A Roadmap for Cybersecurity Research

A Roadmap for Cybersecurity Research November 2009 Contents Executive Summary................................................................................................................................................iii Introduction..............................................................................................................................................................v Acknowledgements.................................................................................................................................................ix Current Hard Problems in INFOSEC Research 1. Scalable Trustworthy Systems ...................................................................................................................1 2. Enterprise-Level Metrics (ELMs) ..........................................................................................................13 3. System Evaluation Life Cycle...................................................................................................................22 4. Combatting Insider Threats ....................................................................................................................29 5. Combatting Malware and Botnets ..........................................................................................................38 6. Global-Scale Identity Management ........................................................................................................50 7. Survivability of Time-Critical Systems ..................................................................................................57 8. Situational Understanding and Attack Attribution ..............................................................................65 9. Provenance .................................................................................................................................................76 10. Privacy-Aware Security ..........................................................................................................................83 11. Usable Security ........................................................................................................................................90 Appendices Appendix A. Interdependencies among Topics ..............................................................................................A1 Appendix B. Technology Transfer ....................................................................................................................B1 Appendix C. List of Participants in the Roadmap Development .................................................................C1 <a href="#0_0">Appendix </a><a href="#0_0">D</a><a href="#0_0">. </a><a href="#0_0">A</a><a href="#0_0">cronyms ...................................................................................................................................... D1 </a>iExecutive Summary Executive Summary e United States is at a significant decision point. We must continue to defend our current systems and networks and at the same time attempt to “get out in front” of our adversaries and ensure that future generations of technology will position us to better protect our critical infrastructures and respond to attacks from our adversaries. e term “system” is used broadly to encompass systems of systems and networks. is cybersecurity research roadmap is an attempt to begin to define a national R&D agenda that is required to enable us to get ahead of our adversaries and produce the technologies that will protect our information systems and networks into the future. e research, development, test, evaluation, and other life cycle consider- ations required are far reaching—from technologies that secure individuals and their information to technologies that will ensure that our critical infrastructures are much more resilient. e R&D investments recommended in this roadmap must tackle the vulnerabilities of today and envision those of the future. e intent of this document is to provide detailed research and development agendas for the future relating to 11 hard problem areas in cybersecurity, for use by agencies of the U.S. Government and other potential R&D funding sources. e 11 hard problems are: 1. Scalable trustworthy systems (including system architectures and requisite development methodology) 2. Enterprise-level metrics (including measures of overall system trustworthiness) 3. System evaluation life cycle (including approaches for sufficient assurance) 4. Combatting insider threats 5. Combatting malware and botnets 6. Global-scale identity management 7. Survivability of time-critical systems 8. Situational understanding and attack attribution 9. Provenance (relating to information, systems, and hardware) 10.Privacy-aware security 11.Usable security For each of these hard problems, the roadmap identifies critical needs, gaps in research, and research agenda appropriate for near, medium, and long term attention. DHS S&T assembled a large team of subject matter experts who provided input into the development of this research roadmap. e content was developed over the course of 15 months that included three regional multi-day workshops, two virtual workshops for each topic, and numerous editing activities by the participants. iii Introduction Introduction Information technology has