The speed, functionality, and accessibility that create the enormous benefits of the computer age can, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with computer operations from remote locations for mischievous or malicious purposes, including fraud or sabotage. As public and private organizations use computer systems to transfer more and greater amounts of money, sensitive economic and commercial information, and critical defense and intelligence information, the likelihood increases that malicious individuals will attempt to penetrate current security technologies, disrupt or disable our nation’s critical infrastructures, and use sensitive and critical information for malicious purposes. In a May 2004 report, we discussed how cyber security technologies can provide a near-term solution for improving critical infrastructure security vulnerabilities. However, these technologies offer only single-point solutions by addressing individual vulnerabilities; they do not provide a complete solution. For example, firewalls can control the flow of traffic between networks but cannot protect against threats from within the network; antivirus software can provide some protection against viruses and worms but cannot protect the confidentiality of the data residing on the system. As a result, many researchers have described the use of these types of near-term solutions as being short-sighted. They argue that it is necessary to design systems with built-in security because it is difficult to deploy secure systems based on insecure components. In addition, researchers have indicated that long-term efforts are needed, such as researching cyber security vulnerabilities, developing technological solutions, and transitioning research results into commercially available products. Research in cyber security technology can help create a broader range of choices and more robust tools for building secure, networked computer systems. Recent cyber attacks and threats have underscored the need to strengthen and coordinate the federal government’s cyber security R&D efforts. Examples of recent attacks include the following: In November 2005, the U.S. government issued a warning about a virus disguised in an e-mail purportedly sent from the Federal Bureau of Investigation. The e-mail tells users that they have been visiting illegal Web sites and directs them to open an attachment with a questionnaire that contains a variant of the w32/sober virus. If the attachment is opened, the virus is executed. In October 2005, information security specialists reported that the Zotob worm, which had adversely affected computer networks in mid-August, had cost infected organizations an average of $97,000. Variants of the worm were capable of attacks that included logging keystrokes, stealing authentication credentials, and performing mass mailings. It was estimated that it took 61 percent of the impacted organizations more than 80 hours of work to clean up the infected systems. In March 2005, security consultants within the electric industry reported that hackers were targeting the U.S. electric power grid and had gained access to electronic control systems. Computer security specialists reported that, in a few cases, these intrusions had “caused an impact.” While officials stated that hackers had not caused serious damage to the systems that feed the nation’s power grid, the constant threat of intrusion has heightened concerns that electric companies may not have adequately fortified defenses against a potential catastrophic strike. In January 2005, a major university reported that a hacker had broken into a database containing 32,000 student and employee social security numbers, potentially compromising the identities and finances of the individuals. In similar incidents during 2003 and 2004, it was reported that hackers had attacked the systems of other universities, exposing the personal information of more than 1.8 million people. The number of malicious attacks has increased with the growing number of vulnerabilities. In 2000, the Software Engineering Institute’s CERT® Coordination Center (CERT/CC) received 1,090 reports of security vulnerabilities. By 2005, this number had more than quadrupled to 5,990. Figure 1 illustrates the number of security vulnerabilities reported from 1995 through 2005. Over the years, the federal government has taken these and other actions to improve cyber security efforts: publishing best practices and guidelines that assist in the planning, selection, and implementation of cyber security technologies; partnering with private sector counterparts to assess vulnerabilities and develop plans to eliminate those vulnerabilities; and awarding grants to support cyber security R&D. Research associated with enhancing the cyber security of critical infrastructures has been reinforced through federal requirements aimed at improving the nation’s cyber security posture. Additional requirements for research can be found in legislation that establishes agency responsibilities. For example, the act that establishes the Office of Science and Technology Policy gives the office the responsibility of assisting the President in providing general leadership and coordination of the research programs of the federal government. To provide a historical perspective, table 1 summarizes the key federal cyber security R&D actions that have shaped the development of the federal government’s cyber security R&D policies. Numerous federal agencies and organizations are involved in federally funded cyber security R&D. Several entities oversee and coordinate federal cyber security research; other groups support coordination on an informal basis; and multiple federal agencies fund or conduct this research. The Office of Science and Technology Policy and OMB, both in the Executive Office of the President, provide high-level oversight of federal R&D, including cyber