# Presentation: 163360

##  2004 R&D Exchange Workshop

**	****	****	****	****	**

** ****2004 R&D Exchange Workshop**
- Closing Plenary Session
- Breakout Session Reports

**October 29, 2004**

## Cyber/Software Security Breakout Session Report

**	****	****	****	****	**

**Cyber/Software Security Breakout Session Report**
**Ms. Cynthia Irvine, Naval Postgraduate School**
**Mr. Mike Tiddy, Lucent**

##  Recent Progress

*** ******Recent Progress***

**  **
** **
**	****	**
**	****	****	****	**
**	**

**  **
**Since the March 2003 RDX Workshop, progress has been made in Cyber/Software Security to advance and ensure the trustworthiness:**
- _Long Term_:  Not much progress
- _Short Term_:
- Code Scanning Software
- Industry adoption of Software Development Best Practices
- More information sharing between companies
- More prevalence of Code Signing, although still lacks verification of signatures
- BGP work
- SPF and BCP38 (packet filtering) are being worked
**	****  ****	****	**

##  Critical Challenges and New Priorities

*** ******Critical Challenges and New Priorities***

**  **
** **
**	****	**
**	****	****	****	**
**	**

**  **
**Members of the Cyber/Software Security breakout session identified the following critical challenges and new priorities for further R&D:**
**Advancements slow because products not commercially viable**
**More collaboration and information sharing needed among stakeholders**
**Interdependencies among critical infrastructures and communications providers**
**Developing parameters for trustworthiness in the changed business environment **
**Competitive constraints prohibit industry from certain collaboration**
**Encryption vs. law enforcement priorities**

##  Agenda for Action 

*** ******Agenda for Action ***

**  **
**The following issues warrant further study by the R&D community:**
**Fund, articulate and promote NS/EP Capability and Requirements in the converging and Next Generation Network Environments**
**Cross Band Communications**
**Priority on Packet Switched Networks **
**Fund R&D authentication, authorization and prioritization in a converged environment (cross band)**
**Transport availability (End-to-End)**
**Application availability**
**	****  ****	****	**

##  Agenda for Action 

*** ******Agenda for Action ***

**  **
**The following issues warrant further study by the R&D community:**
**Fund basic research to uncover critical interdependencies and vulnerabilities that can affect NS/EP objectives**
**Explore impact of critical infrastructures and communications systems interdependencies upon NS/EP requirements, such as: power, pipelines, etc.**
**Develop technologies to guarantee service availability**
**Conduct threat modeling and model validation techniques**
**Fund research that extends the utilization of cyber and physical sensors and early warning systems to maintain NS/EP requirements in a converged environment**
**	****  ****	****	**

##  Agenda for Action 

*** ******Agenda for Action ***

**  **
**The following issues warrant further study by the R&D community:**
**Develop metrics for assessing performance, security and reach of converged networks’ ability to meet NS/EP requirements**
**Explore the creation of baseline, audit/forensic standards analysis, and the ability of incentives to increase their use**
**	****  ****	****	**

## Human Factors Breakout Session Report

**	****	****	****	****	**

**Human Factors Breakout Session Report**
**Dr. John Arquilla, Naval Postgraduate School**
**Ms. Cristin Flynn Goodwin, BellSouth**

##  Critical Challenges and New Priorities

*** ******Critical Challenges and New Priorities***

***  ***
*** ***
***	******	***
***	******	******	******	***
***	***

**  **
**Members of the human factors breakout session identified the following critical challenges and new priorities for further R&D:**
**  ****Trustworthiness may not be realizable**
- Risk analysis, verification tools as tools for building confidence
- Willingness to sacrifice security for availability in NS/EP situations
-   **Authentication & Identity Management**
- Disclosure of identity:  anonymity (privilege) v. accountability (requirement)
- Multi-faceted roles, institutional constraints
- Control and management of personal information
-   **Transmission of knowledge**
- Promulgation and implementation of best (or worst) practices
- Mining personal and organizational experience
-   **Optimal hybridization of decision systems**
- Ideal division of labor between humans and computer systems
- Development of system to assess ideal equilibrium
-   **Delegation of responsibilities to individuals, Government, and enterprise**
- Collective good and collective action
- Incentive systems (or disincentives, consequences)
- Education, user awareness, training at all levels

