WEBVTT 00:05.600 --> 00:11.860 Hello and welcome to Checklist for Aviation Vulnerability Disclosure, Don't Go It Alone. 00:12.240 --> 00:18.780 Before I dive into the talk, I first off would like to thank the Aerospace Village for allowing me to come speak today. 00:18.780 --> 00:26.720 They've been a great partner with CISA over the past year and I really appreciate them allowing me to come and chat with you for a few minutes. 00:28.180 --> 00:36.080 So, I am with the Cybersecurity Infrastructure Security Agency, commonly referred to as CISA. 00:36.400 --> 00:44.700 You may know us from some of our previous branding such as US CERT, ICS CERT, NCIC, or even NPPD. 00:44.700 --> 00:50.460 All of those functions, brands, and identities have been rolled up into a single agency within the U.S. 00:50.460 --> 00:52.540 Department of Homeland Security. 00:53.720 --> 00:55.700 So, what do we do? 00:55.700 --> 01:00.120 We essentially function as the nation's risk advisor. 01:00.120 --> 01:04.440 We do national risk management for cyber and physical infrastructure. 01:06.640 --> 01:10.080 So, kind of to break down, how do we do this? 01:10.080 --> 01:14.700 We leverage four major program areas. 01:14.700 --> 01:17.240 First, federal network protection. 01:17.240 --> 01:24.060 We augment the protection of the .gov web space, infrastructure, resilience, and field operations. 01:24.300 --> 01:33.590 If you're in the U.S., you may have crossed paths one time or another with our CSAs or PSAs, our cybersecurity advisors and protected security advisors. 01:34.340 --> 01:36.940 And we also have emergency comms. 01:36.940 --> 01:41.720 This group supports the COM ISAC and the critical PSF2 function. 01:42.320 --> 01:48.400 And most importantly, the final group that I skipped is the comprehensive cyber protection efforts. 01:48.400 --> 01:52.700 This is where I fall among the many functions in this group. 01:52.700 --> 01:57.660 I facilitate the disclosure of industrial control system vulnerabilities. 01:58.920 --> 02:02.640 So, and to kind of sum up all of this part with who I am. 02:02.640 --> 02:04.040 So, I am Jay Angus. 02:04.040 --> 02:09.920 I'm the federal lead for the industrial control systems vulnerability disclosure program. 02:09.920 --> 02:18.660 Since 2012, we've been disclosing on average about 700 to 800 industrial control system vulnerabilities per year. 02:18.660 --> 02:25.780 And these vulnerabilities impact vulnerabilities across all 16 critical infrastructure sectors. 02:25.780 --> 02:33.700 We try to provide timely, actionable information to remediate these vulnerabilities in as public a manner as possible. 02:34.760 --> 02:38.260 So, we're going to kind of level set here. 02:38.260 --> 02:41.740 We're going to start off with what is a vulnerability ? 02:41.740 --> 02:43.600 What do I consider a vulnerability? 02:43.880 --> 02:47.880 And I pulled this from the internet engineering task force. 02:47.880 --> 03:02.740 According to them, through their RFC 4949, it's a flaw or weakness in a system's design implementation for operation and management that could be exploited to violate the system's security policy. 03:02.840 --> 03:13.780 I kind of generalize as a risk that can be exploited by a threat actor such as an attacker to perform unauthorized actions within an information system. 03:17.170 --> 03:22.890 So, we break this down generally into two different categories from my perspective. 03:22.890 --> 03:24.710 We have our zero days. 03:24.710 --> 03:28.210 These are unintentional vulnerabilities. 03:28.210 --> 03:36.530 They're risks previously unknown to anyone and typically require intervention from the vendor for remediation. 03:36.530 --> 03:39.690 Whereas, we also have misconfigured devices. 03:39.690 --> 03:42.410 This is intentional or accidental. 03:42.730 --> 03:55.390 The risk is commonly introduced by the asset owner and it requires changes to the configuration on the device or the architecture surrounding the device. 03:55.470 --> 03:58.250 Either way, zero day misconfigured device. 03:58.250 --> 04:02.400 This is dangerous information in the hands of the adversary. 04:06.400 --> 04:11.960 And to continue this level setting, what do we consider a coordinated vulnerability disclosure? 04:12.100 --> 04:22.080 Just to kind of read the slide here, it's an effort to verify that accurate information is being openly disclosed on a vulnerability so that it can be addressed accordingly. 04:23.220 --> 04:26.360 I kind of use the airplane analogy at times. 04:26.500 --> 04:41.100 Much the way a vulnerability is found, a plane takes off and hopefully they both will make it controlled, safe to sit, you know, back to whether it's a public disclosure or a receiving airport. 04:41.100 --> 04:48.140 My team works to make disclosures of vulnerability in a safe, controlled manner. 