97
Innovation Network event 1 October 2015

AM Briefing: Security for the internet of things

Embed Size (px)

Citation preview

Page 1: AM Briefing: Security for the internet of things

Innovation Network event 1 October 2015

Page 2: AM Briefing: Security for the internet of things

Innovation Network event 1 October 2015

Page 3: AM Briefing: Security for the internet of things

Jim Pennycook

CDE Head of Operations

Page 4: AM Briefing: Security for the internet of things

Military capability

Advantage

Persistent

Page 5: AM Briefing: Security for the internet of things

The aim of CDE

Page 6: AM Briefing: Security for the internet of things

Rapid technology change

Defence

Other markets

Utilisation

Page 7: AM Briefing: Security for the internet of things

CDE Evolution

Years

Page 8: AM Briefing: Security for the internet of things

CDE directive

Prove the value of innovative,

high-risk, high-potential-benefit

research to enable

development of cost-effective

military capability advantage

Defence White Paper – National Security Through Technology Feb 2012

Page 9: AM Briefing: Security for the internet of things

Defence and security

Page 10: AM Briefing: Security for the internet of things

First point of contact

‘CDE remains our first point of

contact for those who wish to

submit a research idea to the

MOD.’

Defence White Paper – National Security Through Technology Feb 2012

Page 11: AM Briefing: Security for the internet of things

Support to SMEs

Page 12: AM Briefing: Security for the internet of things

Routes to market

Page 13: AM Briefing: Security for the internet of things

CDE operating principles

Page 14: AM Briefing: Security for the internet of things

Engage with innovators

Page 15: AM Briefing: Security for the internet of things

Funded opportunities

Page 16: AM Briefing: Security for the internet of things

Participation costs

Page 17: AM Briefing: Security for the internet of things

Risk

Page 18: AM Briefing: Security for the internet of things

Intellectual property

Page 19: AM Briefing: Security for the internet of things

Compliance

Regulated

Transparent

Auditable

Page 20: AM Briefing: Security for the internet of things

Managing innovation

Proof of concept

Development

Innovation Future capability

CDE MOD + investors

Page 21: AM Briefing: Security for the internet of things

CDE competition space

Page 22: AM Briefing: Security for the internet of things

Technology innovation lifecycle

Original idea Capability

Page 23: AM Briefing: Security for the internet of things

Technology innovation lifecycle

Uptake /

commercialisation Pre-commercial

development

TRL 1 TRL 2 TRL 3 TRL 4 TRL 5 TRL 6 TRL 7 TRL8 TRL 9

Experimental

research

Technology

implementation Applied research

Curiosity

driven

research

Page 24: AM Briefing: Security for the internet of things

CDE competition space

Pre-commercial development

TRL 3 TRL 4 TRL 5 TRL 6

Applied research

Solution exploration Prototyping/test products

Phase 1 Phase 2

Page 25: AM Briefing: Security for the internet of things

Phase 1

TRL 7

TRL 2

CDE competition space

Pre Commercial Development

Solution exploration Prototyping/test products

Phase 2

TRL 3

TRL 4

TRL 5

TRL 6

Page 26: AM Briefing: Security for the internet of things

Two routes to funding

Enduring

Themed

Not classified

Enduring

competition

Themed

competition

£ 7M

Page 27: AM Briefing: Security for the internet of things

Enduring competition

Page 28: AM Briefing: Security for the internet of things

Enduring challenges

Framework

Page 29: AM Briefing: Security for the internet of things

Challenge framework

Protection Lethality

Human performance

Mobility

Situational awareness

Communication Data

Power

Lower cost of ownership

Page 30: AM Briefing: Security for the internet of things

Themed competition

Page 31: AM Briefing: Security for the internet of things

Competitions this year

Theme Value

Open-source big data insight £2.25M

Persistent surveillance from the air £2.25M

Agile, immersive training £2.25M

What's inside that building? £1.15M

Understand and interact with cyberspace £1.00M

Page 32: AM Briefing: Security for the internet of things

Current competitions

Theme Value

Security for the internet of things £2M

Autonomy and big data for defence £4M

Page 33: AM Briefing: Security for the internet of things

Online bid submission

Page 34: AM Briefing: Security for the internet of things

Portal upgrade

Page 35: AM Briefing: Security for the internet of things

How has CDE performed?

Page 36: AM Briefing: Security for the internet of things

CDE in numbers

5933 proposals received 57%

Page 37: AM Briefing: Security for the internet of things

CDE in numbers

17% of proposals funded

20% 13%

E T

Page 38: AM Briefing: Security for the internet of things

CDE in numbers

934 contracts placed 43%

Page 39: AM Briefing: Security for the internet of things

CDE in numbers

£57.9M invested

1 2 3 4 5 6 7 8

Page 40: AM Briefing: Security for the internet of things

What’s next for CDE?

