CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War / Cyber Security

Cybersecurity Is Not Just About The Tech

Cybersecurity may well be the most important function in the modern world. Without it, nothing else can be trusted, in any sector of the economy.
hacking-detected-shutterstock_188832089Cyber Security is far more than just protecting data. Security is about protecting the functionality of IT. It involves confidentiality, availability and integrity of resources. This higher order approach to cyber security requires vision, leadership, and actions in dimensions of people, process and technology.
 We also need to draw your attention to the higher order concept of Cyber War. This is, unfortunately, something all technologists should be familiar with now. The most critical piece to read on that topic now is Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases followed by: Main Street Cybersecurity: Can Email Be Safe? and Time for Transformational Cybersecurity!

Stay In The Loop: Sign Up To The CTOvision Daily

When it it time to research the great providers of Cybersecurity Solutions, kick off  your search in the CTOvision Disruptive Technology Finder. Pay particular attention to the sections on Cybersecurity, CASB, Cyber Threat Intelligence, and VPN.

For help putting all this information into context for your business, consider tapping into Crucial Point's CTO-as-a-Service or Technology Due Diligence offerings, both are ways to quickly leverage the technical talents of experienced enterprise technology professionals.

CNO Part 2: Computer Network Defense

This is the second installation on my series about Computer Network Operations (CNO).  The last blog explored the actions known as Computer Network Exploitation (CNE), and as always, please feel free to comment.  Today, the topic switches from exploitation to defense.

Computer Network Defense (CND): Includes actions taken via computer networks to protect, monitor, analyze, detect and respond to network attacks, intrusions, disruptions or other unauthorized actions that would compromise or cripple defense information systems and networks. Joint Pub 6.0 further outlines Computer Network Defense as an aspect of NetOps.

CND essentially means keeping the bad guys out and from acquiring or altering our information.  This is something that the United States has not been particularly successful with recently.  There has been progress made, however, largely due to the recognition that vulnerabilities in cyberspace affect everyone, not just the government or military.

In 2006 the first Government-led, full-scale, cyber security exercise of its kind, Cyber Storm, took place.  “Cyber Storm was a coordinated effort between international, Federal and State governments, and private sector organizations to exercise their response, coordination, and recovery mechanisms in reaction to simulated cyber events.”[1] This event highlighted some of the vulnerabilities in our defense systems as well as some of the shortcomings in our attribution and response capabilities.  Each Cyber Storm builds on lessons learned from previous real world incidents, ensuring that participants face more sophisticated and challenging exercises every two years.  Cyber Storm has been repeated bi-annually since and advances have been made to address the major issues, but more work needs to be done.

There are many efforts being made between the public and private sectors to secure our cyber domains, yet our networks are infiltrated daily.  The very nature of the Internet and it’s decentralization ensures that there will still be a lot of work to be done for the foreseeable future.  Let’s continue our efforts to collaborate and share between sectors and work together towards a secure cyber future.

[1] Department of Homeland Security, National Cyber Security Division. (2006). Cyber storm: exercise report Retrieved from http://www.dhs.gov/xlibrary/assets/prep_cyberstormreport_sep06.pdf

Related Reading:

Twelve Principles of DoD Cyber Conflict

CNO Part 1: Computer Network Exploitation

US Navy CNO’s Navigation Plan 2014-2018: Warfighting first. Operate forward. Be ready. 

Towards a Cyber Deterrent: Are we getting any closer?

Important Context on Recent Defense Industrial Base Attacks from Tom Parker

I just read a great article on DarkReading.com called “A Tale Of Two Hacks” by the experienced, seasoned cyber security thought leader and mentor Tom Parker of Securicon. Tom is a good balance to those in the press who form a bit of an echo chamber. He also helps cancel out some of the pseudo experts in the field (the guys who claim to be experts but really have nothing to show for it).