##  Roles & Responsibilities

*** ******Roles & Responsibilities***

***  ***
***	******	***
***	***

**  **
**Unique roles and responsibilities in funding and advancing trustworthiness R&D:**
**R&D Investments and Contributions by Discipline**

| Technological |  Authentication & Identity Management (perimeter defense)
 Enforcement of strict code attribution, integrity controls |
| --- | --- |
| Sociological / Psychological |  Exploitation / subversion of technology
 Public campaign – convey knowledge, articulate ideal, educate
 Collective good, economic incentives/disincentives
  Redefinition of the (virtual) insider  |
| Organizational |  Optimal hybridization of decision systems
 Clarifying the culture of security (currently not a priority, identifying    where it fits into the organizational hierarchy) |
| Legal & Regulatory Policy |  Authentication implications for privacy / civil liberties
 |

##  R&D Agenda for Action 

*** ******R&D Agenda for Action ***

***Research issues:***** **
**Balance security v. availability in NS/EP situations**
- Risk management model and consequence management  framework to address the need to use available communications when secure communications are not available
**Improve security without achieving full trustworthiness**
- What are the metrics to measure security?
- Develop standardized factors, criteria that are generalizable
**Determine optimal hybridization (managing manual/automated interactions)**
- Assess role of human judgment under security uncertainty
- Modeling and design methods across manual and automated interactions
**Identify and convey ideal requirements and responsibilities for user**
- Government / enterprise / individual and network / system / user
- Investigate impediments (including usability), self-education tools
**Understand relationship between Internet relay chat (IRC) and security**
- Investigate implications of illegal IRC activities and corresponding impact of elimination
***Policy issues:***
- Promote standards and understand legal implications of authentication and identity management related to privacy
- Explore the human factor in software and architecture development

##  Policy Issues for Further Study

**  **
**	****	**
**	**

**  **
**Based on our discussion, the following policy issues are among those that should be considered by OSTP & DHS:  **
**Creation of a profile of the *****ideal***** user (individual, Government, enterprise)**
- NS/EP ideal users and citizen ideal users
- Gather and diffuse knowledge (virtual pulpit)
**Migration of device development to mirror reality of inherently untrustworthy devices**
**Optimal hybridization – where can humans be taken out and where must they be put back in for mitigation strategies?**
**Several issues also merit further study by the NSTAC:**
**Legal and Regulatory Task Force: Understand the implications of privacy and authentication, identity management**

## Integration Breakout Session Report

**	****	****	****	****	**

**Integration Breakout Session Report**
**Dr. George Dinolt, Naval Postgraduate School**
**Mr. Frank Cantarelli, Lucent**

##  Recent Progress

*** ******Recent Progress***

**  **
** **
**	****	**
**	****	****	****	**
**	**

**  **
**Since the March 2003 RDX Workshop, progress has been made in Integration to advance and ensure the trustworthiness:**
_***NSTAC Influenced Progress:***_
**HSPD-7 and HSPD-12 **
**NSF/DHS sponsored research:**
**EMIST and PREDICT programs**
**Development of the DETER Testbed**
**NSF cyber TRUST program**
**DHS cyber security research program**
**Implementation of WPS**
_***Additional Progress:***_
**Integration of CAC cards**
**DHS SAFECOM program/ APCO25 - first responder radio service/standards**
**Trusted Computer Working Group**
**CYBERCiege**
**DoDD 8100.2 – DoD Wireless Security Policy**
*	**  **	**	*

##  Critical Challenges and New Priorities

*** ******Critical Challenges and New Priorities***

**  **
** **
**	****	**
**	****	****	****	**
**	**

**  **
**Members of the Integration breakout session identified the following critical challenges and new priorities for further R&D:**
**Protocol interoperability**
**Research on economic models and understanding the interdependencies of these models**
**Enhanced survivability in the integrated network:**
**Intelligent network infrastructure (e.g., self healing networks)**
**Modeling and simulation of the integrated, survivable network**
**Recovery and reconstitution**
**Access and traffic prioritization**
**Security in the integrated network, examining the NSTAC vision of the NGN**
**Ubiquitous interoperable authentication of parties and devices**
**Identity management**
**Scalable key management**
** **
**The challenges of understanding interdependencies of the integrated network, including architectural, sector, and user environment**
**Deperimeterization, including the examination of an end to end view of the network **
**The intensity of zero day threats**

