Scott Foote is a Cyber Security Engineer in MITRE's National Security Engineering Center (NSEC) FFRDC. At MITRE, Scott is applying his extensive knowledge of software engineering, business/operations management, enterprise-scale information systems, information security, and open source threat intelligence to researching and developing solutions for today's enterprise-scale Cybersecurity challenges. Scott's involvement with Cybersecurity began in the mid 1980's at Digital Equipment Corporation (DEC), and has spanned both the commercial and public sectors ever since, in a number of commercial companies including Oracle, OpenVision/Veritas, and a series of startups focused on the Information Security market. Scott is currently the lead for MITRE's "Cyber Operations Center" (CyOC) Capstone Initiative, the lead for the company's "Cyber Situation Awareness" Initiative, chief engineer on a number of customer-focused Cyber Operations efforts, and contributor to several MITRE R&D projects addressing specific Cyber Operations needs, solutions, and deployments.

Problem: The impact and visibility of cybersecurity breaches continues to rise. Fortune.com estimates that more than 140 countries have some level of cyber weapon development program. Mandiant (now FireEye) estimates that successful attackers are staying resident for >200 days on average, and that these attacks and breaches may already be costing the global economy $Trillions (2014 Mandiant Report). Today’s attackers are professionals, targeting the enterprise’s growing vulnerability. Vulnerability inherent in the expanding complexity, accessibility and dependencies that the enterprise has on information and supporting technology. In response, the Cybersecurity solution marketplace continues to grow, yet remains highly fragmented with 100s of companies providing point solutions in a wide range of categories: network security; intrusion detection/prevention; unified threat management; endpoint security; mobile and IoT security; “cloud” security; application security; data-at-rest and message security; threat intelligence and analytics; security operations & incident response; risk & compliance; etc. This is essentially a cyber “arms race”; and there is no “silver bullet”. CISOs and cybersecurity professionals are faced with a daunting challenge of unprecedented complexity and scale – effectively reducing the Risk to their business.

Engineering Approach: This session will discuss the application of contemporary Systems Engineering discipline to bring some Order to this Chaos – specifically Needs Analysis and Solution Concept Evolution. Conventional Needs Analysis in this domain suffers from the significant complexity of today’s enterprise, its unprecedented dependencies on highly-vulnerable information technology (cyberspace), and urgent demands for immediate solutions that mitigate the risk. “Decomposition” is discussed as a technique for iteratively reducing Abstract Needs into Concrete Requirements. Then, “Re-composition” (iterative System Design, Development, Deployment and continuous integration) is presented as a technique for rapidly evolving effective Solution Concepts.

Solution Concept: Finally, the session will briefly introduce a new system concept for “Cyber Situation Awareness”, informing enterprise-scale Cybersecurity – a federation of people, processes, and enabling technologies – that fuses multi-dimensional intelligence (of information systems and networks, the mission/business dependencies on them, and the emerging cyber threat targeting them) into a complex knowledgebase that provides "signal filtering" for more effective cybersecurity and risk management decisions supporting the "Complex System" that is the enterprise.