04:48.260 --> 05:02.240 There's no guarantee that every disclosure will be smooth, but as for the aviation sector, as they begin to handle more disclosures, I think this is going to be much easier. 05:02.240 --> 05:14.060 And this will be an issue that we won't be as concerned about as time and effort continues to grow in this area. 05:14.460 --> 05:22.100 So to kind of help frame this conversation today, the aviation sector loves checklists. 05:22.100 --> 05:28.660 It's a very common approach to managing safety and risk within the sector. 05:28.820 --> 05:36.980 And one of these checklists could make, you know, disclosures easier whether you're a researcher or a vendor. 05:36.980 --> 05:44.780 And I kind of wanted to pull from the form published by the FAA, the FAA Form 7233-4. 05:48.020 --> 05:54.640 So if you're a pilot, you're probably very familiar with this, but it's the pre-flight pilot checklist. 05:54.640 --> 05:59.180 Looks like it collects a lot of information prior to takeoff. 05:59.340 --> 06:11.520 And hopefully I won't get too lost in the jargon here, but I'm going to break some of this down, compare it to vulnerability disclosure process, and see if we can find some parallels. 06:14.660 --> 06:19.720 So the first thing I noticed that this report is very interested in the weather. 06:20.580 --> 06:25.440 And what does the weather have to do with vulnerability to disclosure? 06:26.400 --> 06:37.840 To me, it has a... appears to have the primary effort to document what the pilot has no control over, which I found to be ironic. 06:37.840 --> 06:51.380 As vulnerability disclosures, there are multiple parties coming together of significant influence that typically have no control or direct control over each other. 06:51.380 --> 06:57.400 They can certainly cause buffeting of each other during the course of disclosure. 06:58.240 --> 07:09.360 And kind of... so as the researcher starts down the aviation research goal process, what is their end goal, right? 07:09.400 --> 07:14.140 Typically, their findings are focused on safe and more secure aviation. 07:14.140 --> 07:24.320 For the researcher, I cannot stress enough, but know the company that you're dealing with, as back to the idea that you can't change them. 07:24.320 --> 07:32.940 I have no doubt that you know how to manipulate their products and work with them very aggressively, but know the culture of the company. 07:32.940 --> 07:38.720 Depending on the company, it could be difficult for you to get your report in front of the right person. 07:40.000 --> 07:52.000 And similarly for vendors, you can't control researchers, but you can help guide them down a safe path so that you both have a controlled disclosure and sharing of information. 07:52.320 --> 07:56.540 And for the vendor, the first step is going to be that vulnerability disclosure policy. 07:57.400 --> 08:07.380 And for vendors and researchers, as I said, you can't change one party or the other, but you can certainly create opportunities to facilitate a controlled disclosure. 08:10.410 --> 08:13.050 So as we continue down the checklist... 08:14.790 --> 08:16.210 Wins Aloft. 08:16.210 --> 08:20.690 So this is the part of the flight that should be the most straightforward. 08:20.690 --> 08:22.730 Cruising, we're cruising. 08:22.730 --> 08:28.270 Systems are communicating as intended and parties have acknowledged each other's presence. 08:28.410 --> 08:34.570 The researcher has begun divulging to the vendor their findings and the vendor is reviewing the information. 08:34.570 --> 08:37.810 But we won't be here forever at this altitude. 08:37.810 --> 08:46.570 As the exchange of information progresses, researchers and vendors need to be open about their intentions and capabilities. 08:47.950 --> 08:53.390 Researchers need to be open of what they intend to do with their disclosure. 08:53.630 --> 08:57.590 Maybe they're going to take this to a talk at a conference. 08:57.830 --> 09:05.030 Maybe they're just doing this as an act of goodwill and don't require public acknowledgement, such as CVEs or press releases. 09:06.090 --> 09:13.350 Whatever the case may be, the party should be open about their tolerance for attention during the process. 09:13.350 --> 09:20.130 We want to keep the flight moving, keep the disclosure moving along as smoothly as possible. 09:20.670 --> 09:37.550 To keep this portion of the disclosure smoothly moving, vendors need to be more open about their product development life cycle, offer up realistic timelines for remediation. 09:37.550 --> 09:48.890 Simply ignoring the researcher first off doesn't buy you more time and at times can make the researcher make a less informed decision about how they want to proceed in a disclosure. 09:49.450 --> 09:59.150 Sometimes we don't need to dive into long protracted timeline for disclosures. 