become pervasive in every way—from our phones and other small devices to our enterprise networks to the infrastructure that runs our economy. Improvements to the security of this information technology are essential for our future. As the critical infrastructures of the United States have become more and more dependent on public and private networks, the potential for widespread national impact resulting from disruption or failure of these networks has also increased. Securing the nation’s critical infrastructures requires protecting not only their physical systems but, just as important, the cyber portions of the systems on which they rely. e most significant cyber threats to the nation are fundamentally different from those posed by the “script kiddies” or virus writers who traditionally have plagued users of the Internet. Today, the Internet has a significant role in enabling the communications, monitoring, operations, and business systems underlying many of the nation’s critical infrastructures. Cyberattacks are increasing in frequency and impact. Adversaries seeking to disrupt the nation’s critical infrastructures are driven by different motives and view cyberspace as a possible means to have much greater impact, such as causing harm to people or widespread economic damage. Although to date no cyberattack has had a significant impact on our nation’s critical infrastructures, previous attacks have demonstrated that exten- sive vulnerabilities exist in information systems and networks, with the potential for serious damage. e effects of a successful attack might include serious economic consequences through impacts on major economic and industrial sectors, threats to infrastructure elements such as electric power, and disruptions that impede the response and communication capabilities of first responders in crisis situations. e United States is at a significant decision point. We must continue to defend our current systems and networks and at the same time attempt to “get out in front” of our adversaries and ensure that future generations of technology will position us to better protect our critical infrastructures and respond to attacks from our adversaries. It is the opinion of those involved in creating this research roadmap that government-funded research and development (R&D) must play an increasing role to enable us to accomplish this goal of national and economic security. e research topics in this roadmap, however, are relevant not only to the federal government but also to the private sector and others who are interested in securing the future. is cybersecurity research roadmap is an attempt to begin to define a national R&D agenda that is required to enable us to get ahead of our adversaries and produce the technologies that will protect our information systems and networks into the future. e research, development, test, evaluation, and other life cycle consider- ations required are far reaching—from technologies that secure individuals and their information to technologies that will ensure that our critical infrastructures are much more resilient. ese investments must tackle the vulnerabilities of today and envision those of the future. “e time is now near at hand...” — George Washington, July 2, 1776 vHistorical background research programs. e original list has mixes of legacy systems), and the presproven useful in guiding INFOSEC ence of significant, asymmetric threats. e INFOSEC Research Council (IRC) research, and policy makers and planners is an informal organization of govern- may find the document useful in evalu- e area of cybersecurity and the associ- ment program managers who sponsor ating the contributions of ongoing and ated research and development activities information security research within the proposed INFOSEC research programs. have been written about frequently over U.S. Government. Many organizations However, the significant evolution of the past decade. In addition to both have representatives as regular members technology and threats between 1999 the original IRC HPL in 1999 and the of the IRC: Central Intelligence Agency, and 2005 required an update to the list. revision in 2005, the following reports Department of Defense (including the erefore, an updated version of the have discussed the need for investment Air Force, Army, Defense Advanced HPL was published in November 2005. in this critical area: Research Projects Agency, National is updated document included the ƒ Toward a Safer and More Secure Cyberspace Reconnaissance Office, National Secu- following technical hard problems from rity Agency, Navy, and Office of the the information security perspective: ƒ Federal Plan for Cyber Security and Information Assurance Research and Development Secretary of Defense), Department of Energy, Department of Homeland Security, Federal Aviation Administra- tion, Intelligence Advanced Research Projects Activity, National Aeronautics 1. Global-Scale Identity Management 2. Insider reat 3. Availability of Time-Critical Systems ƒ Cyber Security: A Crisis of Prioritization and Space Administration, National 4. Building Scalable Secure Systems ƒ Hardening the Internet Institutes of Health, National Institute of Standards and Technology, National Science Foundation, and the Technical Support Working Group. In addition, the IRC is regularly attended by partner organizations from Canada and the United Kingdom. 