degree of dependency that we
have on people process and technology as
we go across the five functions of the
net cybersecurity framework
so
when it comes to the functions of
identify and protect we should largely
rely upon technology to do the work
there as we move to detect respond and
recover what i have found is that
despite whatever technologies that come
our way we still have a very
we're heavily dependent upon
people to do a lot of the work on the
right side of boom boom by the way is
between protect and detect and on the
right side of boom it tends to be that
we need people to do a lot of the work
there
throughout all five functions we have a
equal amount of dependence on process
meaning we always have a need for
process throughout
all of five functions it's not something
that we should disregard
so
to be able to test the cyber defense
matrix then i would want to take all
those buzzwords that we saw previously
and see whether or not i could find a
home for each one of these buzzwords
right and for uh for the most part i was
able to do that i was able to take a lot
of those buzzwords and fit them in
and in doing so i can see for example
what the buzzwords mean
in relation to the function and the
asset class where it's trying to perform
some security function it also allows me
to see adjacencies it lets me see gaps
as well potentially in the marketplace
now just because there's a word in
[Music]
one of these boxes doesn't necessarily
mean that all the the individual
functions within
[Music]
the five functions of the subsequent
framework are actually being performed
so
again it's a 50 000 foot view and as you
get lower into the 25 000 and ten
thousand and five thousand for view
um as you see more granularity and start
seeing more tactical view of the
landscape uh we'll see more gaps emerge
just because uh there's only so much you
can see
at this sort of scale
now the cyber defense matrix
i wanted to find an easy way to put it
into practice or help people put it into
practice so i came up with an approach
that i call the stack
and the stack uh
is
i use
a food analogy when describing the stack
because well we all have to eat food so
hopefully it's something that everyone
can relate to
the stack uses the cyber defense matrix
as a foundation
and then we what we are going to do is
to
to map various layers
and these layers consist of different
parts of how we
make food okay so the first layer is a
recipe
these are proven practices these are
frameworks these are
architectures that we have to abide by
and this represents the things that we
have to do
the kind of requirements that we have to
meet to to have a robust cybersecurity
environment
the next layer is our pantry basically
what do you have today in your existing
portfolio capabilities that can help
secure your environment
the third layer is the market so what
can you find in the grocery store what
can what's available from vendors to
help you
meet to to
fulfill the recipe that you're trying to
try to make
now we can't
not everyone can eat every kind of food
likewise within a business
not everyone can
adhere to all the security controls that
we want to
implement
so we have to somehow capture business
constraints and exceptions and things
that will cause impact to the business
and so these allergies is something that
we also want to capture in the matrix as
well
and then lastly we want to capture
nutritional needs and this represents
the risks that we see in our environment
the attack surfaces the threats the
vulnerabilities that uh
can potentially harm us
and the combination of these then is
what i call the stack
what we're going to do is to
map each of these different layers to
the cyber defense matrix and i'll show
you how we might go about doing that
in doing so we should be able to answer
these three questions
how secure are we
and to answer that question we would
look at our existing capabilities
next how secure should we be and here
we're looking at proven practices plus
the risks that we have to address
and then lastly how do we get there and
for this we're going to look at what's
available in the market plus be mindful
of the constraints that we have to deal
with
and my hope is that we can take this
approach
i've used this approach for enterprise
security but my hope is that we can use
a similar type of approach to help us
address some of the challenges that we
see in healthcare
so first
let's look at our pantry
now if you're trying to do enterprise
security there's a lot of capabilities
that are at our disposal
unfortunately though i think when it
comes to healthcare many of those
capabilities don't exist and so
we
have to be mindful that our pantry may
be a little bit more thin for healthcare
and and also just understanding what's
available for the enterprise security
market gives us a template if you will
to say hey why why don't we have some of
these capabilities for healthcare let's
find investment to be able to build some
of these capabilities out
so capturing the existing capabilities
um that's that's a representation of how
secure we are
let's now move to the proven practices
one of the ways that
proven practices are articulated is
through the cis controls
as a version seven actually they already
map directly to the cyber defense matrix
so if you look at version seven and the
more recently released version eight
you'll see that there's actually already
a mapping to the cyber defense matrix
i'm not a healthcare expert and
i haven't worked in healthcare before
but
