Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr....

26
UNCLASSIFIED Republic of Bulgaria Ministry of Defense Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - [email protected] National Cybersecurity Coordinator (2014-2017) Director, European Software Institute CEE & Cyber Security & Resilience Lab @ ENISA conference: Artificial Intelligence – An opportunity for the EU cyber crisis management 3-4 June 2019, Athens

Transcript of Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr....

Page 1: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Republic of BulgariaMinistry of Defense

Can we handle a Cybrid crisis without AI/ML?

Dr. George Sharkov

Adviser Cyber Defense @ MoD - [email protected]

National Cybersecurity Coordinator (2014-2017)

Director, European Software Institute CEE & Cyber Security & Resilience Lab

@ ENISA conference: Artificial Intelligence – An opportunity for the EU cyber crisis management3-4 June 2019, Athens

mailto:[email protected]
Page 2: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Application complexities

Business processcomplexities

and more…

Digital dependency, interoperability and complexity >>> new types and levels of vulnerabilities

Page 3: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Digital dependency and complexity:

If Software is eating the world, are we safe ?

Page 4: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

2011

2016

… distributed systems — encompassing cloud and SaaS; A.I., machine learning, deep learning; and quantum computing — to the role of hardware; future interfaces; and data, big and small.… why simulations matter… and what do we make of our current reality if we are all really living in a simulation as Elon Musk believes?

Page 5: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

January 25, 2018, DavosTo Prevent a Digital Dark Age: World Economic Forum Launches Global Centre for Cybersecurity

The Global Risk Landscape - 2018

2016

1. Building Resilience to

Water Crises

2. Building Resilience to

Large- Scale Involuntary

Migration

3. Building Resilience to

Large- Scale

Cyberattacks NEW

Page 6: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Understanding cyber/hybrid crisis:Digitized Society (the “fifth domain”) = digital “ecosystem” of1) Cyber-Physical Systems2) Complex Systems-of-Systems with emergent behavior

Page 7: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Complex Systems-of-Systems (SoS)Interoperability layers and security

• Network Transport – physical connectivity and network interoperability;

• Information Services – data/object models, semantic/ information interoperability, knowledge and awareness of actions interoperability;

• People, Processes and Applications: aligned procedures, aligned operations, harmonized strategy/doctrine, and political or business objectives.

Page 8: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Holistic approach – understanding interdependencies:Beyond Layer 7: the real Cyberspace and Cyber terrain[DoD - Defense in depth; Cyber Physical Systems]

Page 9: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

SoS and Layers of the IoT/IIoT

Page 10: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Understanding SoS (emergent) behavior ≠

Sum of compound systems

Page 11: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

SoS are not just complex systems[Maier's criteria, 1998]

• Operational Independence of Elements

• Managerial Independence of Elements

• Evolutionary Development

• Emergent Behavior

• Geographical Distribution of Elements

[Dr. Daniel DeLaurentis, 2005 ]

• Interdisciplinary Study

• Heterogeneity of Systems

• Networks of SystemsSoS (System-of-systems) need AI/ML for “management”

Page 12: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

SoS: Situational Awareness view (simplified)

Page 13: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

SIEMSOC

SIEMSOC

SIEMSOC SIEM

SOC

SIEMSOC

SIEMSOCSIEM

SOC SIEMSOC

SoS Resilience = SIEM/SOC collaboration, AI/ML empowered (advanced SIEMs+)

Page 14: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Threat/Vulnerability side

• SoS (Systems-of-Systems) and emergent behavior/risks• From Very-large-scale systems to all interoperable systems• Cyber Physical Systems• Supply Chains as SoS

• Micro-targeting• Privacy• Mind/behavior manipulation

• “Embedded” (by design) vulnerabilities (exploitable?)• Zero day• “Eternal Blue” Syndrome• Complex nature

• Unknown Unknowns

Page 15: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Economy, state and society:from cyber hacking to manipulation of emotions and minds

Concordia Summit: Alexander Nix, the CEO of

Cambridge Analytica, which did data analysis and

message targeting for the Trump campaign, New

York City, September 2016

Behavioralmicrotargeting

Behavioral economics

Page 16: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

SoS - obvious and non-obvious relationships and linkages Forensic vulnerability analysis: the weak point is at 4th Degree of Separation

https://ndupress.ndu.edu/Media/News/Article/1130658/forensic-vulnerability-analysis-putting-the-art-into-the-art-of-war/

https://ndupress.ndu.edu/Media/News/Article/1130658/forensic-vulnerability-analysis-putting-the-art-into-the-art-of-war/
Page 17: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Unknown unknowns = ontological uncertainties

