2152 Federal Register / Vol. 76, No. 8 / Wednesday, January 12, 2011 / Notices 

1 Defense-in-depth: A practical strategy for 

achieving Information Assurance in today’s highly 

networked environments. 

workshops to begin the assumption 

buster process. The assumptions that 

underlie this series are that cyber space 

is an adversarial domain, that the 

adversary is tenacious, clever, and 

capable, and that re-examining cyber 

security solutions in the context of these 

assumptions will result in key insights 

that will lead to the novel solutions we 

desperately need. To ensure that our 

discussion has the requisite adversarial 

flavor, we are inviting researchers who 

develop solutions of the type under 

discussion, and researchers who exploit 

these solutions. The goal is to engage in 

robust debate of topics generally 

believed to be true to determine to what 

extent that claim is warranted. The 

adversarial nature of these debates is 

meant to ensure the threat environment 

is reflected in the discussion in order to 

elicit innovative research concepts that 

will have a greater chance of having a 

sustained positive impact on our cyber 

security posture. 

The first topic to be explored in this 

series is ‘‘Defense-in-depth is a Smart 

Investment.’’ The workshop on this 

topic will be held in the Washington, 

DC area on March 22, 2011. 

Assertion: ‘‘Defense-in-Depth is a 

smart investment because it provides an 

environment in which we can safely 

and securely conduct computing 

functions and achieve mission success.’’ 

This assertion reflects a commonly 

held viewpoint that Defense-in-Depth is 

a smart investment for achieving perfect 

safety/security in computing. To 

analyze this statement we must look at 

it from two perspectives. First, we need 

to determine how the cyber security 

community developed confidence in 

Defense-in-Depth despite mounting 

evidence of its limitations, and second, 

we must look at the mechanisms in 

place to evaluate the cost/benefit of 

implementing Defense-in-Depth that 

layers mechanisms of uncertain 

effectiveness. 

Initially developed by the military for 

perimeter protection, Defense-in-Depth 

was adopted by the National Security 

Agency (NSA) for main-frame computer 

system protection. The Defense-inDepth strategy was designed to provide 

multiple layers of security mechanisms 

focusing on people, technology, and 

operations (including physical security) 

in order to achieve robust information 

assurance (IA).1 Today’s highly 

networked computing environments, 

however, have significantly changed the 

cyber security calculus, and Defense-inDepth has struggled to keep pace with 

change. Over time, it became evident 

that Defense-in-depth failed to provide 

information assurance against all but the 

most elementary threats, in the process 

putting at risk mission essential 

functions. The 2009 White House 

Cyberspace Policy Review called for 

‘‘changes in technology’’ to protect 

cyberspace, and the 2010 DHS DOD 

MOA sought to ‘‘aid in preventing, 

detecting, mitigating and recovering 

from the effects of an attack’’, suggesting 

a new dimension for Defense-in-depth 

along the lifecycle of an attack. 

Defense-in-Depth can provide robust 

information assurance properties if 

implemented along multiple 

dimensions; however, we must consider 

whether layers of sometimes ineffective 

defense tools may result in delaying 

potential compromise without 

providing any guarantee that 

compromise will be completely 

prevented. In today’s highly networked 

world, Defense-in-Depth may best be 

viewed as a practical way to defer harm 

rather than a means to security. It is 

worth considering whether the Defensein-Depth strategy tends to contribute 

more to network survivability than it 

does to mission assurance. 

Intrusions into DoD and other 

information systems over the past 

decade provide ample evidence that 

Defense-in-Depth provides no 

significant barrier to sophisticated, 

motivated, and determined adversaries 

given those adversaries can structure 

their attacks to pass through all the 

layers of defensive measures. In the 

meantime, kinetic Defense-in-Depth of 

weapons platforms (such as aircraft) 

evolved into a life-cycle strategy of 

stealth (prevent), radars (detect), 

jammers and chaff (mitigate), fire 

extinguishers (survive) and parachutes 

(recover), a strategy that could provide 

value in the cyber domain. 

How to Apply 

If you would like to participate in this 

workshop, please submit (1) a resume or 

curriculum vita of no more than two 

pages which highlights your expertise in 

this area and (2) a one-page paper 

stating your opinion of the assertion and 

outlining your key thoughts on the 

topic. The workshop will accommodate 

no more than 60 participants, so these 

brief documents need to make a 

compelling case for your participation. 

Applications should be submitted to 

assumptionbusters@nitrd.gov no later 

than 5 p.m. EST on February 10, 2011. 

Selection and Notification 

The SCORE committee will select an 

expert group that reflects a broad range 

of opinions on the assertion. Accepted 

participants will be notified by e-mail 

no later than February 28, 2011. We 

cannot guarantee that we will contact 

individuals who are not selected, 

though we will attempt to do so unless 

the volume of responses is 

overwhelming. 

