Program Manager, Information Innovation Office

Peiter Mudge Zatko

If you don't like the game, hack the playbook...

DARPA Cyber Colloquium Arlington, VA November 7, 2011

Approved for Public Release, Distribution Unlimited.

The Problem: Not Convergent

10,000,000

Unified Threat Management

Lines of Code

8,000,000 Security software 6,000,000

4,000,000 x 2,000,000
DEC Seal Milky Way Stalker Network Flight Recorder

0 1985

x 1995

Snort

Malware: 125 lines of code* 2005 2010

1990

2000

* Public sources of malware averaged over 9,000 samples (collection of exploits, worms, botnets, viruses, DoS tools)
Approved for Public Release. Distribution Unlimited.

Maker spaces and boutique security firms

Small groups of motivated and like minded researchers have repeatedly shown significant talent and capabilities. Commodity high end computing, personal prototyping and fabrication capabilities, and open software tools remove barrier to entry. The new home brew computer club This relationship needs to be mutually beneficial. DARPA intends to cultivate relations and become a resource. Number of US Maker Spaces
120 100 80 60 40 20 0 1985 1990 1995 2000 2005 2010

NYC Resistor Brooklyn, NY

Source: Make Magazine

Approved for Public Release. Distribution Unlimited.

The New Cyber Braintrust

Assembly, Helsinki, Finland May 8, 2004

Approved for Public Release. Distribution Unlimited.

Cyber Fast Track

DARPA-PA-11-52

Approved for Public Release, Distribution Unlimited.

Patient Zero

Dino Dai Zovi

Hank Leininger

Fyodor

Bruce Potter
Approved for Public Release. Distribution Unlimited.

Cyber Fast Track Themes Crowd

Many eyes on many efforts Faster than adversary lifecycle (transition while still relevant) Low price point Numerous approaches Numerous efforts

Fast and cheap

Diverse

The key to a good strategy is to have multiple options.

Approved for Public Release. Distribution Unlimited.

Current Cyber Fast Track Efforts

Performer Effort Period of Performance

Rogue Networks Immunity Federal Services, LLC Charlie Miller Secure Ideas, LLC Korelogic, Inc. Assured Information Security, Inc. Peak Security, Inc. Raphael Mudge

Methods of Detecting Malicious Web Server Traffic Combining Expert Knowledge and Symbolic Analysis for Detection of Exploitable Bugs Evaluation of Near Field Communication in Mobile Smartphones MobiSec Live Environment Mobile Testing Framework Hand Held Testing MoRE: Measurement of Dynamic Code TinyLANE - Mobile Hardware Endpoint Security for Individuals A Language to Control and Automate Cyber Capabilities

3 Months 7 Months 7 Months 3 Months 2 Months 4 Months 9 Months 7 Months

Approved for Public Release, Distribution Unlimited.

Cyber Fast Track So Far

In its first 2 months:

31 submissions - 19 non-traditional performers 8 awards - 7 non-traditional performers Average time from submission to award is 7 days Average period of performance: 5 months

www.cft.usma.edu
Approved for Public Release, Distribution Unlimited.

Cyber Fast Track

PA #: DARPA-PA-11-52 CyberFastTrack@DARPA.MIL DARPA CFT Town Hall meetings

URL: http://www.cft.usma.edu

Contact: CyberFastTrack@darpa.mil
Approved for Public Release. Distribution Unlimited.