5. Situational Understanding and Attack Attribution 6. Information Provenance 7. Security with Privacy ƒ Information Security Governance: A Call to Action ƒ The National Strategy to Secure Cyberspace 8. Enterprise-Level Security Metrics ƒ Cyber Security Research and Development Agenda ese eight problems were selected e IRC developed the original Hard as the hardest and most critical chal- Problem List (HPL), which was com- lenges that must be addressed by the ese reports can be found at <a href="/goto?url=http://www.cyber.st.dhs.gov/documents.html" target="_blank">http:// </a>posed in 1997 and published in draft INFOSEC research community if trust- <a href="/goto?url=http://www.cyber.st.dhs.gov/documents.html" target="_blank">www.cyber.st.dhs.gov/documents.html </a>form in 1999. e HPL defines desir- worthy systems envisioned by the U.S. able research topics by identifying a set Government are to be built. INFOSEC of key problems from the U.S. Govern- problems may be characterized as “hard” Current context ment perspective and in the context of for several reasons. Some problems are On January 8, 2008, the President IRC member missions. Solutions to hard because of the fundamental techni- issued National Security Presiden- these problems would remove major cal challenges of building secure systems, tial Directive 54/Homeland Security barriers to effective information secu- others because of the complexity of Presidential Directive 23, which for- rity (INFOSEC). e Hard Problem information technology (IT) system malized the Comprehensive National List was intended to help guide the applications. Contributing to these Cybersecurity Initiative (CNCI) and a research program planning of the IRC problems are conflicting regulatory and series of continuous efforts designed to member organizations. It was also hoped policy goals, poor understanding of establish a frontline defense (reducing that nonmember organizations and operational needs and user interfaces, current vulnerabilities and preventing industrial partners would consider these rapid changes in technology, large het- intrusions), defending against the full problems in the development of their erogeneous environments (including spectrum of threats by using intelligence vi and strengthening supply chain security, influence in networking and IT systems, interagency coordination to ensure cov- and shaping the future environment by components, and standards among U.S. erage of all the topics. enhancing our research, development, competitors. Federal agencies with and education, as well as investing in mission-critical needs for increased Each of the following topic areas is <ul style="display: flex;"><li style="flex:1">“leap-ahead” technologies. </li><li style="flex:1">cybersecurity, which includes informa- treated in detail in a subsequent section </li></ul>tion assurance as well as network and of its own, from Section 1 to Section 11. e vision of the CNCI research com- system security, can play a direct role munity over the next 10 years is to in determining research priorities and “transform the cyber-infrastructure so assessing emerging technology proto- that critical national interests are pro- types. Moreover, through technology tected from catastrophic damage and transfer efforts, the federal government our society can confidently adopt new can encourage rapid adoption of the 1. Scalable trustworthy systems (including system architectures and requisite development methodology) 2. Enterprise-level metrics (including measures of overall system trustworthiness) 3. System evaluation life cycle (including approaches for sufficient assurance) <ul style="display: flex;"><li style="flex:1">technological advances.” </li><li style="flex:1">results of leap-ahead research. Technol- </li></ul>ogy breakthroughs that can curb or Two components of the CNCI deal break the resource-draining cycle of with cybersecurity research and develop- security patching will have a high likeli- ment—one focused on the coordination hood of marketplace implementation. of federal R&D and the other on the development of leap-ahead technologies. As stated previously, this Cybersecu- rity Research Roadmap is an attempt 4. Combatting insider threats 5. Combatting malware and botnets 6. Global-scale identity management No single federal agency “owns” the to begin to address a national R&D issue of cybersecurity. In fact, the agenda that is required to enable us to federal government does not uniquely get ahead of our adversaries and produce own cybersecurity. It is a national and the technologies that will protect our global challenge with far-reaching con- information systems and networks into sequences that requires a cooperative, the future. e topics contained in this comprehensive effort across the public roadmap and the research and developand private sectors. However, as it has ment that would be accomplished if the done historically, U.S. Government roadmap were implemented are, in fact, R&D in key technologies working in leap-ahead in nature and address many 7. Survivability of time-critical systems 8. Situational understanding and attack attribution 9. Provenance (relating to information, systems, and hardware) 10.Privacy-aware security 11.Usable security close cooperation with private-sector of the topics that have been identified Eight of these topics (1, 2, 4, 6, 7, 8, partners can jump-start the necessary in the CNCI activities fundamental technical transformation. 