Submitted by the National Science 

Foundation for the National 

Coordination Office (NCO) for 

Networking and Information 

Technology Research and Development 

(NITRD) on January 7, 2011. 

Suzanne H. Plimpton, 

Reports Clearance Officer, National Science 

Foundation. 

[FR Doc. 2011–522 Filed 1–11–11; 8:45 am] 

BILLING CODE 7555–01–P 

SECURITIES AND EXCHANGE 

COMMISSION 

Proposed Collection; Comment 

Request 

Upon Written Request, Copies Available 

From: Securities and Exchange 

Commission, Office of Investor 

Education and Advocacy, 

Washington, DC 20549–0213. 

Extension: 

Rule 17a–4; SEC File No. 270–198; OMB 

Control No. 3235–0279. 

Notice is hereby given that pursuant 

to the Paperwork Reduction Act of 1995 

(44 U.S.C. 3501 et seq.), the Securities 

and Exchange Commission 

(‘‘Commission’’) is soliciting comments 

on the collection of information 

provided for in Rule 17a–4 (17 CFR 

240.17a–4), under the Securities 

Exchange Act of 1934 (15 U.S.C. 78a et 

seq.). The Commission plans to submit 

this existing collection of information to 

the Office of Management and Budget 

for extension and approval. 

Rule 17a–4 requires exchange 

members, brokers and dealers (‘‘brokerdealers’’) to preserve for prescribed 

periods of time certain records required 

to be made by Rule 17a–3. In addition, 

Rule 17a–4 requires the preservation of 

records required to be made by other 

Commission rules and other kinds of 

records which firms make or receive in 

the ordinary course of business. These 

include, but are not limited to, bank 

statements, cancelled checks, bills 

receivable and payable, originals of 

communications, and descriptions of 

various transactions. Rule 17a–4 also 

permits broker-dealers to employ, under 

certain conditions, electronic storage 

media to maintain records required to 

be maintained under Rules 17a–3 and 

17a–4. 

mstockstill on DSKH9S0YB1PROD with NOTICES

Federal Register / Vol. 76, No. 8 / Wednesday, January 12, 2011 / Notices 2153 

1This figure is based on SIFMA’s Office Salaries 

in the Securities Industry 2010, modified by 

Commission staff to account for an 1800-hour workyear multiplied by 2.93 to account for bonuses, firm 

size, employee benefits, and overhead. 

There are approximately 5,057 active, 

registered broker-dealers. The staff 

estimates that the average amount of 

time necessary to preserve the books 

and records as required by Rule 17a–4 

is 254 hours per broker-dealer per year. 

Thus the staff estimates that the total 

compliance burden for 5,057 

respondents is 1,284,478 hours. 

The staff believes that compliance 

personnel would be charged with 

ensuring compliance with Commission 

regulation, including Rule 17a–4. The 

staff estimates that the hourly salary of 

a Compliance Clerk is $67 per hour.1

Based upon these numbers, the total 

cost of compliance for 5,057 

respondents is the dollar cost of 

approximately $86.1 million (1,284,478 

yearly hours × $67). The total burden 

hour decrease of 468,122 is due to a 

decrease in the number of respondents 

from 6,900 to 5,057. 

Based on conversations with members 

of the securities industry and based on 

the Commission’s experience in the 

area, the staff estimates that the average 

broker-dealer spends approximately 

$5,000 each year to store documents 

required to be retained under Rule 17a– 

4. Costs include the cost of physical 

space, computer hardware and software, 

etc., which vary widely depending on 

the size of the broker-dealer and the 

type of storage media employed. The 

Commission estimates that the annual 

reporting and record-keeping cost 

burden is $25,285,000. This cost is 

calculated by the number of active, 

registered broker-dealers multiplied by 

the reporting and record-keeping cost 

for each respondent (5,057 active, 

registered broker-dealers × $5,000). 

Written comments are invited on: 

(a) Whether the proposed collection of 

information is necessary for the proper 

performance of the functions of the 

agency, including whether the 

information shall have practical utility; 

(b) the accuracy of the agency’s estimate 

of the burden of the proposed collection 

of information; (c) ways to enhance the 

quality, utility, and clarity of the 

information to be collected; and (d) 

ways to minimize the burden of the 

collection of information on 

respondents, including through the use 

of automated collection techniques or 

other forms of information technology. 

Consideration will be given to 

comments and suggestions submitted in 

writing within 60 days of this 

publication. 

Please direct your written comments 

to: Thomas Bayer, Chief Information 

Officer, Securities and Exchange 

Commission, c/o Remi Pavlik-Simon, 

6432 General Green Way, Alexandria, 

Virginia 22312 or send an e-mail to: 

PRA_Mailbox@sec.gov. 

