RESEARCH AND DEVELOPMENT EXCHANGE PROCEEDINGS: RESEARCH AND DEVELOPMENT ISSUES TO ENSURE TRUSTWORTHINESS IN TELECOMMUNICATIONS AND INFORMATION SYSTEMS THAT DIRECTLY OR INDIRECTLY IMPACT NATIONAL SECURITY AND EMERGENCY PREPAREDNESS A SYMPOSIUM SPONSORED BY THE PRESIDENT’S NSTAC IN CONJUNCTION WITH THE WHITE HOUSE OFFICE OF SCIENCE AND TECHNOLOGY POLICY AND THE GEORGIA TECH INFORMATION SECURITY CENTER AT THE GEORGIA INSTITUTE OF TECHNOLOGY GEORGIA INSTITUTE OF TECHNOLOGY ATLANTA, GEORGIA MARCH 13-14, 2003 The President’s National Security Telecommunications Advisory Committee MEMORANDUM FOR THE INDUSTRY EXECUTIVE SUBCOMMITTEE SUBJECT: 2003 NSTAC Research and Development Exchange Proceedings On March 13-14, 2003, the President’s National Security Telecommunications Advisory Committee (NSTAC) held its fifth Research and Development (R&D) Exchange, in co- sponsorship with the White House Office of Science and Technology Policy (OSTP) and the Georgia Tech Information Security Center (GTISC) at the Georgia Institute of Technology. The event was hosted at the Georgia Centers for Advanced Telecommunications Technology in Atlanta, Georgia. The purpose of the event was to: 1) Explore and prioritize key R&D issues related to the trustworthiness of national security and emergency preparedness (NS/EP) telecommunications and the related, networked information systems; 2) Identify and frame key R&D related policy issues associated with the trustworthiness of NS/EP telecommunications and related information systems for future consideration and study by the President’s NSTAC; 3) Provide input to the OSTP in its preparation of the President’s R&D agenda and budgetary requests; and 4) Identify and characterize barriers and impediments that inhibit the R&D of trustworthy networked information systems. Participants engaged in discussion and debate not only during breakout and plenary sessions but also during their breaks and meals. All contributions were “not-for-attribution” unless specifically approved by the contributor. The participants collectively identified several issues or concerns regarding or impacting the trustworthiness of NS/EP telecommunications and information systems, including: a sense of frustration and urgency regarding what they perceived as a lack of substantive action on cyber security issues; the need to improve threat identification and analysis and improve methods to share and use that information across industry, Government, and academia; the need to strike a balance between better engineering of software and hardware with efforts to improve human factors; and the realization that the definition and nature of NS/EP telecommunications continued to change. The insights, conclusions, and recommendations contained within these Proceedings result from the Exchange and are solely attributable to the combined and unique contributions of Exchange participants and invited speakers. The results indicate that the Industry Executive Subcommittee and the NSTAC should continue to work with OSTP and other NSTAC stakeholders to explore key issues related to R&D of NS/EP telecommunications and information systems. The R&D Exchange Task Force greatly appreciates the support of the OSTP, Georgia Tech, and our breakout session facilitators. In particular, we thank the Director of OSTP, the Honorable Dr. John H. Marburger, for his personal engagement, which contributed greatly to the event’s success. We thank Dr. Seymour E. Goodman, Professor of Computing and International Affairs, R&D Exchange i The President’s National Security Telecommunications Advisory Committee Georgia Tech, and Co-Director, GTISC, for his untiring support and contributions. We are grateful as well to the many staff and contract support contributors who performed so well, attending to so many details. Finally, many thanks to the co-sponsoring companies acknowledged in the Proceedings. Respectfully, Guy L. Copeland, CSC Chair, Research and Development Exchange Task Force ii R&D Exchange The President’s National Security Telecommunications Advisory Committee ACKNOWLEDGEMENTS The President’s National Security Telecommunications Advisory Committee (NSTAC) would like to thank the representatives from industry, Government, and academia who participated in the fifth Research and Development (R&D) Exchange held in conjunction with the White House Office of Science and Technology Policy (OSTP) and the Georgia Tech Information Security Center at the Georgia Institute of Technology from March 13 to 14, 2003, in Atlanta, Georgia. NSTAC would especially like to acknowledge the important contributions of the OSTP; the Office of the Manager, National Communications System; and the Georgia Institute of Technology for the planning of the 2003 R&D Exchange. Special thanks also go to