Please read the entire article, but a snippet of important context is below:

As someone who strongly believes that cyber-attribution is possible (today), I’m extremely hesitant to apply a buzzword like APT (and therefore implicating a specific state actor) without some sort of sound evidence — and you should be, too. The media has been instrumental in its coverage of many such incidents over the past two or three years, and we can safely assume that it is no longer (if it ever was) a secret that techniques, such as leveraging client-side vulnerabilities and social engineering, are far more effective for penetrating an Internet perimeter than the infrastructure attacks that have been preferred in years gone by.

While exact details regarding what data was stolen from RSA earlier this year aren’t known, RSA has released a number of blog posts and customer advisories that allow us to get a pretty good idea of the possible impact to customers based on what was stolen. Notably, instructions on monitoring RSA audit logs for signs of compromise attempts were circulated, which specifically advise for the identification of bad authentication PINs (the something you know) with a good token code (the something you have). Lots of these in a log file is a sure-fire sign that someone is trying to brute-force his way in and has possession of both a good username and stolen (or cloned) token. This supports earlier speculation that it was the seed values that were stolen.

That was a good article, one of a string from Tom providing fantastic context on the incredibly serious issues of enterprise cyber security. Another good one was “A Not-So Targeted Targeted Attack” where he detailed another threat vector. The bad guys never quite, they will always be there.

Tom is a good writer/thinker and security expert. You can find him on Twitter at: http://twitter.com/tomwparker

 

CNO Part 1: Computer Network Exploitation

This is the first part in my series about Computer Network Operations (CNO).  Again, I welcome any and all discussion on the matter and hope that this post will help educate our readers and encourage dialogue between them.

  • Computer Network Exploitation (CNE): Includes enabling actions and intelligence collection via computer networks that exploit data gathered from target or enemy information systems or networks. Joint Pub 3-13

CNE, which can include cyber-espionage, has many advantages at the strategic, operational, and the tactical levels.  Strategically, an adversary may find it more beneficial to collect data against us rather than make an offensive move against us, for fear of retaliation.  Again, a vulnerability in our network is an open door for another to come take information.  This is generally physically harmless, but the amount of information that walks out the door daily is staggering and it adds up.

This has been one of the biggest problems that the U.S. has had to deal with in recent years, as witnessed during the release of hundreds of thousands of diplomatic cables over the Wikileaks website last summer.  China and other countries steal our government and our industry secrets every day.  Of course, that is not to say that we aren’t stealing theirs as well, but we need to continue to become better, while getting better at securing our own information.

In an excerpt from the book Toward a Theory of Space Power: Selected Essays, Benjamin Lambeth, a RAND researcher, says “unlike the air and space environments, cyberspace is the only military operating area in which the United States already has peer competitors in place and hard at work.”[1] Naturally, most hold China to be our main competitor in this arena, and in fact most other areas as well, but there are and will be other adversaries, state-level and below, that have designs on exploiting the United States through the cyber domain.  What are some strategies that we should seek to continue growing in this area?

[1] Lambeth, B. (2011). Airpower, space, and cyberwar. JFQ, (60), Retrieved from http://www.ndu.edu/press/lib/images/jfq-60/JFQ60_46-53_Lambeth.pdf

 

A Discussion About Computer Network Operations

In a networked world, as in the rest of the world, we have to keep ourselves protected from attacks.  The problem is, this networked world actually exists in a different domain than we are historically used to fighting in.  Of course, I am talking about the cyber domain.  The United States has long enjoyed a distinct military advantage in controlling the four traditional domains of air, space, ground, and land.  But the cyber domain is the only one that man created; yet paradoxically the U.S. does not have full control over it.

Cyberspace is our interconnected information technology. It is the very nature that is cyberspace (decentralized) that makes it so difficult to dominate.  Further, dominance in cyberspace is essential to dominance in all other domains, as they are all increasingly dependent upon cyber infrastructure.  It seems that right now we are involved in what I see as an arms race, so to speak, that parallels historical times such as aircraft wars during the initial stages of flight, the space race between the U.S. and Soviet Union, and also the nuclear arms race during the Cold War.

