# Presentation: 513847

## Cybersecurity Research Challenges

- Cybersecurity Summit, Crystal City, VAMay 8, 2008

- Jeannette M. WingAssistant DirectorComputer and Information Science and Engineering DirectorateNational Science Foundationand
- President’s Professor of Computer ScienceCarnegie Mellon University

## Outline

- The Setting: Then and Now
- What’s Missing
- Long-term outlook
- Big picture
- 5 new research areas

- Jeannette M. Wing

- Cybersecurity

## The Setting: Then and Now

- We are at risk.  Increasingly, America depends on computers.  They control power delivery, communications, aviation, and financial services.  They are used to store vital information, from medical records to business plans to criminal records.  Although we trust them, they are vulnerable—to the effects of poor design and insufficient quality control, to accident, and perhaps most alarmingly, to deliberate attack.  The modern thief can steal more with a computer than with a gun. Tomorrow’s terrorist may be able to do more damage with a keyboard than with a bomb.

- 1991 *Computers at Risk*, National Academies CSTB Study, p. 7.

- 1999 *Trust in Cyberspace*, CSTB Study.

- 2007 *Improving Cybersecurity for the 21**st** Century*, CSTB Study.

- everywhere, everyone, all the time,embedded, invisible, visible,mobile, wearable, handheld, remote,peta, tera, giga, mini, micro, nano,good guys, bad guys

**2001 September 11**

- Jeannette M. Wing

- Cybersecurity

## Slide 4

- Jeannette M. Wing

- Cybersecurity

## What’s Missing in Our Thinking

- Be proactive, not reactive.
- We are using yesterday’s solutions to address today’s threats.
- We should be ready today for tomorrow’s threats.
- We are not.
- Anticipate the future.
- Long-term outlook
- Big picture view
- Foundational research

- Jeannette M. Wing

- Cybersecurity

## Long-Term Outlook: Who and Why

- Threats
- Today: hackers, criminals
- Tomorrow: organized crime, terrorists, nation-state, enemy state
- Motivation
- Today: fame, money
- Tomorrow: power, control
- Attacks
- Use cyberattack as an amplifier of a physical attack
- Cyberspace is an enabler
- Attack the Internet
- More likely as we put more key functionality on-line
- Use cyberspace to hide

- Jeannette M. Wing

- Cybersecurity

## Long-Term Outlook: How

- Today: code-level vulnerabilities
- Flaws in the code
- Tomorrow: component-level vulnerabilities
- Flaws in the design

*aka* *interface mismatch, composition flaws, feature interaction, ...*

-  Simple examples of design-level flaws
-      - Netscape browser and Domain Name Server spoofing attack, Princeton [DFW96]
-      - Google Desktop Search and Java applets, Rice [NFW04]
-      - Microsoft Outlook and IE settings, Microsoft Research and Carnegie Mellon [PW05]

- Jeannette M. Wing

- Cybersecurity

## Big Picture: It’s not just security 

**Trustworthy*** *systems
- Security
- Reliability
- Privacy
- Usability

- Cyber Security and *Information Assurance*

**    ****Holistic** view     Technical: The whole stack

** ** Non-Technical
-         Psychology and human behavior
-            - Usable security	- Social engineering attacks	- Privacy
-            - Insider threat	- Attacker’s motivation
-         Economics, risk management, law, politics

- Jeannette M. Wing

- Cybersecurity

## Credit: NCO/NITRD

- Jeannette M. Wing

- Cybersecurity

## What’s Missing?

- Credit: NCO/NITRD

- Jeannette M. Wing

- Cybersecurity

## 1. Foundations

- New models, logics, and theories for analyzing and reasoning about
- Security
- Reliability
- Privacy
- Usability
- Crypto for quantum

- Jeannette M. Wing

- Cybersecurity

## Foundations: Security Models

- Today: “Security Without Borders”

- Jeannette M. Wing

- Cybersecurity

## Foundations: Logics for Reasoning About Privacy

- This privacy statement goes on for seven screenfuls!

-  Do you read these?
-  What are they saying?
-  Can you trust them?

- Credit: Microsoft

- Jeannette M. Wing

- Cybersecurity

## Foundations: Cryptography

- Quantum/traditional cryptography immune to quantum-based attacks
- Traditional cryptography based on RSA is breakable by Shor’s quantum algorithm

- Credit: Oxford University

- Jeannette M. Wing

- Cybersecurity

## 2. Security Architectures

- What we have
- Point solutions to point problems, e.g.,
- Code-level solutions buffer overruns
- Firewalls for intrusion detection
- What we need
- Integration of solutions
- Up and down the vertical stack, from hardware to appl’ns.
- At each layer, e.g., routers and links at the network layer
-  Compositionality of components and services

- Jeannette M. Wing

- Cybersecurity

## Composition of Components and of Security Policies

- Component A

*Local Security Policy *(SPA)