Page 41: AM Briefing: Security for the internet of things

Innovation Network events

Page 42: AM Briefing: Security for the internet of things

Innovation Network events

Next event: 21 October 2015

Sign up to get updates

Page 43: AM Briefing: Security for the internet of things

www.gov.uk/dstl/cde

Page 44: AM Briefing: Security for the internet of things

A successful proposal

Page 45: AM Briefing: Security for the internet of things

A successful proposal

Page 46: AM Briefing: Security for the internet of things

Innovation Network event 1 October 2015

Page 47: AM Briefing: Security for the internet of things

The security challenges of the internet of things

1

Page 48: AM Briefing: Security for the internet of things

Relentless growth

2

Connected devices growth graphic by HP forecasting

Page 49: AM Briefing: Security for the internet of things

Government working online

3

Page 50: AM Briefing: Security for the internet of things

IoT vulnerabilities

4

Page 51: AM Briefing: Security for the internet of things

The challenge

5

There are a number of routes into the SIA, this campaign is just one:

The SIA invests well over £10m per year in research and innovation through industry and

academic partnerships

The SIA must cast the net wide, from blue-sky thinking

to mature ideas, to tackle today’s

problems

Other innovation and research contract competitions

Through our Prime industry partners

Direct relationships

Page 52: AM Briefing: Security for the internet of things

External engagement

6

This is the 3rd SIA open competition to reach out to new suppliers.

Importantly, this competition is about building relationships,

20 new organisations now have an ongoing relationship with the SIA

2012 ‘Finding the Threat’, saw the

biggest response to a CDE

competition:

• 24 proposals funded at phase 1

• 9 projects taken to phase 2

• 3 projects successfully made it onto

the SIA business baseline

2014 ‘Secure Working in Insecure

Environments’ resulted in:

• 14 proposals funded at phase 1

• 5 projects taken to phase 2

• 2 projects hoped to make it onto the

SIA business baseline

Page 53: AM Briefing: Security for the internet of things

Innovation Network event 1 October 2015

Page 54: AM Briefing: Security for the internet of things

Encouraging innovation and the internet of things

future

55

Page 55: AM Briefing: Security for the internet of things

Innovation is hard

• “Innovation is hard because ‘solving problems people didn’t know they had’ and ‘building something no one needs’ look identical at first ” - Aaron Levie, CEO at Box

• “You can't solve a problem on the same level that it was created. You have to rise above it to the next level" - Albert Einstein

• Innovation in the national security area is even harder:

- tradition

- high cost of failure

- security culture

56

Page 56: AM Briefing: Security for the internet of things

But strong imperatives

• “My sharpest concern as Director General is the growing gap between the increasingly challenging threat and the decreasing availability of capabilities to address it” – Andrew Parker

• Move towards ubiquitous encryption

• Nimble adversaries

eg ISIL’s strategic use of social media

57

Page 57: AM Briefing: Security for the internet of things

Need to be outward looking

58

• Innovation relies on being receptive to ideas from outside

• In particular, we need to engage with non-traditional partners and this CDE competition is an important part of that

Page 58: AM Briefing: Security for the internet of things

Connected future

59

Page 59: AM Briefing: Security for the internet of things

Connected future

60

Page 60: AM Briefing: Security for the internet of things

The IoT’s significance

61

“The internet of things is a transformative development. We are on the brink of a new industrial revolution.

I want the UK to lead it.”

Page 61: AM Briefing: Security for the internet of things

Exciting capabilities

62

Smart cities Smart home Wearable tech

Smart parking saving time and cutting congestion

Neurio sensor capable of tracking and controlling the power of every device in a home

Tzukuri sunglasses capable of notifying an owner when they’ve left them behind

Page 62: AM Briefing: Security for the internet of things

Emerging risks

63

Smart cities Smart home Wearable tech

In increasingly computer-controlled cities, critical infrastructure has a growing vulnerability to cyberterrorism

Hacking smart home security systems can facilitate criminal entry

Perceived threat to pacemakers/ defibrilators

Page 64: AM Briefing: Security for the internet of things

Innovation Network event 1 October 2015

Page 65: AM Briefing: Security for the internet of things

Security for the internet of things

1

Page 66: AM Briefing: Security for the internet of things

To improve the security of devices and sensors, that connect to one or more

physical and/or virtual hubs, in either a critical infrastructure or consumer

environment

To know when this security has been threatened and the impact this may have

on the authenticity, integrity and availability of data

Solutions must demonstrate:

• how to manage the security of IoT devices

• how to manage the privacy of data collected by devices

While enabling the management of systems and the protection of privacy of the

data shared beyond the network, you should consider protocols that provide:

• authentication

• integrity

• availability supervisory control

Challenge 1: security of IoT devices

Page 67: AM Briefing: Security for the internet of things

Challenge 2: linking and understanding IoT data

To understand what’s happening from apparently unrelated data. How to gather

and visualize data from a diverse, sensor-rich, loosely connected environment

that operates across different protocols and standards

Demonstrate how, based on the data gathered, 2 or more events/users/devices

could be linked and how to indicate a level of confidence in that connection

Demonstrate how you might identify malicious activities from the behaviour

and/or performance of the network nodes themselves. Where wireless is used,

you should demonstrate the vulnerabilities it presents and how this can be made

more secure at the physical layer

Page 68: AM Briefing: Security for the internet of things

Challenge 2: linking and understanding IoT data

You should consider:

• gaps in dissecting and analyzing protocols

• how value can be brought from auditing IoT devices

• how data from IoT devices could enhance existing security, eg the presence of

an IoT device as an additional authentication factor, using sensor monitoring to

build patterns of life to inform security decisions

• how vulnerable to attack are the IoT devices in different markets, eg medical,

financial, automotive etc

• what value could be gained by attackers from IoT devices, eg payment details,

location

Page 69: AM Briefing: Security for the internet of things

What we want

We are looking for innovative proof-of-concept technology developments, at

technology readiness level (TRL) 3 to 4

Phase-1 project deliverables must be completed by 31 March 2016

A successful proposal will clearly demonstrate how the new techniques and

methods could provide a more comprehensive solution

Proposals should be for novel research and innovation that result in a

demonstration and have a realistic exploitation route. Solutions can either be

software or hardware

Page 70: AM Briefing: Security for the internet of things

What we don’t want

The SIA don’t want paper-based studies, consultancy work, proposals that aren’t

innovative, or demonstrations of mature technologies, ie TRL 6 and above

The SIA don’t want technologies that can only be used for gathering intelligence

Page 71: AM Briefing: Security for the internet of things

Gemma Moxham

Competition Manager

Page 72: AM Briefing: Security for the internet of things

Security for

the internet of things

How will it work?

Page 73: AM Briefing: Security for the internet of things

What’s different?

Page 74: AM Briefing: Security for the internet of things

Assessors

Page 75: AM Briefing: Security for the internet of things

Technical Partners

Page 76: AM Briefing: Security for the internet of things

Up to £1 million

Up to 3 months

Proof of concept

CDE contract with Dstl

Phase 1 C

ost

Scope

Tim

e

Page 77: AM Briefing: Security for the internet of things

£1 million

Longer research

projects

Not Dstl contracts

Phase 2

Page 78: AM Briefing: Security for the internet of things

What’s the same?

Page 79: AM Briefing: Security for the internet of things

www.gov.uk/dstl/cde

Page 80: AM Briefing: Security for the internet of things

Funded opportunities

Awareness

Network

Funding Fair

Accessible

100%

Page 81: AM Briefing: Security for the internet of things

Compliance

Regulated

Transparent

Auditable

Page 82: AM Briefing: Security for the internet of things

Intellectual property

Defcon 705

Rights of use

Page 83: AM Briefing: Security for the internet of things

Online bid submission

CDE portal

Only route

Low overhead

Page 84: AM Briefing: Security for the internet of things

A successful proposal

Clear

Concise

Evidence based

Page 85: AM Briefing: Security for the internet of things

What do we want?

Page 86: AM Briefing: Security for the internet of things

Challenge 1:

security of IoT devices

Page 87: AM Briefing: Security for the internet of things

Challenge 2:

linking and understanding

IoT data

Page 88: AM Briefing: Security for the internet of things

What we want

Innovative proof-of-concept

Software or hardware

Completed by 31 March 2016.

Demonstrations

Page 89: AM Briefing: Security for the internet of things

What we don’t want

Studies

Consultancy

Incremental

Mature technologies

Page 90: AM Briefing: Security for the internet of things

Technical queries

[email protected]

Page 91: AM Briefing: Security for the internet of things

Dates

Webinar:

8 October 2015

Page 92: AM Briefing: Security for the internet of things

Dates

Contract placement initiated:

Early December 2015

Page 93: AM Briefing: Security for the internet of things

Dates

Phase-1 research deadline:

31 March 2016

Page 94: AM Briefing: Security for the internet of things

Competition deadline

Page 95: AM Briefing: Security for the internet of things

29 October 2015 at 5pm

Page 96: AM Briefing: Security for the internet of things

www.gov.uk/dstl/cde

Page 97: AM Briefing: Security for the internet of things

Innovation Network event 1 October 2015