security. The Office of Science and Technology Policy oversees the National Science and Technology Council, which prepares R&D strategies that are coordinated across federal agencies. The council operates through its committees, subcommittees, and interagency working groups, which coordinate activities related to specific science and technology disciplines. The Subcommittee on NITRD and the Interagency Working Group on Cyber Security and Information Assurance are the key entities responsible for coordinating cyber security R&D activities among federal agencies. The organization chart in figure 2 depicts the federal organizations involved. While this chart illustrates that several organizations are involved, much of the coordination for cyber security research is actually accomplished at lower level working groups and subcommittees by content matter experts from different agencies. Table 2 contains a brief description of the roles and responsibilities of the federal organizations and groups involved in the oversight and coordination of cyber security research. Participation by federal entities in other interagency groups provides opportunities for enhanced coordination of cyber security R&D efforts on an informal basis. The InfoSec Research Council (the Council) is a voluntary organization that is to facilitate coordination and communication of federal information security research among its members. The Council meets regularly to discuss current research projects, proposed future research initiatives, and critical information security issues. It is also responsible for producing a “hard problems list” that describes what it considers to be the most critical information security problems that, from a government perspective, should be addressed within the next 5 to 10 years. The latest version of the hard problems list was released in November 2005 and includes problems such as addressing insider threats, building secure systems, and improving information security without sacrificing privacy. The development of the list was intended to create consensus on particularly challenging information security issues that can be addressed through federal government coordination, but the Council recognizes that its members also have their own research priorities. The Technical Support Working Group also provides a means for coordination of cyber security R&D. Under the supervision of the Departments of Defense and State, the group operates with the collaboration and voluntary participation of more than 80 federal organizations in its 10 subgroups. In fulfilling its mission to conduct the national interagency R&D program for combating terrorism, the group facilitates interagency communication by serving as a forum for developing user-based counterterrorism technology requirements across the federal government. Its Infrastructure Protection subgroup meets once a year and is responsible for identifying, prioritizing, and executing R&D projects that satisfy interagency infrastructure protection requirements, including cyber security. Research and development officials at several agencies noted that, through other informal activities, they maintained additional contact with personnel at other agencies conducting cyber security R&D. Many mentioned that they participated in other agencies’ project selection and technical review panels. For example, experts from the Department of Homeland Security served on the review panel for the National Science Foundation’s 2005 Cyber Trust program. In addition, officials noted the relatively small size of the federal cyber security research community— many of the same officials attend the coordination meetings and a few officials within the community have worked at other agencies. This familiarity among cyber security experts has allowed for informal knowledge sharing and communication among agencies. While there are multiple agencies involved, three agencies fund and conduct much of cyber security R&D: the National Science Foundation and the Departments of Homeland Security and Defense. In 2004, the National Science Foundation established the Cyber Trust program to complement ongoing cyber security investments in each of its core research areas: computer and networked systems, computing and communication foundations, information and intelligence systems, shared cyber infrastructure, and information technology research. In accordance with the Cyber Security Research and Development Act, the National Science Foundation awards Cyber Trust grants for projects that (1) advance the relevant knowledge base; (2) creatively integrate research and education for the benefit of technical specialists and the general populace; and (3) effectively integrate the study of technology with the policy, economic, institutional, and usability factors that often determine its deployment and use. Recent Cyber Trust grants include research in areas such as approaches to Internet security, system behavior monitoring, and information security risk management architecture. The President’s budget for fiscal year 2006 provides about $94 million to the National Science Foundation for cyber security research, education, and training. The Department of Homeland Security’s R&D efforts are aimed at countering threats to the homeland by making evolutionary improvements to current capabilities and by developing revolutionary new capabilities. The Department of Homeland Security’s cyber security R&D program resides in the agency’s Science and Technology Directorate. According to Department of Homeland Security officials, the cyber security R&D program was funded—out of the department’s $1 billion science and technology budget—with approximately $10 million in fiscal year 2004, $18 million in fiscal year 2005, and $17 million in fiscal year 2006. The Department of Homeland Security’s cyber security R&D activities are largely unclassified and near-term.