i'm not sure to what degree the cis
controls can apply to
healthcare environments but i suspect
that a good amount of it can overlap or
can be applied
in those environments so um but
nonetheless i think it's important to
recognize that not everything is going
to fit exactly but
the cis controls at least is a starting
point to be able to say here are
controls that we we can implement but
not only that here's a here's a set of
controls that we can implement in a
certain priority order so
we should do number one first before we
do number two number two before we do
number three and so on so forth
um so anyway the cis controls provides
an example of how we take this notion of
recipes and map it directly to the cyber
defense matrix again the
cis has already mapped it to the matrix
so the work's already been done for you
and this gives you a sense of the
controls that you would need to
implement for each of these boxes as
well as the priority order that you
would follow
so we've captured existing capabilities
we've captured proven practices
and to be able to answer the rest of the
question on how secure we should be
let's also look at risks
and to that end the cyber defense matrix
provides a a way that we can actually
visualize
um our risk and attack surfaces and
vulnerabilities and so on and so forth
so here's an example of how we can look
at attack surfaces
if i look at a traditional three three
tier web application there's a lot that
i need to secure i need to secure the
server i need to secure the application
i need to secure the network i still
need to secure the data
and when we consider
all that i need to secure and the attack
surface is associated with it
we can see that there's a lot of
controls that are needed
compare that to let's say a serverless
function
where
i can remove much of my attack surface
or at least transition the risks
associated with that to the provider
that's providing this ribulous function
but ultimately it gives me a visual
depiction of
of a path that i want to encourage
others to take which is i want to move
from uh this traditional 3d architecture
to one that actually has a reduced
attack surface and the reduced attack
surface is something that gives us an
opportunity to be more secure because
we're building on
more defensible infrastructure that has
fewer attack surfaces
just being able to visualize this i
think is a powerful
way to
help
our partners and stakeholders move to
more defensible infrastructure overall
and it allows us to understand again
what controls can be maybe needed to be
able to address some of the risks that
we see
another mapping that i'm sure you guys
are another
mechanism another tool that i'm sure
many of you all familiar with is the
miter attack framework that
characterizes a lot of the ttps that we
see attackers
following
and if we look closely at the mitre
attack framework
you'll see that there's also
specific asset classes that are
represented in the ttps so not
everything
or many of the ttps that you see in the
mitre attack framework tend to be device
oriented attacking things like your
workstation and windows and so on and so
forth
but there are other ttps in the attack
framework that map to an attack against
an application or attack against a
network or data or users
within each of the ttps there's also
additional information in terms of
how would you find these attacks how
would you know that an attack occurred
or one of these ttps
were used and so it captures information
like what data sources you need it also
captures information on what protective
mitigations you might want to put in
place and if you're not familiar with
the cyber analytic repository or car
car that mitre that org
it also provides the analytic approach
or method the logic to be able to look
for these attacks within one's
environment
and what i've done here is to be able to
just map each of those different types
of information to the different asset
classes that are within the cyber
defense matrix
so
that maps
the
the attack surfaces and the risks that
we see in our environment
and to be able to characterize how
secure we should be
lastly we want to understand how do we
get there
and to that to that end let's look at
market capabilities so what sort of
vendors are out there
now i i tried to do my best here to
find
vendors that are specialized towards the
healthcare market
and it seemed relatively small
now
again i don't know the mint market as
well um and so if i make a mistake here
or if i left somebody up you know please
forgive me i'm not endorsing any of
these vendors in fact the ones that you
see here are really based on how easily
i could find their logo so um uh yeah
i'm sure i'm missing plenty of vendors
out there
and the mapping itself again
is based on what i could dissect in the
marketing language that i see in the
vendor website but nonetheless i think
overall you can still see that there's
interesting concentrations and gaps as
well uh and some interesting conver
concentrations in that there's a ton of
companies that are helping to identify
uh the presence of medical devices but a
lot of the other places are a bit weaker
in terms of uh being able to uh perform
the various functions that you see in
the in the
in the separate defense matrix by the
way uh also if there's plenty of vendors
who will come to me and say hey no i do
x y and z
there's a distinction that i want to
make between i do something versus i
support something so
there are capabilities where
a particular vendor will definitively do