09:59.650 --> 10:06.390 And we kind of want to break that down a little bit into two different types of disclosures here. 10:06.410 --> 10:18.790 So for misconfigured devices, frequently focus on leaving the information with the vendor and a lot of times the asset owner under the expectation they'll remediate the finding. 10:18.790 --> 10:28.530 It's likely this type of disclosure, straightforward, relatively quick to resolve, and there's no space for a CVE assignment. 10:28.810 --> 10:42.530 But that being said, if you are having trouble getting someone's attention, we can help it sizzle with that and making sure that the information is put in front of the right person and I'll have my contact info later for that kind of disclosure. 10:43.830 --> 10:55.170 And then so second, the other type of disclosure we're seeing for zero days, you can expect that kind of a long protracted disclosure timeline for these. 10:55.490 --> 11:05.250 We've seen anywhere from 45 days for a typical IT vulnerability and at times to a couple of years for operational technology. 11:05.510 --> 11:07.450 Try to find a happy medium here. 11:07.450 --> 11:15.930 Researchers should acknowledge the amount of time that they spent finding the vulnerability and expect lag and remediation from the vendor. 11:15.950 --> 11:22.630 It's particularly for aviation systems as they have a much longer remediation process. 11:23.110 --> 11:30.010 A quote I hear sometimes from the aviation sector is it costs a million dollars to update a line of code. 11:30.210 --> 11:38.270 Whether or not that's true, recognize there's great efforts that could be required to remediate a vulnerability. 11:42.550 --> 11:44.090 So here we are. 11:44.090 --> 11:50.230 I think one of my more important points for this discussion today, who are you working with? 11:50.770 --> 11:56.330 So first off, I'll go ahead and list my favorite option, CISA. 11:56.370 --> 12:08.150 Our ICS vulnerability disclosure program has been in place for eight years now and we've assisted with disclosure of thousands of vulnerabilities across all critical infrastructure sectors. 12:08.510 --> 12:22.210 Most importantly, as a CNA, we can assign CVEs to new vulnerabilities, assuming it's within scope, and doing so will assist with better identifying vulnerabilities in the future. 12:23.170 --> 12:26.130 So, and I've listed multiple entities here. 12:26.130 --> 12:34.050 All of these entities are more than happy to work with researchers and I've seen them do so in good, definitely good faith. 12:34.490 --> 12:38.010 But, and for vendors, who are you working with? 12:38.450 --> 12:43.110 It's important that you have a relationship with the national search. 12:43.110 --> 12:46.210 You want to have that relationship ahead of time. 12:46.470 --> 13:00.750 And especially if you have a product security team, that they're in a perfect position to be building those contacts and reaching out to these, the national search to build the relationships in advance. 13:02.550 --> 13:10.130 So, and also we can kind of talk about here, when should an additional party be brought in to assist with a disclosure? 13:10.570 --> 13:29.050 And I definitely believe for all disclosures, anytime it's crossing international boundaries, I think it's, that's a great time to engage an external third party to assist with communicating with other entities and making sure your information is put in front of the right group. 13:29.190 --> 13:38.830 And, and the other situation, obviously for this discussion, aviation disclosures should always have a trusted third party involved. 13:39.050 --> 13:48.570 I think these third parties add some oversight and an additional party to make sure that the correct stakeholders and asset owners are being notified. 13:52.730 --> 13:59.730 So, hopefully as we discussed earlier, we've kind of talked around the factors. 13:59.730 --> 14:04.030 What does a landing look like for an aviation disclosure? 14:04.430 --> 14:14.450 Researchers, from my experience, want to acknowledge, want to be acknowledged publicly, privately, and want to see a fix for a vulnerability . 14:14.450 --> 14:20.610 At times it is just that simple, especially for misconfigured devices. 14:21.010 --> 14:31.330 Many times vendors struggle with their own bureaucracy and lose valuable time arguing points of a disclosure rather than focusing on remediation. 14:31.330 --> 14:37.850 My opinion is we do not see enough aviation specific vulnerabilities with CVEs being assigned. 14:37.850 --> 14:52.350 While I can appreciate the sensitivity of the sector, that this quiet disclosure process can create digital debt that can come due over and over again as more researchers enter the sector and continue to have similar findings. 14:53.030 --> 15:02.210 While the quiet disclosure is a useful alternative, it will come with consequences over time. 15:07.770 --> 15:10.930 So, airspace restrictions. 15:12.130 --> 15:15.770 Make sure you're clear to do the work that you're doing. 15:15.810 --> 15:17.850 This should go without saying. 