Cyberphysical Security
Our innovative security mechanics detect, diagnose and prevent attacks on cyber-physical Internet of Things (IoT) components.
Internet of Things (IoT) systems are comprised of networked components that connect the physical and digital worlds, such as sensors, actuators, controllers, and computing devices. Much of todayās critical infrastructure depends on this technology. Smart power grids, nuclear power plants, military command centers, smart city installations, transportation systems, smart homes, and smart offices belong to this category.
These systems were initially designed to be functional, reliable, and interoperable across different manufacturers and standards. Security was an afterthought. As a result, these systems present a rich āattack surface,ā or group of exposed vulnerabilities that can be exploited in a security attack. The potential consequences of a security attack are not just limited to data breaches or lost productivity ā human lives may be at risk.
Our mission is to develop innovative security mechanisms to detect, diagnose, and prevent attacks on cyber-physical systems. Our researchers approach this challenge from multiple perspectives, ranging from cryptographic protocols and novel designs of networking and distributed systems to adversarial machine learning algorithms and model-based reasoning.
SCIBORGā¢
Reducing network attack risks while maximizing business opportunity
The Challenge
Network complexity makes it difficult to optimize a secure configuration without hampering business productivity
- Complexity leads to vulnerability: As networked ecosystems become larger, more complex, and increasingly cloud-based, there are more opportunities for misconfiguration, leading to vulnerabilities and potential data breaches. Systems can easily become so complex that humans are unable to process and evaluate all the data, components, dependencies, relationships, privileges, exceptions, connected systems, devices, and circumstances that can make a system vulnerable. Unmanageable system complexity leads to more paths for attackers to exploit.
- Endless, Laborious Fixes: Prioritizing, tracking and documenting vulnerabilities is laborious, and attack path evaluation may occur infrequently. Some companies only do what is necessary to meet minimum compliance requirements.
- Current tools fall short: Many organizations use attack prevention and detection tools, which emphasize security but do not optimize network configuration. And network configuration tools emphasize efficiency, but not necessarily security.
The bottom line: Organizations struggle to securely configure their systems, many of which are complex and involve many components, without sacrificing business functionality.
Us: When you implement a remediation instruction from your security tool, how do you know that you havenāt impacted something else in the network?
Customer CISO: Thatās the problem.
The SCIBORG Solution:
SCIBORG (Secure Configuration for the IoT Based on Optimization and Reasoning on Graphs) serves as a āconfiguration recommendation engineā, providing the best configuration for an organizationās entire system of systems, given the unique requirements and landscape. It provides actionable recommendations, prioritizing business requirements from the start so that an organization can be secure AND maintain business functionality.
- Graph-based solution enables emphasis on relationships, dependencies, systems of systems
- Allows you to focus on managing your business requirements
- Ability to run scenarios: See what the effect will be elsewhere in the network if the user makes a recommended change
- Can reduce manual effort and risk of human error
- Offers actionable recommendations tailored to the organization
- Potential to be real-time/continuous ā important since inventory, business requirements, and vulnerabilities are all in a constant state of change
- Differentiation and accuracy due to use of multiple metrics in solver/reasoner (probability/likelihood, utility, impact valueā¦)
- Flexibility for the user to define/adjust utility, and change the relative weights of variables ā may help to address future types of attacks
- Ability to extend to consider additional variables (e.g. age of a vulnerability)
āGiven an initial or default configuration, SCIBORG tells a system operator which configuration parameter values should be changed, what the new values should be, why those changes should be made, and what security gains are made as a result.ā Shantanu Rane, project PI
| Use Cases: | Tested On: |
| Networked devices | Home IoT |
| Industrial IoT | Industrial IoT |
| Multi-cloud systems | Satellite Systems |
| Positive Train Control | |
| Windows Active Directory |
Accolades
- 2 Best Paper Awards
- $4.5M Funding (DARPA and Xerox)
- 12 Filed patents
SCIBORG Bibliography:
- Securing Distributed System Configuration through Optimization and Reasoning on Graphs (NDSS 2019 Poster)
- SCIBORG: Secure Configurations for the IoT Based on Optimization and Reasoning on Graphs (IEEE CNS 2020, Best Paper)
- Vulnerability Metrics for Graph-based Configuration Security (SECRYPT 2021)
- Mason Vulnerability Scoring Framework: a Customizable Framework for Scoring Common Vulnerabilities and Weaknesses (SECRYPT 2022, Best Paper)
- An Attack Volume Metric (Wiley Security & Privacy, 2022) – Accepted, to be published