##  Collaboration & Information Sharing

*** ******Collaboration & Information Sharing***

**  **

**  **
**As communities of interest shift, the following opportunities for collaboration and information sharing exist in the area of Integration that could advance trustworthiness R&D:**
**Joint exercises must be conducted:**
**Public/private**
**Cross-sectoral**
**Physical and cyber, simultaneously examined**
**Information-sharing culture issues**
**Smarter and more focused information sharing and analysis**
**Recalibration of legislative policy developed post-9/11 (i.e. Safety Act)**
**Globalization**
**Process and criteria for developing an NS/EP telecom/IT technology roadmap**

##  Roles & Responsibilities

*** ******Roles & Responsibilities***

**  **
**	****	**
**	**

**  **
**Industry, academia, and Government all have unique roles and responsibilities in funding and advancing trustworthiness R&D:**
**R&D Investments and Contributions by Sector**

| Academia | Educate next generation of human capital, develop basic and generic applied research, attack and defend very large networks |
| --- | --- |
| Industry | Provide data, provide test sets, provide threat data, share research priorities |
| Government | Provide test sets, provide threat data, provide information sharing, provide predictable funding profiles for the long-term, R&D priorities |
| Others? | Collaboration |

##  Policy Issues for Further Study

*** ******Policy Issues for Further Study***

**  **
**	****	**
**	**

**  **
**Based on our discussion, the following policy issues should be considered by OSTP & DHS: **
**Need for improved policy framework to guide evolution of telecommunications infrastructure, including NS/EP **
**Examine options for how the Government can provide incentives to industry to ensure new systems and technologies can integrate with one another**
**Identify approaches to prepare to deal with ‘high impact-low probability’ events**
**Several issues also merit further study by the NSTAC:**
**Joint exercises to examine interdependencies between systems**

##  Agenda for Action 

*** ******Agenda for Action ***

**  **
**An Agenda for Action should: **
**Improve policy framework to evolve telecommunications infrastructure, ensuring NS/EP needs are met (OSTP)**
**Develop investment plan for the secure network architecture required for NS/EP**
**Determine whether existing Presidential crisis authorities are sufficient in an integrated network (OSTP)**
**Is existing technology capable of allowing those activities to be executed?**
**Conduct joint exercises to examine interdependencies between systems (DHS IAIP)**
**Simulate and model survivable networks in a testbed (DHS S&T, DARPA, NSF, Industry)**
**Undertake research for technology to accelerate reconstitution and recovery (DHS S&T, Industry)**
**Develop standards to integrate token-based (extensible) authentication to enable appropriate priority-based bandwidth/resource utilization (NIST, NCS, Inter-agency effort)****	****  ****	****	**

## Physical Security Breakout Session Report

**	****	****	****	****	**

**Physical Security Breakout Session Report**
**Dr. Matt Carlyle, Naval Postgraduate School**
**Mr. David Barron, BellSouth**

##  Recent Progress

*** ******Recent Progress***

**  **
**Since the March 2003 RDX Workshop, progress has been made in physical security to advance and ensure the trustworthiness:**
**	****  ****	****	**

**Trusted Access Task Force has drafted recommendations to the President (pending final NSTAC approval) regarding background screening and credentialing standards**
**The NSIE and the Legislative and Regulatory Task Force is currently examining information availability (drawing critical information from the public domain)**
**Various national labs are undertaking modeling and simulation activities towards defense of networks and critical infrastructures many with NS/EP implications (DITRA, Los Alamos, Sandia National Labs)**
**Progress in anomaly detection?  Likely there is niche sector specific work here that the group is currently unaware of**
**Biometrics:  Overwhelming drive to get this done across industries including ongoing DHS and DoD work**
**Impediments:  Broadly phrased request for threat information**

##  Critical Challenges and New Priorities

*** ******Critical Challenges and New Priorities***

**  **
** **
**	****	**
**	****	****	****	**
**	**

**  **
**Members of the Physical Security breakout session identified the following critical challenges and new priorities for further R&D:**

**Lack of clarity regarding the subject of criticality**
**Specifically, how do you define what is critical and take into account the different missions (homeland defense, NS/EP, national economic, and customer service) that the telecommunications infrastructure serves**
**The definition will drive investment, risk assessments, and response and recovery efforts as well as assist in determining what information is acceptable for the private sector to share via the public domain**
**Mutual dependency between the electric power and telecommunications infrastructure**
**Should the two infrastructures be viewed as one**
**Proliferation of non-traditional communications technologies (wireless, cable, etc.) and the lack of standards relating to redundancy and service levels**
**Guidelines for effective information sharing, specifically between government and industry regarding threats and vulnerabilities**