Dated: January 6, 2011. 

Elizabeth M. Murphy, 

Secretary. 

[FR Doc. 2011–476 Filed 1–11–11; 8:45 am] 

BILLING CODE 8011–01–P 

SECURITIES AND EXCHANGE 

COMMISSION 

Proposed Collection; Comment 

Request 

Upon Written Request, Copies Available 

From: Securities and Exchange 

Commission, Office of Investor 

Education and Advocacy, 

Washington, DC 20549–0213. 

Extension: 

Rule 15c3–3; SEC File No. 270–087; OMB 

Control No. 3235–0078. 

Notice is hereby given that pursuant 

to the Paperwork Reduction Act of 1995 

(44 U.S.C. 3501 et seq.) the Securities 

and Exchange Commission 

(‘‘Commission’’) is soliciting comments 

on the existing collection of information 

provided for in Rule 15c3–3 (17 CFR 

240.15c3–3), under the Securities 

Exchange Act of 1934 (15 U.S.C. 78a et 

seq.). The Commission plans to submit 

this existing collection of information to 

the Office of Management and Budget 

for extension and approval. 

Rule 15c3–3 requires that a brokerdealer that holds customer securities 

obtain and maintain possession and 

control of fully-paid and excess margin 

securities they hold for customers. In 

addition, the Rule requires that a brokerdealer that holds customer funds make 

either a weekly or monthly computation 

to determine whether certain customer 

funds need to be segregated in a special 

reserve bank account for the exclusive 

benefit of the firm’s customers. It also 

requires that a broker-dealer maintain a 

written notification from each bank 

where a Special Reserve Bank Account 

is held acknowledging that all assets in 

the account are for the exclusive benefit 

of the broker-dealer’s customers, and to 

provide written notification to the 

Commission (and its designated 

examining authority) under certain, 

specified circumstances. Finally, 

paragraph (o) of Rule 15c3–3, which 

applies only to broker-dealers that sell 

securities futures products (‘‘SFP’’) to 

customers, requires that such brokerdealers provide certain notifications to 

customers, and to make a record of any 

changes of account type. 

There are approximately 279 brokerdealers fully subject to the Rule (i.e., 

broker-dealers that cannot claim any of 

the exemptions enumerated at 

paragraph (k)), of which approximately 

13 make daily, 210 make weekly, and 56 

make monthly, reserve computations. 

On average, each of these respondents 

require approximately 2.5 hours to 

complete a computation. Accordingly, 

Commission staff estimates that the 

resulting burden totals 36,780 hours 

annually ((2.5 hours × 240 computations 

× 13 respondents that calculate daily) + 

(2.5 hours × 52 computations × 210 

respondents that calculate weekly) + 

(2.5 hours × 12 computations × 56 

respondents that calculate monthly)). 

A broker-dealer required to maintain 

the Special Reserve Bank Account 

prescribed by Rule 15c3–3 must obtain 

and retain a written notification from 

each bank in which it has a Special 

Reserve Bank Account to evidence 

bank’s acknowledgement that assets 

deposited in the Account are being held 

by the bank for the exclusive benefit of 

the broker-dealer’s customers. As stated 

previously, 279 broker-dealers are 

presently fully-subject to Rule 15c3–3. 

In addition, 120 broker-dealers operate 

in accordance with the exemption 

provided in paragraph (k)(2)(i) which 

also requires that a broker-dealer 

maintain a Special Reserve Bank 

Account. The staff estimates that of the 

total broker-dealers that must comply 

with this rule, only 25%, or 100 ((279 

+ 120) × .25) must obtain 1 new letter 

each year (either because the brokerdealer changed the type of business it 

does and became subject to either 

paragraph (e)(3) or (k)(2)(i) or simply 

because the broker-dealer established a 

new Special Reserve Bank Account). 

The staff estimates that it would take a 

broker-dealer approximately 1 hour to 

obtain this written notification from a 

bank regarding a Special Reserve Bank 

Account because the language in these 

letters is largely standardized. 

Therefore, Commission staff estimates 

that broker-dealers will spend 

approximately 100 hours each year to 

obtain these written notifications. 

In addition, a broker-dealer must 

immediately notify the Commission and 

its designated examining authority if it 

fails to make a required deposit to its 

Special Reserve Bank Account. 

Commission staff estimates that brokerdealers file approximately 33 such 

notices per year. Broker-dealers would 

require approximately 30 minutes, on 

average, to file such a notice. Therefore, 

Commission staff estimates that brokerdealers would spend a total of 

mstockstill on DSKH9S0YB1PROD with NOTICES