Need: Prepare Organizations and Nations for

“Unknown Unknowns”

Page 18: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Protection / Defense / Resilience side

• Security & Resilience by design• IoT (+ Industrial Control Systems ICS/SCADA)• Requirements CIP, CIIP, Essential Services

• Regulations - eID (eIDAS) – in relation to GDPR, NISD, PSD2

• Standards, certifications – holistic approach (entire ecosystem), complementarity

• New generation SIEMs

• AI – more than Machine Learning

• Quantum Safe Cryptography

• Active response capability development

Page 19: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Financial/Stock Markets: >80% generated by Automated Trading

Systems

Aviation: Uninterruptible Autopilot System, Training simulators

Military: Nuclear / autonomous WeaponsEnergy: Nuclear

Power Plants

Utilities: Water Plants/Electrical Grid Communications: Satellites

If AI/ML is already in charge, can we have situational awareness and impact assessment without? [the Blueprint]

Supplies/Logistics:Supply/Value chains

Science: R&D, Applied, Education

Page 20: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Super Viruses – Weaponized AI/ML

Relying on Kindness of Machines? The Security Threat of Artificial Agents.By Randy Eshelman and Douglas Derrick. JFQ 77, 2nd Quarter 2015.

@romanyam [email protected]

New generation of malware: Super viruses + evolving, learning, adaptive, complex targeted attacks – new APTs)

New computing paradigms and technologies - cloud computing, the internet of things, big data, inmemory computing, blockchain

>> new playgrounds for malware authors to develop complex and sophisticated malwares

Page 21: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Weaponized AI used to develop new cyber attacks (new generation APTs) by:

• Militaries - cyber-weapons, super robot-soldiers, autonomous drones and precision lethal weapons

• Governments - use AI/ML to monitor/control people, or disrupt other states (governments, economy, society)

• Corporations – competition war-games, intel

• Hackers – steal, penetrate, destroy (ransom), “stealth” invisible activities (“as a service”)

• Doomsday cults attempting to bring the end of the world by any means.

• Psychopaths – appear in history books by any means

• Criminals – dark web and proxy systems for any unlawful activities

Accessible AI/ML as a Service - anyone could be bad actor!

@romanyam [email protected]

Page 22: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Adversaries – access to cheap and powerful AI/ML tools

By the year 2021, cybercrime losses will cost upwards of $6 trillion annually.

Page 23: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

Cyber/hybrid (cybrid) crisis?Or constant low-level cyber war?

Page 24: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

AI in wild (use)

• AI for advanced malware detection and protection• ML for fileless malware detection >>> examples• AI/ML for static and dynamic analysis for malware detection

• AI/ML-based monitoring and safety systems (for any type of ICT

• Cyber protection for AI applications – seems only AI/ML can monitor the AI-empowered systems – “Trustworthy AI” (EI Guidelines), DARPA XAI project

• AI for red teaming and exercises (if bad guys are using it…)

But also

• AI/ML empowered APTs, campaigns, cyber/hybrid war

Page 25: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

A proof:BG-GB Cyber Shockwave exercise“Skin in the game”• Industry (Gas and oil distribution) >>> State (3 ministries, 3 agencies)• Technical + Tabletop (4 main attack vectors + misinformation)• Small (business) is BIG (threat)• Context: EU elections (but CYBRID by nature, any time …)Tested: EU Blueprint (ENISA), Cybersecurity Incident Taxonomy, AI & ML pilot

Asymmetry demonstrated: RED (+simple AI/ML) <> BLUE (Industry + State)Result: 4 hours, score 3.5 for ??? out of 4

Supported by: UK Embassy, NCSC, UK companies/consultantsWhat’s next: Romania, Greece

Page 26: Can we handle a Cybrid crisis without AI/ML? · Can we handle a Cybrid crisis without AI/ML? Dr. George Sharkov Adviser Cyber Defense @ MoD - g.sharkov@mod.bg National Cybersecurity

UNCLASSIFIED

“If you are not part of the solution, you must be part of the problem”

