Apply for the 2018 R&D 100 Awards

High-Fidelity Adaptive Deception & Emulation System (HADES), from Sandia National Laboratories, was a 2017 R&D 100 Award winner. The winners were announced at The R&D 100 Awards Gala held in Orlando, Florida on Nov. 17, 2017. See the full list of 2017 R&D 100 Award Winners here.

The R&D 100 Awards have served as the most prestigious innovation awards program for the past 56 years, honoring R&D pioneers and their revolutionary ideas in science and technology.

Submissions for the 2018 R&D 100 Awards are now being accepted. Any new technical product or process that was first available for purchase or licensing between January 1, 2017 and March 31, 2018, is eligible for entry in the 2018 awards. Entries for the R&D 100 Awards can be entered under five general product categories— Mechanical Devices/ Materials, IT/Electrical, Analytical/Test, Process/Prototyping, and Software/Services.

The deadline is July 2, 2018 

To apply visit: https://www.rd100conference.com/how-enter-rd-100-awards/

Rather than just booting cyber threats from a network, a new cyber security system isolates the bad actors in a copy of the breached environment and then gathers as much information from them as possible, providing key insight to prevent future attacks.

Researchers from Sandia National Laboratories have developed the High-Fidelity Adaptive Deception & Emulation System (HADES), a cyber-security system that officials hope will put a dent in the $450 billion lost annually due to cybercrime by allowing in-house personnel to learn as much as they can about any potential attacker. HADES was a 2017 R&D 100 Award recipient.

Vincent Urias, a principal member of the technical staff at Sandia, said that the traditional way of ridding networks of adversaries leaves corporations and government entities with more questions than answers as to how their networks were breached and what happened once they were breached.

“In the world we live in today, the instinct in terms of cyber security, especially when it is compromised in a network, is to stop the action,” Urias said in an interview with R&D Magazine. “By doing that you lose a lot of valuable information about what the adversary is doing, how much information they have and what they are actually trying to get to.

“Given the changes in computing and given the changes in networking could we leverage that to our advantage to start looking at ways to make the adversaries’ job harder,” he added. “So we started building and leveraging this infrastructure that could specify large and large numbers of nodes, that look and field like machines you find on your open enterprise.”

HADES takes advantage of several different emerging technologies in cloud computing, software-defined networking, virtual machine introspection (VMI), and dynamic deception and analytics, to change how cyber defenders protect their networks, while gaining insight into possible intruder’s intentions.

“We developed a series of technologies that enabled us to say that if there is a machine that’s compromised, we can move the state of that virtual machine and that virtual machine to another part of the network and start emulating the world around it,” Urias said.

The new system aids in the detection of cyber intrusions, live-migrates the attacker into a realistic deception environment that is a high fidelity functioning copy of the breached environment, isolates the deception environment from the host system to protect its data, and offers the defender an undetectable but omniscient view of the attacker’s movements.  

The system then enables instantaneous adjustment to the adversary’s changing attack vectors through modifications to the deception environment.

This provides the user with a rich set of analytics about the attack both in real-time and for post-event analysis that will help the user develop improved protections against future attacks. 

“So we can watch the users, we can watch the adversaries’ behavior, reconstruct our tools from memory transparently to them, enabling us to develop our intelligence on the fly,” Urias said.

Urias said the target customers for HADES would likely be large corporations, as well as government agencies.

According to a 2016 survey, 53 percent of cyber security professionals believe that modern hacking tools could easily break passwords within their organizations. In the same survey, 45 percent of those surveyed said they believe they are unprepared to defend against a cyber-attack.

However, Urias said part of the success of cybersecurity systems like HADES is that they are so sophisticated that bad actors usually think twice before attacking a network that is secure.

“I think there is always going to be an evolution but part of it is there is a cognitive component to this,” he said. “When you introduce the idea of doubt into something, even just saying that you are running deception, changes a networks behavior.”

In recent years, both popular websites and government agencies have been under attack from cyber threats.

In 2015, nearly 20 million personnel records at the U.S. Personnel Office were compromised in an attack experts believe was backed by the Chinese government, when the infidelity site Ashley Madison lost the credit card data of some 11 million users—along with their confidentiality.

In 2016, Yahoo disclosed that 500 million accounts had been hacked in 2014 and that another billion accounts had been compromised in 2013—including user information that could be used to access or reset users’ non-Yahoo accounts. Such breaches often result in identity fraud and theft, as well as financial reparation by the networks’ owners.