##  Collaboration & Information Sharing

*** ******Collaboration & Information Sharing***

**  **

**As communities of interest shift, the following opportunities for collaboration and information sharing exist in the area of physical security that could advance trustworthiness R&D:**

**Define criticality and identify what assets are critical based on the defined primary mission of the infrastructure**
**Model physical interdependencies within the infrastructure and with other infrastructures, specifically electric power**
**Identify alternative means to supply power to critical telecommunications facilities and specific telecommunications components (if cell tower has power and cell phones do not and cannot be recharged)**
**Examine electric power infrastructure dependence on telecommunications.  Do they currently have and do they need to maintain some level autonomy?**
**Develop response and recovery processes for physical facilities based on the definition of criticality and known interdependencies (processes, training, and technologies)**
**Utilize simulated exercises, complex models and test beds to understand the effects of catastrophic events and test responses (gauge their speed and effectiveness)**
**Understand how much physical diversity and redundancy already exists and how much is necessary for critical processes and dependencies (financial services, 911 services, etc.);  Utilize this information to work towards the balance between redundancy and hardening investments**
**Understand what is the “shelf life” of vulnerability assessments.  What parameters will identify an outdated assessment?**

##  Collaboration & Information Sharing (continued)

*** ******Collaboration & Information Sharing (continued)***

**  **

**As communities of interest shift, the following opportunities for collaboration and information sharing exist in the area of physical security that could advance trustworthiness R&D:**

**Define industry’s essential elements of information for law enforcement and intelligence to provide back to industry**
**Develop industry-wide guidelines on the integration of physical early warning information.  Can and how can telecommunications utilize early warning, anomaly detection and sensor technologies from chem/bio and nuclear?**
**Establish public/private partnerships to support R&D.  Can industry be more involved in this work?  How can the government give feedback to industry on progress?**
**Define website publishing guidelines to minimize sharing critical information on the public network**
**Continuing biometrics R&D towards ease of use and cost reduction for the telecommunications industry.  Also, identify best technologies to serve the needs of the industry**

##  Roles & Responsibilities

*** ******Roles & Responsibilities***

**  **
**	****	**
**	**

**  **
**Industry, academia, and Government all have unique roles and responsibilities in funding and advancing trustworthiness R&D:**
**R&D Investments and Contributions by Sector**

| Academia | Model infrastructure and infrastructure interdependences and simulate, test, and challenge response and recovery processes; Develop test beds and standards for criticality, diversity and redundancy; Investigate what types of threat information is useful; Identify applications for technologies from other infrastructures that have applications in telecom |
| --- | --- |
| Industry | Develop standards for criticality, diversity and redundancy; Investigate what types of threat information is useful; Identify applications for technologies from other infrastructures that have applications in telecom; Improve response and recovery plans between companies and sectors |
| Government (Federal, State, and local) | Work with industry to define critical from government perspective; Facilitate cross-sector (telecom and electric power) collaboration and exercises; share specific, timely and actionable threat information as well as the general threat environment information with industry ; funding and training at State and local levels  |

##  Policy Issues for Further Study

*** ******Policy Issues for Further Study***

**  **
**	****	**
**	**

**  **
**Based on our discussion, the following policy issues should be considered by OSTP & DHS:  **
**In the case where telecommunications is provided by nontraditional technology, examine the need for policy around minimum service level agreements for network reconstitution for anyone who provides telecommunications services**
**Possibility of regulation for minimum security standards related to critical facilities?**
**Several issues also merit further study by the NSTAC:**
**Further address the issue of background screening and credentialing, including the issue of a perimeterless environment where the network has expanded beyond the building; necessitating better capabilities for analyzing and identifying those in virtual space**
**Further examine the codependence between power and telecommunications, including identifying the appropriate channel for energy sector participation in NSTAC, NCC, or NSIE activities**

##  Agenda for Action 

*** ******Agenda for Action ***

**  **
**An Agenda for Action should: **
**	****  ****	**

**Provide clarity regarding the subject of criticality**
**Examine mutual dependency between the electric power and telecommunications infrastructure**
**Respond to the proliferation of non-traditional communications technologies (wireless, cable, etc.) and the lack of standards relating to redundancy and service levels**
**Create guidelines for effective information sharing, specifically between industry and Government regarding threats and vulnerabilities**