Attributed to: Eldridge Clever (1969); African proverb, others


Grow Micro Bloom Honey · Week 7 Late Flowering - 6.0 mL 11.0 mL 10.0 mL 8.0 mL 8.0 mL - Week 8 Ripening - 4.0 mL 11.0 mL 5.0 mL 4.0 mL 6.0 mL - Week 9 Flush 2.0 mL 2.0 mL 2.0 mL

Grow Micro Bloom Honey · Week 7 Late Flowering - 6.0 mL 11.0 mL 10.0 mL 8.0 mL 8.0 mL - Week 8 Ripening - 4.0 mL 11.0 mL 5.0 mL 4.0 mL 6.0 mL - Week 9 Flush 2.0 mL 2.0 mL 2.0 mL

REPLACEMENT PARTShs series automatic slicers (ml-136313 thru ml-136324) ml-136313 hs7 ml-136314 hs7n ml-136317 hs7 (canada) ml-136318 hs7n (canada) ml-136324 hs7-phs

REPLACEMENT PARTShs series automatic slicers (ml-136313 thru ml-136324) ml-136313 hs7 ml-136314 hs7n ml-136317 hs7 (canada) ml-136318 hs7n (canada) ml-136324 hs7-phs

Kleargene plant spin plate DNA extraction kits user manualIsopropanol 7.5 mL 30 mL 125 mL 2 x 250 mL Ethanol 7.5 mL 30 mL 125 mL 2 x 250 mL Buffer W1 Ethanol 10.5 mL 42 mL 175 mL 700

Kleargene plant spin plate DNA extraction kits user manualIsopropanol 7.5 mL 30 mL 125 mL 2 x 250 mL Ethanol 7.5 mL 30 mL 125 mL 2 x 250 mL Buffer W1 Ethanol 10.5 mL 42 mL 175 mL 700

d163axztg8am2h.cloudfront.net...Analysis Volume 100 ml IOO ml 400 ml IOO ml 50 ml 50 ml 200 ml 50 ml 500 ml 300 ml IOO ml 25 ml 500 ml 200 ml IOO ml 200 ml EPA Method # 305 310 350

d163axztg8am2h.cloudfront.net...Analysis Volume 100 ml IOO ml 400 ml IOO ml 50 ml 50 ml 200 ml 50 ml 500 ml 300 ml IOO ml 25 ml 500 ml 200 ml IOO ml 200 ml EPA Method # 305 310 350

田島ルーフィング株式会社 …quality sample Real／リアル ML-3146 ML-3584 ML-3860 ML-3355 ML-3405 ML-3723 ML-3430 ML-5225 ML-5801 ML-E5231 Cocoa／ココア Fresco／フレスコ

田島ルーフィング株式会社 …quality sample Real／リアル ML-3146 ML-3584 ML-3860 ML-3355 ML-3405 ML-3723 ML-3430 ML-5225 ML-5801 ML-E5231 Cocoa／ココア Fresco／フレスコ

The Homogenizer Company™ 2015 CATALOG · The Omni TH is a powerful tissue homogenizer that was designed to handle a wide range of samples from 0.20 mL to 100 mL. The TH can usually

The Homogenizer Company™ 2015 CATALOG · The Omni TH is a powerful tissue homogenizer that was designed to handle a wide range of samples from 0.20 mL to 100 mL. The TH can usually

SK.ES 030519 CON RESINA ......Bote de 100 g - polvo 200-2605 VERTYS SIRINGHE + HANDLE Jeringa para inyección de resina + empuñadura ergonómica 10 uds de 30 ml + VERTYS HANDLE 200-2490

SK.ES 030519 CON RESINA ......Bote de 100 g - polvo 200-2605 VERTYS SIRINGHE + HANDLE Jeringa para inyección de resina + empuñadura ergonómica 10 uds de 30 ml + VERTYS HANDLE 200-2490

Final - English · English Breakfast 20 Camomile 20 Earl Grey 20 350 ml 350 ml 250ml 1800 ml 1800 ml 135 ml 750 ml 135 ml 300 ml 300 ml. Title: Final - English Created Date: 7/24/2018

Final - English · English Breakfast 20 Camomile 20 Earl Grey 20 350 ml 350 ml 250ml 1800 ml 1800 ml 135 ml 750 ml 135 ml 300 ml 300 ml. Title: Final - English Created Date: 7/24/2018

