I-Corps: Innovation Corps Training for NPView Network Security Leadership

拟议的小组开发了一种解决各组织网络安全问题的工具，以确保这些系统不仅符合现行条例，而且领先于对抗性技术。基本的创新是将网络防火墙分析与最先进的网络建模技术相结合，以便提取和查询有关组织网络的完整连接图的知识，以便验证安全策略的实施。考虑到应用程序和设备的多样性、通信的异构性以及对手的动机和资源，IT基础设施很难保护。电力行业对这个问题的回应是，要求所有大型电力公用事业公司遵守关键基础设施保护法规。每年，几家公用事业公司都会因为在审计期间发现其网络安全存在违规行为而受到每天高达100万美元的罚款。本提案提出了NP-View工具的商业化项目，该工具是一种软件应用程序，旨在支持公用事业公司和审计员评估网络是否安全并符合政府的NERC/CIP法规。NP-View的核心是一种技术，它使用设备配置来创建虚拟网络表示，该表示准确地预测数据包如何通过网络并提供对给定网络安全策略的分析。对网络合规官和审计人员的好处包括对其资产安全的更高信心，以及减少分析安全态势和确定漏洞缓解优先顺序所需的时间和资源。该工具的初始版本通过国土安全部(DHS)赞助的评估计划，在30名来自电力公用事业公司和咨询公司的Beta用户中进行了测试。测试版用户和NERC审计员的反馈使团队相信该项目有很大的商业机会，首先是在电力行业，其次是在更广泛的企业网络所有者市场。电力基础设施的中断很快导致混乱的局势，使人的生命处于危险之中。电网控制中心依赖于IT基础设施。通过有条不紊的IT安全保护、监控和响应来确保系统和网络的弹性至关重要。通过开发和传播自动核查技术，拟议的工作将对网络运营商和安全管理员执行一套正确的规则，使关键资产不被网络对手触及的能力产生影响。对电力行业和整个社会的最终好处将是有意义地改善这一重要资源的安全性。

The proposed team has developed a tool that addresses the security of organizations' networks to ensure that those systems are not only compliant with current regulations but also ahead of adversarial techniques. The fundamental innovation is to combine network firewall analysis with state-of-the-art network modeling techniques so that knowledge about the complete connectivity map of an organization's network can be extracted and queried in order to verify the implementation of a security policy. IT infrastructures are difficult to protect given the variety of applications and devices, the heterogeneity of communications, and the motivation and resources of adversaries. The power industry has responded to this problem by mandating critical infrastructure protection regulations to be followed by all large electric utilities. Every year, several utilities receive penalties of up to $1,000,000 a day because of violations found in the security of their networks during audits. This proposal presents a commercialization project for the NP-View tool, a software application designed to support utilities and auditors in assessing whether networks are secure and in compliance with government NERC/CIP regulations. At the core of NP-View is a technology that uses device configurations to create a virtual network representation that accurately predicts how packets traverse networks and provides analysis of a given network security policy. The benefits for network compliance officers and auditors include higher confidence in their asset security, as well as reduced amounts of time and resources needed to analyze security posture and prioritize vulnerability mitigations. An initial version of the tool was tested with 30 beta users from electric utilities and consultant businesses through an evaluation program sponsored by the Department of Homeland Security (DHS). Feedback from beta users and from NERC auditors led the team to believe in a strong commercial opportunity for this project, first in the power industry, and secondly in the broader market of enterprise network owners. Disruptions of power infrastructures quickly lead to chaotic situations in which human lives are put at risk. Power grid control centers are reliant on IT infrastructures. It is critical to ensure the resiliency of systems and networks through methodical IT security protection, monitoring, and response. Through development and dissemination of automated verification technologies, the proposed work will have an impact on the ability of network operators and security administrators to implement the correct set of rules to keep critical assets out of the reach of cyber adversaries. The ultimate benefit to the power industry and to society at large will be meaningful improvement of the security of an important resource.