One major difference in this realm however, is that domination in cyberspace means you essentially become the main target of anyone wishing to expand their power, to take a realist’s perspective.  In the cyber realm there are no borders by which to define your existence and draw a line in the sand.  Additionally, as of now there are no widely accepted defined rules, analogous to a Geneva Convention or Nuclear Non-Proliferation Treaty, governing actions in this realm.  Even if there were established norms and mores in this realm, there is no international governing body to preside over them.  All in all, this ‘wild west’ atmosphere essentially means that if there is an open door (i.e. vulnerability in your network), it is an invitation for someone to walk in and take something or attack without fear of repercussion.

This as where Computer Network Operations (CNO) comes into play.  According to Joint Pub 3-13, CNO consists of three different operations; computer network exploitation (CNE) (and espionage), computer network defense (CND), and computer network attack (CNA):

  • Computer Network Exploitation (CNE): Includes enabling actions and intelligence collection via computer networks that exploit data gathered from target or enemy information systems or networks.
  • Computer Network Defense (CND): Includes actions taken via computer networks to protect, monitor, analyze, detect and respond to network attacks, intrusions, disruptions or other unauthorized actions that would compromise or cripple defense information systems and networks. Joint Pub 6.0 further outlines Computer Network Defense as an aspect of NetOps
  • Computer Network Attack (CNA): Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves.

Over the next couple weeks I will be expanding upon this concept with a series of posts related to this.  I am hoping this can help some people understand what it is we are all dealing with here, what the nature of the threat is, and how we can work together to alleviate it.  I welcome any input and discussion on the matter.

For more on these topics see the CTOvision Guide to National Security Technology and

 

 

Kyrus Tech: Changing the dynamics in incident response and cyber forensics

A few weeks ago I was invited to the offices of Kyrus Tech, which is a start-up company run by a former colleague of mine from government. Kyrus (adapted from Caerus, the Greek deity of luck and opportunity) does both government and commercial work in digital forensics, reverse engineering and vulnerability research, but I was there specifically to hear about a new tool they have developed called Carbon Black, which has many potential uses, but threatens to be particularly disruptive in the incident response space.

When you think about how incident response is performed today, you know there is room for improvement. It is largely a lot of data collection activities that are carried out in order to find out what happened after the fact. Almost all of this activity is designed to try to answer a key question: What sort of evil ran on a given host and what did it do? Numbers vary based on your source, but the cost of dealing with an intrusion can quickly run into six and even seven figures if the scope of the problem is large enough. That doesn’t include the cost of complying with breach notification laws, the expense associated with improving/upgrading/changing your security architecture and solutions and so on.

Carbon Black gets to the heart of the matter by telling you exactly what executes on a host, and if it made any changes to the file system (when the final release candidate is ready it will also tell you if an executable opened up a network connection and if it made any changes to the Registry) . If this approach to identifying suspect activity sounds familiar it is because that’s basically how a lot of malware works: get in, get persistent, phone home and/or exfiltrate data. You can query your systems based on file name, hash or other attributes, bracket your search in a given time period (down to minutes if you need to), and re-order your query – much like an Excel pivot table – to answer different questions with the same subset of data. I’m not describing what they showed me justice, I’d recommend joining the Carbon Black Ning group to view several short use-case-based videos.

There is a lot to like about Carbon Black, but two things stick out in my mind as being important. The first is that it is small and simple. It does a few things very well, which stands in stark contrast to so many tools that seem to want to add just one more feature. In fact the guys at Kyrus made a point to say that they had created a “sensor” not another “agent,” and at 100kb I think that’s a fair description.

The second is that it is not just a security tool. If you know exactly what is happen on your hosts, you know exactly what your software “inventory” is doing (or if it is even being used). You can tell if you are in compliance with a range of regulatory requirements (patches up-to-date? unauthorized software running?). Carbon Black is a tool the entire C-suite can use, not just the CISO.

Those who are interested in testing Carbon Black should join the Carbon Black Ning group and a link to download an executable will be forthcoming. The current Beta version will send host data to Kyrus for storage and processing, so it’s best to use in a lab or virtual machine if your organization has PII issues. The guys at Kyrus tell me that when the Alpha version is ready both a paid model (all logs stay within your network) and free model (logs come back to Kyrus) will be available.