Studies Improving Health - Buckeye International · 2017. 9. 18. · 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml Vivid

Studies Improving Health - Buckeye International · 2017. 9. 18. · 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml Vivid

mapendakuningan.files.wordpress.com · Ml PUI Ciawigebang Ml PUI Ciwedus I Cigandamekar Ml PUI Ciwedus 1 Cigandamekar Ml Sangkanurip Cilimus Ml Situgede Kec. Subang Ml Susukan Kec.

mapendakuningan.files.wordpress.com · Ml PUI Ciawigebang Ml PUI Ciwedus I Cigandamekar Ml PUI Ciwedus 1 Cigandamekar Ml Sangkanurip Cilimus Ml Situgede Kec. Subang Ml Susukan Kec.

User s Guide - GilsonP1000L 0.01 mL mL 0.002 mL P5000L 0.01 mL mL 0.002 mL P10mL L mL 0.1 mL 0.02 mL Lock System For additional safety, the volume selected is lockable. With the left

User s Guide - GilsonP1000L 0.01 mL mL 0.002 mL P5000L 0.01 mL mL 0.002 mL P10mL L mL 0.1 mL 0.02 mL Lock System For additional safety, the volume selected is lockable. With the left

Cybrid Walkthrough

Cybrid Walkthrough

Manual: InterPlay Mammalian TAP SystemStreptavidin resin (#240105)b 1.25 ml 1.25 ml — — 1.25 ml — Streptavidin binding buffer (SBB) 25 ml 25 ml — — 25 ml 25 ml Streptavidin

Manual: InterPlay Mammalian TAP SystemStreptavidin resin (#240105)b 1.25 ml 1.25 ml — — 1.25 ml — Streptavidin binding buffer (SBB) 25 ml 25 ml — — 25 ml 25 ml Streptavidin

SAMPLING SCOOPS - North Central Laboratories · SAMPLING SCOOPS Sampling scoops with handle. Handle has wood reinforcement. Scoop is molded on and has one spout and a 1000 ml capacity.

SAMPLING SCOOPS - North Central Laboratories · SAMPLING SCOOPS Sampling scoops with handle. Handle has wood reinforcement. Scoop is molded on and has one spout and a 1000 ml capacity.

 · construccion de la area materno e infantil del centro de salud ... glb ml m3 ml ml und ml und ml und und und ml und und und und und ml und ml und ml und und

 · construccion de la area materno e infantil del centro de salud ... glb ml m3 ml ml und ml und ml und und und ml und und und und und ml und ml und ml und und

ML Rope and Handle Catalouge

ML Rope and Handle Catalouge

repository.unisba.ac.id › bitstream › handle › 123456789 › ... · 2.1 Kajian Pustaka 2.1.1 Anatomi Ginjalhanya 1 ml yang diteruskan ke dalam ureter sebagai urin kemudian ditampung

repository.unisba.ac.id › bitstream › handle › 123456789 › ... · 2.1 Kajian Pustaka 2.1.1 Anatomi Ginjalhanya 1 ml yang diteruskan ke dalam ureter sebagai urin kemudian ditampung

ml-1640, ml-2240, ml-2241, ml-2245 general

ml-1640, ml-2240, ml-2241, ml-2245 general

Frontier 5000 Series - Hogentogler & Co., Inc.€¦ · Frontier™ 5000 Series Multi Pro Centrifuges FC5718/FC5718R 0.2/ 0.4 ml 0.5 ml 1.5/ 2.0 ml 4.5 ml 5 ml 7 ml 10 ml 15 ml 16

Frontier 5000 Series - Hogentogler & Co., Inc.€¦ · Frontier™ 5000 Series Multi Pro Centrifuges FC5718/FC5718R 0.2/ 0.4 ml 0.5 ml 1.5/ 2.0 ml 4.5 ml 5 ml 7 ml 10 ml 15 ml 16

modification placards and educational Dispensers 1250 ml · 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml PrestigeEmpathyAlertCalmVivid Alpine Dispensers 1250 ml Symmetry’s newest

modification placards and educational Dispensers 1250 ml · 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml PrestigeEmpathyAlertCalmVivid Alpine Dispensers 1250 ml Symmetry’s newest