9, 10) are adopted from the November 2005 IRC Hard Problem List [IRC05] and are still of vital relevance. e other three topics (3, 5, 11) represent Document format e leap-ahead strategy aligns with the consensus of the nation’s networking e intent of this document is to additional areas considered to be of and cybersecurity research communi- provide detailed research and develop- particular importance for the future. ties that the only long-term solution to ment agendas for the future relating to the vulnerabilities of today’s network- 11 hard problem areas in cybersecurity, e order in which the 11 topics are ing and information technologies is to for use by agencies of the U.S. Govern- presented reflects some structural simiensure that future generations of these ment and anyone else that is funding larities among subgroups of the topics technologies are designed with secu- or doing R&D. It is expected that each and exhibits clearly some of their major rity built in from the ground up. e agency will find certain parts of the interdependencies. e order proceeds leap-ahead strategy will help extend document resonant with its own needs roughly from overarching system con- U.S. leadership at a time of growing and will proceed accordingly with some cepts to more detailed issues—except vii for the last topic—and has the following Background ƒ What R&D is evolutionary and what is more basic, higher risk, game changing? structure: ƒ What is the problem being addressed? a. Topics 1–3 frame the overarching problems. ƒ Resources ƒ What are the potential threats? ƒ Measures of success ƒ Who are the potential beneficiaries? What are their respective needs? b. Topics 4–5 relate to specific major threats and needs. ƒ What needs to be in place for test and evaluation? c. Topics 6–10 relate to some of the “ilities” and to system concepts required for implementing the previous topics. ƒ To what extent can we test real systems? ƒ What is the current state of the practice? ƒ What is the status of current Following the 11 sections are three appendices: research? Topic 11, usable security, is different from the others in its cross-cutting Future Directions Appendix A: Interdependencies among Topics nature. If taken seriously enough, it ƒ On what categories can we can influence the success of almost all the other topics. However, some sort of transcendent usability requirements need to be embedded pervasively in all the other topics. subdivide the topics? Appendix B: Technology Transfer ƒ What are the major research <ul style="display: flex;"><li style="flex:1">gaps? </li><li style="flex:1">Appendix C: List of Participants in the </li></ul>Roadmap Development ƒ What are some exemplary problems for R&D on this topic? Each of the 11 sections follows a similar format. To get a full picture of the problem, where we are, and where we need to go, we ask the following questions: ƒ What are the challenges that must be addressed? ƒ What approaches might be desirable? References <ul style="display: flex;"><li style="flex:1">[IRC2005] </li><li style="flex:1">INFOSEC Research Council Hard Problem List, November 2005 </li></ul><a href="/goto?url=http://www.cyber.st.dhs.gov/docs/IRC_Hard_Problem_List.pdf" target="_blank">http://ww</a><a href="/goto?url=http://www.cyber.st.dhs.gov/docs/IRC_Hard_Problem_List.pdf" target="_blank">w</a><a href="/goto?url=http://www.cyber.st.dhs.gov/docs/IRC_Hard_Problem_List.pdf" target="_blank">.cyber.st.dhs.gov/docs/IRC_Hard_Problem_List.pdf. </a>[USAF-SAB07] United States Air Force Scientific Advisory Board, Report on Implications of Cyber Warfare. Volume 1: Executive Summary and Annotated Brief; Volume 2: Final Report, August 2007. For Official Use Only. Additional background documents (including the two most recent National Research Council study reports on cybersecurity) can be found online. (<a href="/goto?url=http://www.cyber.st.dhs.gov/documents.html" target="_blank">http://www.cyber.st.dhs.gov/documents.html</a>). viii Acknowledgements Acknowledgements e content of this research roadmap was developed over the course of 15 months that included three workshops, two phone sessions for each topic, and numerous editing activities by the participants. Appendix C lists all the participants. e Cyber Security program of the Department of Homeland Security (DHS) Science and Technology (S&T) Directorate would like to express its appre- ciation for the considerable amount of time they dedicated to this effort. DHS S&T would also like to acknowledge the support provided by the staff of SRI International in Menlo Park, CA, and Washington, DC. SRI is under contract with DHS S&T to provide technical, management, and subject matter expert support for the DHS S&T Cyber Security program. ose involved in this effort include Gary Bridges, Steve Dawson, Drew Dean, Jeremy Epstein, Pat Lincoln, Ulf Lindqvist, Jenny McNeill, Peter Neumann, Robin Roy, Zach Tudor, and Alfonso Valdes. Of particular note is the work of Jenny McNeill and Peter Neumann. Jenny has been responsible for the organization of each of the workshops and phone sessions and has worked with SRI staff members Klaus Krause, Roxanne Jones,

A Roadmap for Cybersecurity Research

Details

Download

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

Support