our Keynote Speaker, the Honorable Dr. John H. Marburger, Director, OSTP; our Luncheon Speaker, Mr. F. Duane Ackerman, Vice-Chair of the President’s NSTAC, and Chairman and Chief Executive Officer, BellSouth; and our hosts at the Georgia Institute of Technology, Dr. G. Wayne Clough, President of the Georgia Institute of Technology; Dr. Richard DeMillo, Imlay Dean of Computing and Director, Georgia Tech Information Security Center; and Dr. Seymour Goodman, Professor of Computing and International Affairs, and Co-Director of the Georgia Tech Information Security Center. We would also like to thank our breakout session facilitators, Dr. Carl Landwehr, National Science Foundation; Mr. Sami Saydjari, Cyber Defense Agency; Mr. David Barron, BellSouth; Dr. Marisa Reddy, U.S. Secret Service; Mr. Michael Vatis, Dartmouth College; Mr. Scott Charney, Microsoft; Dr. Stephen Squires, Hewlett-Packard; Mr. Shannon Kellogg, Information Technology Association of America; Mr. Phillip Lacombe, Veridian; and Mr. Jim Craft, Raytheon. Finally, NSTAC would like to thank the following organizations for sponsoring the 2003 NSTAC R&D Exchange: Conference Co-Sponsors NSTAC Sponsors of R&D Exchange Events R&D Exchange iii The President’s National Security Telecommunications Advisory Committee TABLE OF CONTENTS EXECUTIVE SUMMARY .................................................................................................... ES-1 1. INTRODUCTION................................................................................................................1-1 1.1 BACKGROUND .........................................................................................................1-1 1.2 PURPOSE....................................................................................................................1-2 1.3 PROCEEDINGS ORGANIZATION...........................................................................1-2 2. OPENING PLENARY SESSION.......................................................................................2-1 2.1 KEYNOTE ADDRESS...............................................................................................2-1 2.2 NSTAC OVERVIEW..................................................................................................2-2 3. LUNCHEON PRESENTATION........................................................................................3-1 4. BREAKOUT SESSIONS ....................................................................................................4-1 4.1 CYBER SECURITY AND SOFTWARE, GROUP I..................................................4-1 4.1.1 THE CURRENT OPERATING ENVIRONMENT ........................................4-1 4.1.2 RESEARCH PRIORITIES..............................................................................4-2 4.1.3 THE PATH FORWARD.................................................................................4-3 4.2 CYBER SECURITY AND SOFTWARE, GROUP II ................................................4-3 4.2.1 THE CURRENT OPERATING ENVIRONMENT ........................................4-3 4.2.2 RESEARCH PRIORITIES..............................................................................4-4 4.2.3 IMPEDIMENTS TO R&D..............................................................................4-4 4.2.4 THE PATH FORWARD.................................................................................4-5 4.3 HUMAN FACTORS...................................................................................................4-5 4.3.1 THE CURRENT OPERATING ENVIRONMENT ........................................4-5 4.3.2 RESEARCH PRIORITIES..............................................................................4-7 4.3.3 IMPEDIMENTS TO R&D..............................................................................4-7 4.3.4 THE PATH FORWARD.................................................................................4-8 4.4 PHYSICAL SECURITY.............................................................................................4-8 4.4.1 THE CURRENT OPERATING ENVIRONMENT ........................................4-9 4.4.2 RESEARCH PRIORITIES..............................................................................4-9 4.4.3 IMPEDIMENTS TO R&D............................................................................4-10 4.4.4 THE PATH FORWARD...............................................................................4-11 4.5 INTEGRATION ........................................................................................................4-11 4.5.1 CURRENT RESEARCH AND OPERATING ENVIRONMENTS .............4-11 4.5.2 PRIORITIES FOR RESEARCH INTEGRATION .......................................4-12 4.5.3 IMPEDIMENTS TO RESEARCH INTEGRATION....................................4-12