Red Teaming and Energy Grid Security
Download as PPTX, PDF3 likes1,374 views
The document outlines the concept and application of red teaming for enhancing energy grid security, presented by Mike Frederick at the 10th Annual EnergySec Summit. It highlights the need for adversarial assessment and the benefits of red cell methodologies in identifying and mitigating potential threats to the energy infrastructure. Various case studies and historical examples illustrate the importance of red teaming in recognizing and responding to vulnerabilities within the system.
Red Teaming and Energy Grid Security
- 1. Red Teaming and Energy Grid Security SC PUBLIC SERVICE AUTHORITY LAW ENFORCEMENT DIVISION 10th Annual EnergySec Summit 21 AUG 2014 Austin, TX Presented by Mike Frederick
- 4. How does kidney theft relate to securing the American energy grid?!
- 5. We Su©k at Processing Info J FKFB INAT OUP SNA SAI RS
- 6. We Su©k at Processing Info JFK FBI NATO UPS NASA IRS
- 7. What Is Red Teaming... ...and What It IS NOT.
- 8. Overview RED CELL Introduction to Red Cell concepts Benefits & Capabilities Limitations & Drawbacks Red Teaming and the American Energy Grid Case Studies & Examples Methodology
- 9. The Concept • Assessment of Threats, Plans, Operations, or Adversaries • Viewed from the Adversarial Perspective (Alternative Assessment) • Structured, Iterative Process • Trained Team Members • Independent • Continuous
- 10. “The firmly inculcated doctrine that an admiral’s opinion was more likely to be right than a captain’s, and a captain’s more than a commander’s, did not hold good when questions entirely novel in character, requiring keen and bold minds unhampered by long routine, were under debate.” -Winston Churchill “To kill an error is as good a service as, and sometimes even better than, the establishing of a new truth or fact.” -Charles Darwin “We do not believe any group of men adequate enough or wise enough to operate without scrutiny or without criticism. We know that the only way to avoid error is to detect it, and that the only way to detect it is to be free to inquire. We know that in secrecy error undetected will flourish and subvert.” -J. Robert Oppenheimer
- 11. Security Posture Extremes GROUND TRUTH / REALITY
- 12. Red Cell History Richard “Dick” Marcinko, CDR, USN (ret)
- 13. Red Cell History • Military OPFOR / Red Teams • “Tiger Teams” (1964) • Navy’s “Red Cell” • Cyber Pen-testing • DARPA / NSCT • Spread into many gov’t and corporate organizations...
- 14. Related Concepts • Threat Assessment • Complicated vs. Complex • Asking the right questions • OODA Loops, Contextual Awareness, and Information Speed
- 16. OODA Loops in the NFL
- 18. Red Cell Types Full physical attack simulation on PREPARED target. LEVEL 1 RED CELL LEVEL 2 RED CELL Social engineering, limited penetration testing, etc. Tabletop (intellectual) exercise only. LEVEL 3 RED CELL A C T I V E P A S S I V E
- 19. Why Red Cell? • Black Swans (hedge against “5σ” surprise) • Complacency Killer • Breaks Silos • Teaches institutional recognition of suspicious behavior • Teaches institutional recognition of flawed thinking and constructs • “Sense Making” – Collective application of individual intuition to identify changes in patterns (or new patterns)
- 20. Why Not? • Situational / Conditional Issues - Scenario Problems; Poor Exercise Design • Organizational Issues - Team Relation; Political Restraints; Misunderstanding Results
- 21. What Red Cells Can’t Do • Detect every Black Swan (never enough info to predict all possible scenarios) • No “checklist” can replace logical thought • Only one way to confirm enemy intentions (wait for the attack) • Serve as fault-finding expedition
- 22. Red Cell Methodology What do our adversaries want? How will they try to achieve their goals? How do we stop them?
- 23. ID/Train Participants EXERCISE Document/evaluate results IMPROVEMENTS Red Cell = Cycles, not Steps
- 24. Red Cell Guidelines • Access to background information • Subject matter experts • Adhere to protocol / decision making system • Think creatively (requires effort) • Don’t obsess on failure (past, present, or anticipated) • Work the problems (don’t let them work you)
- 25. Assessment Techniques • Pre-mortem • Red Cell / Physical Pen testing • SWOT • WRAP • Dilbert?! Six Filters… • A Team / B Team • Argument Deconstruction • Contrarian Analysis • Devil’s Advocacy • Occam’s Razor “What would have to be true to allow or make this happen?”
- 26. Red Teamer Skill Levels • APPRENTICE: Can think like the attacker. • JOURNEYMAN: Can think like the attacker and defender. • MASTER: Able to think like the attacker and defender thinking about each other. Hire an apprentice to model an unsophisticated adversary; a journeyman to model a sophisticated one. Hire masters to model the entire system...
- 27. Mumbai, India 2008 • 26 NOV 2008 • 11 Coordinated assaults • Low-tech (“guys with guns”) • Porous border Low-Tech Coordinated Assault
- 28. Low-Tech Coordinated Assaults Against US? • 30 Operatives (minimal training) • Porous border? Docs? • $75,000 for housing, rifles, ammo • Pre-raid surveillance / planning • Phase I – Malls • Phase II – Grocery Stores / Wal-Marts • Phase III – Elementary Schools • Phase IV – Houses of Worship • Results? Retail, food shopping, culture, and education systems?
- 29. Low-Tech Coordinated Assaults Against US? Beltway Snipers (3 weeks – OCT 2002) John Allen Muhammad and Lee Boyd Malvo
- 30. Beslan School 1 – 3 SEP 2004 ~1100 hostages (~775 kids) ~334 killed (including 186 children)
- 31. Dam Sabotage
- 32. Insider Threats (not new) • WWII B-17 “Tondelayo” (as related in “The Fall of Fortresses” by Elmer Bendiner) • Bomb run over Kassell, Germany • Piloted by Bohn Fawkes; story told by Bendiner • Eleven 20mm explosive shells in aircraft...
- 34. The general who attempts to protect everything, protects nothing.
- 35. Those generals who have had but little experience attempt to protect every point, while those who are better acquainted with their profession, having only the capital object in view, guard against a decisive blow, and acquiesce in small misfortunes to avoid greater. Frederick the Great
- 36. Santee Cooper Red Cell
- 37. So, what? A newspaper is better than a magazine. A seashore is a better place than the street. At first it is better to run than to walk. You may have to try several times. It takes some skill, but it is easy to learn. Even young children can enjoy it. Once successful, complications are minimal. Birds seldom get too close. Rain, however, soaks in very fast. Too many people doing the same thing can cause problems. One needs lots of room. If there are no complications, it can be very peaceful. A rock will serve as an anchor. If things break loose from it, however, you will not get a second chance.
- 38. Red Teaming and Energy Grid Security SC PUBLIC SERVICE AUTHORITY LAW ENFORCEMENT DIVISION QUESTIONS? Presented by Mike Frederick