I-Corps: Innovation Corps Training for NPView Network Security Leadership

拟议的小组开发了一个解决组织网络安全问题的工具，以确保这些系统不仅符合现行法规，而且领先于对抗性技术。根本的创新是将联合收割机网络防火墙分析与最先进的网络建模技术相结合，以便提取和查询有关组织网络的完整连接图的知识，以验证安全策略的实施。由于应用程序和设备的多样性、通信的异构性以及对手的动机和资源，IT基础设施很难得到保护。电力行业已经通过强制所有大型电力公司遵守关键基础设施保护法规来应对这一问题。每年，由于在审计期间发现其网络安全存在违规行为，一些公用事业公司每天都会收到高达100万美元的罚款。该提案提出了NP-View工具的商业化项目，该软件应用程序旨在支持公用事业和审计人员评估网络是否安全并符合政府NERC/CIP法规。NP-View的核心是一种使用设备配置来创建虚拟网络表示的技术，该技术可以准确预测数据包如何穿越网络，并提供对给定网络安全策略的分析。网络合规人员和审计人员的好处包括对其资产安全性的更高信心，以及减少分析安全状况和优先考虑漏洞缓解所需的时间和资源。该工具的初始版本通过国土安全部（DHS）赞助的评估计划与来自电力公司和咨询公司的30名测试用户进行了测试。来自测试版用户和NERC审计员的反馈使团队相信该项目具有强大的商业机会，首先是在电力行业，其次是在更广泛的企业网络所有者市场。电力基础设施的中断迅速导致混乱局面，使人的生命处于危险之中。电网控制中心依赖于IT基础设施。通过有条不紊的IT安全保护、监控和响应来确保系统和网络的弹性至关重要。通过开发和传播自动验证技术，拟议的工作将对网络运营商和安全管理员实施正确规则集的能力产生影响，以使关键资产远离网络对手。对电力工业和整个社会的最终好处将是对一种重要资源的安全性的有意义的改善。

The proposed team has developed a tool that addresses the security of organizations' networks to ensure that those systems are not only compliant with current regulations but also ahead of adversarial techniques. The fundamental innovation is to combine network firewall analysis with state-of-the-art network modeling techniques so that knowledge about the complete connectivity map of an organization's network can be extracted and queried in order to verify the implementation of a security policy. IT infrastructures are difficult to protect given the variety of applications and devices, the heterogeneity of communications, and the motivation and resources of adversaries. The power industry has responded to this problem by mandating critical infrastructure protection regulations to be followed by all large electric utilities. Every year, several utilities receive penalties of up to $1,000,000 a day because of violations found in the security of their networks during audits. This proposal presents a commercialization project for the NP-View tool, a software application designed to support utilities and auditors in assessing whether networks are secure and in compliance with government NERC/CIP regulations. At the core of NP-View is a technology that uses device configurations to create a virtual network representation that accurately predicts how packets traverse networks and provides analysis of a given network security policy. The benefits for network compliance officers and auditors include higher confidence in their asset security, as well as reduced amounts of time and resources needed to analyze security posture and prioritize vulnerability mitigations. An initial version of the tool was tested with 30 beta users from electric utilities and consultant businesses through an evaluation program sponsored by the Department of Homeland Security (DHS). Feedback from beta users and from NERC auditors led the team to believe in a strong commercial opportunity for this project, first in the power industry, and secondly in the broader market of enterprise network owners. Disruptions of power infrastructures quickly lead to chaotic situations in which human lives are put at risk. Power grid control centers are reliant on IT infrastructures. It is critical to ensure the resiliency of systems and networks through methodical IT security protection, monitoring, and response. Through development and dissemination of automated verification technologies, the proposed work will have an impact on the ability of network operators and security administrators to implement the correct set of rules to keep critical assets out of the reach of cyber adversaries. The ultimate benefit to the power industry and to society at large will be meaningful improvement of the security of an important resource.