 

Hardware Really Matters for Computer Functionality and Security

It may be stating the obvious to say that the hardware you use has a direct impact on the functionality of your IT. That is so fundamental of a statement it really goes without saying. But for some reason decision-makers gloss over the importance of hardware to security design. Why? The hardware you pick has a direct impact on the security of your enterprise.

This matters at even layer of your enterprise. From devices to networks to servers and storage. The hardware you use has security ramifications.

Consider, for example, Intel Corporation’s vPro technology. This is a capability that comes with modern PC’s.  This component of hardware provides management features that enable systems administrators to exert control over devices to ensure computers are operating well and to ensure they are working securely.  This capability enables remote management, security monitoring and updating of PCs. vPro has several components (my favorites are Intel Active Management Technology (AMT) and Intel Trusted Execution Technology (TXT).  AMT is hardware that enables the secure remote management of enterprise PCs. TXT is the only technology I know of that verifies the launch environment and establishes a root of trust. TXT enables trust at a fundamental/foundational layer.  Without it, no PC can be secure. With it, more secure, resilient systems can be configured and operated and entire enterprises can be made more resilient.

For more on AMT and TXT see: http://ipip.intel.com/go/fedgov/

And for more on hardware and security see: http://www.intel.com/technology/security/index.htm

 

Mature Models for Healthy and Resilient Cyber Systems

In February 2011 we reported on a Department of Homeland Security research agenda for cyber security, providing the opinion that this was “the most mature research agenda on the topic of cyber security.” That research agenda is fantastic and should help shape the future cyber ecosystem in very positive ways.

Now in March 2011, DHS has produced another significant, positive, virtuous document on the topic of Cybersecurity that deserves the attention of leaders, planners and technologists from across the country. They have given us a white paper titled “Building a Healthy and Resilient Cyber Ecosystem with Automated Collective Action.” This paper flows from discussion, dialog and workshops that collegially fleshed out concepts. It is well worth a read and should help us all move towards a better IT environment.

Things I liked about this paper:

  • It is collegial. It is not about “command and control,” it is about vision and collaboration.
  • It uses relevant models for complex systems like modern IT. Relevant models, like those based on life, can really help in our understanding of how to design for success.
  • It is well written, so it is easy to follow and fast to read
  • It focuses on the most critical threats, in my opinion. With no hype or hyperbole, it spells out clearly what the threat is and why we must rise to mitigate it.
  • It articulates “Resiliency,” an important emerging way of descirbing the state we need in IT that realizes attacks will always be with us.
  • It simply describes and moves out on concepts of healthy devices, strong authentication, automation, and interoperability.

I hope that has been enough to grab your interest. I think the authors would like your review and would appreciate your feedback. They are clearly writers and thinkers with open minds, and the document contains contact information you can use to connect with them.

You can also read context by Phil Reitinger (Deputy Under Secretary, National Protection and Programs Directorate) on the DHS blog at: http://blog.dhs.gov/2011/03/enabling-distributed-security-in.html

Related Reading

Moving Toward a Framework for Resilient Cybersecurity: Expanding to a Hybrid Security Architecture

Moving Toward a Framework for Resilient Cybersecurity: Evaluating the Threat Landscape

DSB Report on Resilient Military Systems and the Cyber Threat

The most well thought out research agenda for cyber security I have seen to date

Opinion: the most mature research agenda on the topic of cyber security is the one established by our nation’s Department of Homeland Security.

I’m keeping an open mind, and would love to learn of other cyber security research agenda’s that might be as well defined. But I have to tell you I have seen research programs associated with cyber for years and this one is impressive.

The details of the topic areas of this research activity are embedded in a Broad Area Announcement (BAA) posted on FedBizOpps. The PDF of the announcement is located here: https://ctovision.com/wp-content/uploads/2011/02/Cyber_Security_BAA_11-02-2.pdf

You can also find info on this research agenda at:

https://baa2.st.dhs.gov/portal/BAA/

A summary of the agenda is pasted below for your review, but please visit review the details on the DHS site and at FedBizOpps for more info. And, if you know of any researcher who has an ability to contribute to the cyber mission needs outlined in this BAA, please get word of the BAA to the researcher. Our nation needs research into these topics, and it looks like DHS may be making some funding available for research into these topics.

