Slide 1

Slide 1 text

Connections and Intersections: Resilience Engineering and Security John Allspaw Adaptive Capacity Labs

Slide 2

Slide 2 text

about me Consortium for Resilient Internet-Facing Business IT Adaptive Capacity Labs

Slide 3

Slide 3 text

Early 2000s Human Factors Safety Science Cognitive Systems Engineering

Slide 4

Slide 4 text

…a community emerges… Rail Maritime Surgery Intelligence Agencies Law Enforcement Aviation/ATM Space Mining Construction Explosives Fire f i ghting Anesthesia Pediatrics Power Grid & Distribution Military Agencies Mid 2000s

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

what makes this work as well as it does? what makes this work dif f i cult for people? what makes them good at it?

Slide 7

Slide 7 text

Resilience is the story of the accident that didn’t happen. security incident

Slide 8

Slide 8 text

anticipating monitoring responding learning Hollnagel, E. (2016). Resilience Engineering Perspectives, Volume 2 (C. P. Nemeth, Ed.). CRC Press.

Slide 9

Slide 9 text

observing inferring planning troubleshooting diagnosing correcting modifying reacting anticipating adapting

Slide 10

Slide 10 text

adaptation What: • conditions • investments • stances • activities …are necessary for effective adaptation to happen…. when/ where/how it needs to?

Slide 11

Slide 11 text

adaptation What: • conditions • investments • stances • activities …are necessary for e f f ective adaptation to happen…. when/where/how it needs to? Resilience is something that you do, not something that you have. bit.ly/ResilienceIsAVerb

Slide 12

Slide 12 text

incidents do not arrive with clear labels attached “I’m a garden-variety outage!” “I’m an attacker-led incident!”

Slide 13

Slide 13 text

#warroo m 2020-01-26 14:57:4 0 Steve Hey guys, why is this happening 3 times a day every last 3 days? Is this some continuous attack effort or some continuous issues with servers? #incident-48712 
 2018-02-12 08:32:31 Lisa I’m not en t i rely sure we’re not being a t t acked at the moment… #emergency-room-3 2019-10-07 05:34:22 Phil wait is it possible that we’re just seeing this because there might be a DDoS going on?

Slide 14

Slide 14 text

What is the automation doing now? What will it do next? How in the world did we ever get into that mode?

Slide 15

Slide 15 text

anticipating monitoring responding learning What new vulnerabilities — and exploits — might be coming? Is our data safe at the moment? Is anyone actively probing or attacking us right now? What happened? How exactly did that happen? How did we know what we knew, when we knew it? What is the automation doing now? What will it do next? How in the world did we ever get into that mode? attacker they

Slide 16

Slide 16 text

what does it look like to understand RE through a security lens?

Slide 17

Slide 17 text

Challenges to Adversarial Interplay Under High Uncertainty: Staged-World Study of a Cyber Security Event DISSERTATION Presented in Partial Fulfillment of the Requirements for the Degree Doctor of Philosophy in the Graduate School of the Ohio State University By 
 Matthieu Branlat, B.S., M.S. 
 Graduate Program in Industrial and Systems Engineering The Ohio State University 2011 bit.ly/BranlatRedBlue

Slide 18

Slide 18 text

Blue Team’s defense activity Red Team’s attack activity

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

No content

Slide 21

Slide 21 text

No content

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

ALL work in security is cognitive work Effective security requires sustaining your ability to adapt on both short and long time scales 20+ years of research in Resilience Engineering: resilience = sustained adaptive capacity

Slide 24

Slide 24 text

Understanding Resilience Engineering will take time the concepts are not intuitive and also critically important

Slide 25

Slide 25 text

Change Is Afoot 2018 2019 J. Paul Reed 2018 Nora Jones Casey Rosenthal 2020 Jessica DeVita Chad Todd Tim Tischler 2021 Learning From Incidents In Software http://learningfromincidents.io

Slide 26

Slide 26 text

Thanks! @allspaw Adaptive Capacity Labs