The Case for Built-In Cybersecurity
The concept of cyber resiliency can mean multiple things to different people. However, a common definition for “cyber resiliency” is the ability of a system to continue to operate in a degraded mode during an active cyber-attack and have a path to recover to full capability within deployed operations and maintenance channels.
In terms of cyber resiliency for a major military satellite development program, failure is not an option. When Lockheed Martin was awarded the opportunity to work on this program, the team responsible made the decision to include cyber at the front-end to eliminate costly and incomplete cyber “bolt-ons” later in the system’s lifecycle.
Using the Cyber Resiliency Level™ Model
Lockheed Martin and the military have been working shoulder-to-shoulder since day one. The Cyber Resiliency Level (CRL®) model helped the joint team identify the program’s “as-is” state, beginning with a cyber tabletop early in the design and development phase.
A cyber table top is one of several techniques that can be used to assess a system’s resiliency to different kinds of cyber-attacks. They can help teams think like an adversary and examine all the ways an attacker might try to compromise the platform. So Lockheed Martin’s cyber experts conducted table tops and were able to use the CRL model to drive changes to requirements to make the platform more cyber resilient.
After conducting the table top exercises, the team used the data to help determine mitigation techniques.
Approximately 15% of new requirements were generated based on the table top findings, which focused on driving the average CRL level 2 to level 3 – yielding a platform architecture that can be survivable under a cyber-attack.
"The CRL model provided us with a repeatable process to continuously address and mitigate threats throughout the program's lifecycle," said Ethan Puchaty, Lockheed Martin’s principal cyber architect. "We are now developing new capabilities specifically tailored to counter the threats that our platform faces. Our customer’s participation in the cyber table tops is critical; it's become much easier to see any identified CRL level 2 risks and understand better how to get to CRL level 3 and even level 4 if technology is mature enough."