I’d also recommend the DHS S&T Topics for Cyber Research by reviewed by computer science students and teachers.  They should also be considered by IT firms large and small, even if the firms are not planning on responding to the DHS announcement.  Anyone doing any research on cyber anywhere would benefit from a review of this agenda, I believe.

Summary from the DHS S&T website:

Description
The Department of Homeland Security (DHS) Science and Technology (S&T) Homeland Security Advanced Research Projects Agency (HSARPA) Cyber Security Division’s (CSD) announce a Broad Agency Announcement (BAA) for Fiscal Year 2011 to improve the security in both Federal networks and the larger Internet. This Broad Agency Announcement (BAA) seeks ideas and proposals for Research and Development (R&D) in 14 Technical Topic Areas (TTAs) related to CSD. The total estimated value of this acquisition is $40 million. Cyber attacks are increasing in frequency and impact. Even though these attacks have not yet had a significant impact on our Nation’s critical infrastructures, they have demonstrated that extensive vulnerabilities exist in information systems and networks, with the potential for serious damage. The effects of a successful cyber attack might include: serious consequences for major economic and industrial sectors, threats to infrastructure elements such as electric power, and disruption of the response and communications capabilities of first responders. The DHS S&T mission is to conduct, for homeland security purposes, research, development, test and evaluation (RDT&E) and timely transition of cyber security capabilities to operational units within DHS, as well as local, state, Federal and operational end users in critical infrastructure. Cyber security is defined in broad terms to encompass the usual attributes of security, as well as reliability, availability, and survivability in the face of adversary attack and accidental fault, while preserving privacy. DHS S&T invests in programs offering the potential for revolutionary changes in technologies that promote homeland security and accelerate the prototyping and system prototype demonstration in an operational environment of technologies that reduce homeland vulnerabilities. A critical area of focus for DHS is the development and deployment of technologies to protect the nation’s cyber infrastructure, including the Internet and other critical infrastructures that depend on computer systems for their mission.
  • TTA 01 – Software Assurance
  • TTA 02 – Enterprise-Level Security Metrics
  • TTA 03 – Usable Security
  • TTA 04 – Insider Threat
  • TTA 05 – Secure, Resilient Systems and Networks
  • TTA 06 – Modeling of Internet Attacks
  • TTA 07 – Network Mapping and Measurement
  • TTA 08 – Incident Response Communities
  • TTA 09 – Cyber Economics
  • TTA 10 – Digital Provenance
  • TTA 11 – Hardware-Enabled Trust
  • TTA 12 – Moving-Target Defense
  • TTA 13 – Nature-Inspired Cyber Health
  • TTA 14 – Software Assurance MarketPlace (SWAMP)

Summaries of these task areas:

TOPIC NUMBER: TTA 01TITLE: Software Assurance

DESCRIPTION:

The nation’s critical infrastructure (energy, transportation, telecommunications, banking and finance, and others), businesses, and services are extensively and increasingly controlled and enabled by software. Vulnerabilities in that software put those resources at risk. The risk is compounded by software size and complexity, the ways in which software is developed and maintained, the use of software produced by unvetted suppliers, and the interdependence of software systems. Software quality addresses the presence of internal flaws and vulnerabilities in software threatening its correct or predictable operation and use. Software assurance deals with the root of the problem by improving software security.

TOPIC NUMBER: TTA 02TITLE: Enterprise-Level Security Metrics

DESCRIPTION:

Defining effective information security metrics has proven difficult, even though there is general agreement that such metrics could allow measurement of progress in security measures and, at a minimum, rough comparisons of security between systems. Metrics underlie and quantify progress in many other system security areas. “You cannot manage what you cannot measure,” as the saying goes; the lack of sound and practical security metrics is severely hampering progress both in research and engineering of secure systems. However, general community agreement on meaningful metrics has been hard to achieve. This is due in part to the rapid evolution of IT, as well as the shifting locus of adversarial action.