something
associated with let's say identifying
devices but oftentimes they may not
necessarily protect them rather they
will enable something else to protect
that device
and so it requires a bit of
synthesizing or just dissecting the
wording of the um
the marketing details
but that that's an important facet of
understanding how to use this matrix
properly to understand the primary
function of a
particular vendor product and a
secondary one the secondary one
or a second order function tends to
require another first order capability
to be in place and that's something that
the cyber defense matrix also helps us
understand and navigate as well
so that's the market capabilities
and then
lastly we want to understand constraints
and to that end
um
if we had our own way we could pro if
security folks could have our own way we
might want to actually implement i think
we may want to implement all these
controls that we have available to us
but
that may not necessarily be the most
wise or cost efficient
a lot of people look at the cyber
defense matrix as a bingo card
you can see why that's the case
but our goal in security isn't always to
play blackout
we we don't necessarily need to
check all the boxes on here what we want
to be able to do is to be able to
declare bingo
by
filling in just enough boxes that
satisfy satisfies our risk tolerance for
them for the environment
and oftentimes
some of these boxes we may not be able
to check because they
create some sort of business impact
there's some sort of allergy associated
with
implementing a certain control here or
there
to be able to capture that uh
systematically the cyber defense matrix
again provides a great organizing
framework to be able to
see
what controls
we have but also where we have
where we need to consider
the the business impact that may come
from implementing a certain set of
controls
in certain environments we may have no
constraints at all so for example in a
call center
we can implement whatever controls we
want but again like i said we may not
want to because
it's expensive and for for the
particular environment that we're
dealing with
we may be willing to accept some degree
of risk um and not have to implement
every possible control that even even if
we could implement every possible
control uh it just may not be cost
effective based on the
risk exposure that we might have
in other cases
we may not be able to
implement a sufficient amount of
security controls because it creates a
business some some degree of business
impact and ultimately what we want to be
able to do is to uh have a systematic
mechanism where we can capture
those conflicts those uh trade-offs this
risk those risk management tradeoffs
where we're saying
uh we're willing to
to forego a certain set of security
controls even though we want to
uh implement them or need to implement
them because it's going to create some
business impact or alternatively uh when
we implement a certain set of security
controls that does create business
impact at least we're knowing we're
doing it knowing that it's going to
create some business impact and we've
negotiated that and discussed that with
other stakeholders where they're willing
to accept that business impact as well
an example of this in the financial
services environment would be something
like uh
high-speed trading so
um
high-speed trading if you put a firewall
in there you might as well close
business because um
it's all predicated on being able to get
information very quickly and so uh we
may have a security requirement to put a
firewall in place but we we know that
that's going to create some
significant business impact and so we
forego the use of the firewall but there
may be other compensating controls or
other mitigating controls what we want
to be able to do systematically as a
community is to be able to capture these
constraints for these different types of
user environments or different types of
business environments and be able to say
okay consider
uh there are alternative design patterns
that helps us still increase the
security posture or address the security
challenges that we might have for that
particular environment without creating
business impact i'm sure that um you
and pretty much every organization you
have some sort of sales and marketing
team where you have some set of
developers or analysts um
we oftentimes are recreating the wheel
every time as we learn how to work
within these environments by creating a
set of controls
without creating distance impact the the
this understanding and this this
these design patterns that we come up
with
what i'm hoping we can do with the cyber
defense matrix is to find a way to
to
consistently capture in these design
patterns and these things that we learn
so that we don't have to always keep
recreating it and also be able to
improve upon it over time as well
so now i've mapped each of these layers
to the cyber defense matrix
and in doing so we can now see how each
of these layers can help us answer the
question of how secure are we
how secure should we be and how do we
get there
and what we want to do is to then
combine these five layers
and in doing so
we can actually understand our overall
decision space and the range of risk
management options that we have in front
of us
so
in combining these we can then say there
are a couple areas for example um right
here
where
it may be just table stakes adjust to it
sort of opportunity so in this
particular situation right here we have
a
proven practice that we know we should