- Component B

*Local Security Policy *(SPB)

- Jeannette M. Wing

- Cybersecurity

## Google Desktop Search

- Credit: Google

- Jeannette M. Wing

- Cybersecurity

## Netscape and Domain Name Server

- browser

- DNS server

- user.foo.com [1.2.3.4,              1.2.3.5,              1.2.3.6]
- user.bar.com [1.2.3.5,
-               1.2.3.7]

- Names to IP addresses* *mapping

- Jeannette M. Wing

- Cybersecurity

## 3. Security Metrics

- Computing Research Associates Grand Challenges on Trustworthy Computing, November 16-18, 2003 _[http://www.cra.org/grand.challenges](http://www.cra.org/grand.challenges)_
- Challenge #3:
- Within 10 years, develop quantitative information-systems risk management that is at least as good as quantitative financial risk management.

- Jeannette M. Wing

- Cybersecurity

## Measuring the Relative Attack Surface

**2. Windows w/IIS enabled is only slightly worse for Windows Server 2003, in contrast to its predecessors.**

**1. Windows Server 2003 is “more secure” than previous versions.**

**3. Windows in “lockdown” mode for NT4.0 and 2000 are each more secure than raw mode.**

- Jeannette M. Wing

- Cybersecurity

## Attack Surface

- The *attack surface* of a system is the ways in which an adversary can enter the system and potentially cause damage.

- Reduce the attack surface  Increase system’s security

- Jeannette M. Wing

- Cybersecurity

## 4. Privacy

- Today: Threats to citizens’ privacy in many sectors of daily life
- Health, financial, e-commerce, social networks, e-voting
- Fundamental challenge: Once someone learns a secret about you, you cannot take away that knowledge
- Different from security (e.g., revoking access to a file, changing a lock on a door)

- Jeannette M. Wing

- Cybersecurity

## Privacy: A Few Questions to Ponder

- What does privacy mean?
- How do you state a privacy policy?  How can you prove your system satisfies it?
- How do you reason about privacy?  How do you resolve conflicts among different privacy policies?
- Are there things that are impossible to achieve wrt some definition of privacy?
- How do you implement practical mechanisms to enforce different privacy policies?  As they change over time?
- How do you measure privacy? (Is that a meaningful question?)

- Jeannette M. Wing

- Cybersecurity

## Privacy and Confidentiality

- What other
- privacy
- policies does
- the database
- enforce?

- privacy policy

- Jeannette M. Wing

- Cybersecurity

**Notes:**
Unfortunately, such confidentiality policies are embedded in source code.

## Privacy and Software Analysis

- Jeannette M. Wing

- Cybersecurity

## 5. Usability

- The user is the weakest link in security.
- Challenges
- Striking a balance between control and convenience
- Users are human.
- Targets of social engineering attacks
- Sources of insider threats

- Jeannette M. Wing

- Cybersecurity

## Usable Security (IE)

- Clicking Your Way Through Security

- Jeannette M. Wing

- Cybersecurity

## Usable Privacy (Firefox)

**Clicking Your Way Through Privacy**

- Jeannette M. Wing

- Cybersecurity

## Summary of Research Challenges

- New research foci
- Theoretical foundations: models, logics, crypto
- Software architecture
- Metrics
- Privacy
- Usability
- Enhanced investments in existing research foci:
- Software security engineering
- Networking
- Testbeds

- Jeannette M. Wing

- Cybersecurity

## Summary of What’s Missing

- Anticipate tomorrow’s threat.
- Take a broad view.
- Long-term
- Holistic
- Research
- Basic research in new areas
- Enhanced investments in existing areas
*Education*

- Jeannette M. Wing

- Cybersecurity

## 

Global Competitiveness
Cyber SecurityInformation AssuranceScience and Engineering

- Global Competitiveness
- Cyber SecurityInformation AssuranceScience and Engineering

- Jeannette M. Wing

- Cybersecurity

## Cyber Security: The US Leads.

- Asia
- Korea Institute of Information Security and Cryptography (KIISC), est. 1990; now 2000 members, 80 agencies and institutes
- Singapore in 2005 announces $24M for 3 years
- Taiwan’s annual spending is $7M
- Taiwan Institute Security Center (TWISC) founded August 2005; now 20 professors, 30 graduate students
- CyLab/Korea, CyLab/Japan (MS program), CyLab/Singapore (CERT)
- Europe
- Germany on August 18, 2006 announces Europe’s first Cybersecurity Plan
- CyLab/Greece (MS program)
- Middle East
- CyLab/Qatar (CERT), $25M

- Jeannette M. Wing

- Cybersecurity

## Information Assurance: Europe Leads in Some Areas

- Europe invests more than the US in
- High-Confidence Systems (see Insup Lee’s talk)
- Programming Language Theory
- Formal Methods