15:18.210 --> 15:29.170 Please, please do not do cyber security research against a system that is not yours or you do not have clear written permission to have access to. 15:29.190 --> 15:36.030 If you have a question about the legality of your work here in the U.S., I encourage you to check out the DMCA. 15:37.110 --> 15:42.450 There is space for cyber security research specific to aviation devices. 15:43.030 --> 15:50.750 You just, it needs to be in your possession, in your property. 15:51.190 --> 15:56.810 To be clear, while I do work for DHS, I am not law enforcement or sector regulator. 15:56.810 --> 16:01.810 I can't put anyone in jail and I certainly can't force anyone to fix a vulnerability. 16:01.950 --> 16:07.630 That said, as a federal employee, I do have a certain obligation to report suspected crimes. 16:07.950 --> 16:25.730 Remember, I can definitely help researchers amplify their messaging around a vulnerability and I have a team of really awesome vulnerability assessors that can assist vendors with researchers, assist vendors and researchers in describing the vulnerability and suggesting mitigation strategies. 16:25.950 --> 16:33.810 But I have to have that information put out in front of me and it has to be in a very legitimate, legal format. 16:37.000 --> 16:42.320 So as I'm trying to sum this up, don't go it alone. 16:42.320 --> 16:45.060 I think that's one of the most important parts here. 16:45.960 --> 16:48.700 Be prepared beyond the vulnerability. 16:48.700 --> 17:00.160 So many times I've seen researchers that know systems better than the manufacturer, but the researcher is completely unprepared to acknowledge that they're working with a business that operates nine to five. 17:02.380 --> 17:06.120 Vendors, I can't help but push this message over and over again. 17:06.120 --> 17:10.520 You've got to have a public vulnerability disclosure policy. 17:10.520 --> 17:17.280 It makes it easier for researchers and vulnerability coordinators to put information in front of you. 17:17.700 --> 17:25.580 If you have a public policy, make sure you have an internal policy and staffing to support it. 17:26.340 --> 17:29.900 You need a team to manage these types of risks. 17:30.160 --> 17:36.120 It's great that you want to take responsibility, but you must have accountability for these processes. 17:36.920 --> 17:40.240 And for both parties, be honest about timelines. 17:40.240 --> 17:41.500 I know it's hard. 17:41.500 --> 17:43.920 You can't take this process personal. 17:48.670 --> 17:58.570 One item that I'd like to see more of is I think tabletop exercises specific to your organization's business model are important. 17:58.570 --> 18:04.690 They can help identify responsible personnel and develop policy in advance of a disclosure. 18:04.690 --> 18:15.110 And a great way to create a scenario that's more realistic is to maybe bring in a researcher that you've worked with in the past. 18:15.130 --> 18:22.650 They probably have experience doing disclosures in a way that could be difficult for their experience. 18:22.650 --> 18:29.070 And bringing them in and seeing their expertise would be a huge opportunity for your organization to grow. 18:30.750 --> 18:39.430 So researchers and vendors, while you're working together, you need to be honest, again, about these timelines and plans for vulnerability. 18:40.030 --> 18:48.870 I really don't enjoy seeing researchers dropping zero days to the internet, especially in the aviation sector, without a reasonable attempt to contact the company. 18:50.610 --> 18:57.790 But, you know, that just really doesn't build trust between the two parties in the long run. 18:57.790 --> 19:00.550 And I don't believe that it serves the greater good. 19:00.550 --> 19:03.270 And the same goes for vendors ignoring researchers. 19:03.270 --> 19:12.090 The lack of engagement doesn't build trust and at times causes these uncontrolled disclosures to happen. 19:13.650 --> 19:20.110 Finally, have a plan tailored to your goals, vendor or researcher. 19:20.390 --> 19:25.350 Both parties in this disclosure should have a plan in place for the disclosure. 19:25.450 --> 19:28.290 And as always, CISA is here to help. 19:28.410 --> 19:31.170 We have a great deal of experience with this. 19:31.170 --> 19:34.770 We partner regularly with SEI, CERT CC. 19:34.770 --> 19:37.630 We have direct access to the FAA. 19:37.750 --> 19:40.550 We've partnered with the Aviation ISAC. 19:40.550 --> 19:45.150 We also have our ACI program to support with disclosures. 19:46.910 --> 19:53.010 So, if you have questions about disclosures, here's my contact information. 19:53.130 --> 20:03.110 Feel free to send me an email and I will be in the chat box here after the presentation answering some questions. 20:03.110 --> 20:07.410 If you have anything, I'd love to support your disclosures. 20:07.410 --> 20:08.310 Thank you.