implement
there are commercial capabilities
available
there's an active
risk issue that's here but we just don't
have any existing capabilities and
there's no business constraints that
limit our ability to implement a control
so that will be a situation where we
could just do it there's no nothing
really stopping us
conversely
let's look at this situation over here
where uh it's a similar sort of
circumstance
with a proven practice with commercial
capabilities available with
an active risk here as well but there is
a mission constraint or some business
constraint and so in those situations
what we want to be able to do is to
recognize that
that there is some business impact that
may occur if you implement some control
um but ultimately it's a discussion that
we need to have with the business to say
do we want to
address this issue
do we want to forego it and accept the
risk associated with it are there other
opportunities to mitigate that control
by putting in controls elsewhere
all right
now um
what i've showed you is
the uh these five layers uh is a
starting point for how i look at uh
using the cyber defense matrix but we
can go beyond even in capturing
additional information that
helps us
further develop and mature our security
program so think of the initial
five things that we talked about before
as
creating the food right
now it's a question of how good does it
taste
or
how cost effective is it
and so what we want to be able to do is
capture measurements here
as i mentioned earlier the cyber defense
matrix is a great organizing construct
and we can organize lots of interesting
information
into the matrix here and so here's an
example of how we can
organize for example the the metrics and
measurements that we have associated
with our program as well as how much
we're spending
associated with each of the different
buckets or each of the different
capabilities that we see in the cyber
defense matrix what i'm showing here is
just a range of different things that we
could potentially capture and organize
into the cyber defense matrix
measurement is a really hard challenge
for many of us
and i would offer there's a couple
different levels of measurement that we
can use to
to capture to understand our security
program and then subsequently be able to
capture it
some of the measurements are easier some
of them are harder um
easier ones are going to be just do we
even have the capability at all that we
have a firewall for example
um it's like saying that we have a
vaccine
the next level will be
is the firewall turned on okay has has
we have we actually opened the vaccine
vial
the next one would be um
are we actually turning on the features
associated with the firewall so
number two can be yes we have a firewall
but it's just it hasn't any any rule uh
number three would be we've actually put
in specific acls into the firewall
and number four is well okay great you
have a firewall you have some product
you have some capability how well does
it actually work in in dealing with the
threats that we see
and then lastly
um is a cost uh
we
introduce cost which is ultimately
how cost effective is it uh relative to
the security benefit that we're getting
each of these different
there's again different levels of
difficulty in getting these values
and i don't expect any organization to
have all these values but we oftentimes
have some of these values but don't
really have a great home for it and what
i will propose is that the cyber defense
matrix at least provides us a place to
organize this information put it in a
place where we can see it relative to
other bits of information and just be
able to methodically uh improve upon
uh what we already have today once it's
organized in this fashion
now the cyber defense matrix um
i've just showed you really just a small
handful of
use cases
my original use case as i mentioned was
just a map then there's
but back in 2016 i showed a whole bunch
of other use cases
which i'm not really presenting here but
if you wanted to dig further into some
of these feel free to look at the link
here and you'll see some of the use
cases that
that i presented then
and in 2019 i gave an update to that as
well with a ton of other use cases
at this point in time i have roughly
about 50 some use cases
which
will take me too long to go through in
this session but nonetheless it's a rich
it's a very
interesting framework that we can use to
understand our space better and to be
able to find ways that we can
improve the security posture of our of
our environment as i mentioned i use
this at the bank of america i've used it
since then to be able to understand the
space better and to
create new use cases i think it has a
lot of applicability for health care
especially since um where some of the
problems that we're seeing
in healthcare we've already addressed in
the enterprise security space the
enterprise security space in fact
provides a template for what the
healthcare
side needs to also address as well so
why not use what we learned and the
structures and the
approaches and
understand how that can be used to help
guide investment and areas for
investigation
and with that
if you have any additional questions or
want to get additional information about
the cyber defense matrix here's how to
contact me and i hope that
you find the cyber defense matrix useful
if you have any use cases that you come
up with or you wanted to offer any
feedback on what you saw please please
feel free to reach out and thank you
very much