- Jeannette M. Wing

- Cybersecurity

## Science and Engineering: Who to Watch

- China
- China has the will, the hunger, the power, the people, the smarts
- They want a *home-grown* Nobel Prize winner, Fields Medalist, and/or Turing Award winner within 10 years

**** US still leads in research know-how: quality, integrity,   long-term view

**** But maybe not in 10 years

-   Cyber security: SHA-1 broken by three Chinese (two from Shandong University)

- Jeannette M. Wing

- Cybersecurity

## 

Funding

- Funding

- Jeannette M. Wing

- Cybersecurity

**ACI**

**Thank you!**

- Jeannette M. Wing

- Cybersecurity

## Cyber Security

- NSF funds nearly 100% of the basic research in cybersecurity.
- DARPA: classified
- NSA: classified
- HS-ARPA: a disappointment
- NIST: Security metrics?

- Jeannette M. Wing

- Cybersecurity

## Computer Science

- NSF funds 86% of all university research in computer science.
- We need to add more diversity in funding models and funding styles to basic research in cyber security (and computer science more generally)
- Long-term
- Sustained
- High-risk
- Teams, especially interdisciplinary
- Large systems
- “Old”-DARPA style, NSF center-sized grants

- Jeannette M. Wing

- Cybersecurity

## Two Suggestions for Diversifying the Portfolio

- Look to NIH for *basic and applied* research in CS
- Intellectual argument makes sense
- Medicine, healthcare, biology need fundamental advances in CS to carry their out their own visions for the future.
- It’s not just massive data crunching, it’s fundamental algorithms and data structures.
- Applicable to cybertrust too, e.g., privacy, genomic databases
- Look to DOE for *basic, not just applied* research in CS
- Algorithms: France (INRIA) in 1992 produced the best *mesh generator* TetMesh-GHS3D, _[http://www.simulog.fr/mesh/gener2b.htm](http://www.simulog.fr/mesh/gener2b.htm)_
- Now used at Sandia, Livermore Software Technology, ...
- Software: getting the code right (PL), job scheduling (O/S), ...
- Hardware: 131,072 processors, 207.3 TFLOPS, petabyte storage systems

- Jeannette M. Wing

- Cybersecurity

## Non-Technical Issues

- Classified versus unclassified research
- Foreign students
- Academia-Industry relations
- Focus on IP
- More complex regulations: tax rules, export rules, conflict of interest rules, ...
- Education: Computational thinking will be a necessary skill for everyone to function in today’s modern society.

- I

- A

- G

- Ecosystem

- Jeannette M. Wing

- Cybersecurity

## Readings and References

- CSTB Studies, National Academies
*Computers at Risk*, 1991
*Trust in Cyberspace*, 1999
*Cybersecurity Today and Tomorrow: Pay Now or Pay Later*, 2002
*IT for Counterterrorism: Immediate Actions and Future Possibilities*, 2003
*Improving Cybersecurity for the 21**st** Century: Rationalizing the Agenda*, 2007 (likely).
- Federal Plan for Cyber Security and Information Assurance Research and Development, NSTC IWG on CSIA, April 2006.
- Cyber Security: A Crisis of Prioritization, PITAC, February 2005.
- J.M. Wing, Computational Thinking, *CACM*, March 2006.

- Jeannette M. Wing

- Cybersecurity

## Security Axiom

- Good guys and bad guys are in a never-ending race!

- Jeannette M. Wing

- Cybersecurity

**Notes:**
The Good Guys try to ensure the Security Properties.
The Bad Guys launch the Security Attacks.

## Thank you.

## Academia-Industry Relations

- Old Model
- Go it alone
- Individual work
- Slow, serial
- Focus on ideas
- Basic research
- Less focus on specific ideas
- Simpler regulations
- Funding sufficiency
- Companies had money
- Indirect benefits

- New Model
- Partnered
- Joint work
- Fast, parallel
- Focus on IP
- Bayh-Dole (1985)
- Applied research
- More focus on specific ideas
- Complex regulations
- Tax rules, export rules, COI
- Funding challenges
- Research $ at program manager level
- Direct benefits

- Jeannette M. Wing

- Cybersecurity

## Credits

- Copyrighted material used under Fair Use.  If you are the copyright holder and believe your material has been used unfairly, or if you have any suggestions, feedback, or support, please contact: jsoleil@nsf.gov
- Except where otherwise indicated, permission is granted to copy, distribute, and/or modify all images in this document under the terms of the GNU Free Documentation license, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.  A copy of the license is included in the section entitled “GNU Free Documentation license” (_[http://commons.wikimedia.org/wiki/Commons:GNU_Free_Documentation_License](http://commons.wikimedia.org/wiki/Commons:GNU_Free_Documentation_License)_)

- Jeannette M. Wing

- Cybersecurity