TOPIC NUMBER: TTA 03TITLE: Usable Security

DESCRIPTION:

Although the problem of achieving usable security is universal – it affects everyone, and everyone stands to benefit enormously if usability is successfully addressed as a core aspect of security – it affects different users in different ways, depending on applications, settings, policies, and user roles. The guiding principles may indeed be universal, but there is certainly no general one-size-fits-all solution.

TOPIC NUMBER: TTA 04TITLE: Insider Threat

DESCRIPTION:

Cybersecurity measures are often focused on threats from outside an organization, rather than threats posed by untrustworthy individuals inside an organization. However, insider threats are the source of many losses in many critical infrastructure industries. In addition, well-publicized intelligence community moles such as Aldrich Ames have caused enormous and irreparable harm to national interests. This TTA focuses on insider threats to our cyber systems, and presents a high-impact research program that could aggressively curtail some aspects of this problem. At a high level, opportunities exist to mitigate insider threats through aggressive profiling and monitoring of users of critical systems, “fishbowling” suspects, “chaffing” data and services by users who are not entitled to access, and finally “quarantining” confirmed malevolent actors to contain damage and leaks while collecting actionable counter-intelligence and legally acceptable evidence.

TOPIC NUMBER: TTA 05TITLE: Secure, Resilient Systems and Networks

DESCRIPTION:

Survivability is the capability of a system to fulfill its mission, in a timely manner, in the presence of attacks, failures, or accidents. Part of the survivability attribute of systems and networks includes being secure and resilient to attack. This is meaningful, in practice, only with respect to well-defined mission requirements against which the survivability can be evaluated and measured.

TOPIC NUMBER: TTA 06TITLE: Modeling of Internet Attacks

DESCRIPTION:

This TTA researches, develops and applies modeling and analysis capabilities to predict the effects of cyber attacks on Federal Government and other critical infrastructures. Two main areas are identified: malware and botnets; and situational understanding and attack attribution.

TOPIC NUMBER: TTA 07TITLE: Network Mapping and Measurement

DESCRIPTION:

The protection of cyber infrastructure depends on the ability to identify critical Internet resources, incorporating an understanding of geographic and topological mapping of Internet hosts and routers. A better understanding of connectivity richness among ISPs will help to identify critical infrastructure. Associated data analysis will allow better understanding of peering relationships, and will help identify infrastructure components in greatest need of protection. Improved router level maps (both logical and physical) will enhance Internet monitoring and modeling capabilities to identify threats and predict the cascading impacts of various damage scenarios.

TOPIC NUMBER: TTA 08TITLE: Incident Response Communities

DESCRIPTION:

Cyber security incident response (CSIR) teams, individuals, and communities have historically consisted of people and organizations that have been “in the right place at the right time.” Only recently has the community begun to specify the skills, abilities, structures, and support to create an effective and sustained incident response capability. While there is a good understanding of the technologies involved in CSIRTs, the operational community has not adequately studied the characteristics of individuals, teams, and communities that distinguish the great CSIR responders from the average technology contributor. In other areas where individual contributions are essential to success, e.g., first responders, commercial pilots, and military personnel, there have studies of the individual and group characteristics essential to success. To optimize the selection, training, and organization of CSIR personnel to support the essential cyber missions of DHS, a much greater understanding and appreciation of these characteristics must be achieved.

TOPIC NUMBER: TTA 09TITLE: Cyber Economics

DESCRIPTION:

Today cyber crime pays. So does cyber-espionage. The state of cyber security today is, and in the future will be, significantly affected by economic conditions and factors. Cyber crime and espionage are making their own economic markets today, having gone well beyond the “script kiddie” and “hacker” personas to mature into big business on a global level. Gaining an understanding of the incentive structure is key to getting stakeholders to behave in a way that will improve overall security. Current cyber-related illegal activities are economically attractive for several reasons.

TOPIC NUMBER: TTA 10TITLE: Digital Provenance

DESCRIPTION:

Individuals and organizations routinely work with, and make decisions based on, data that may have originated from many different sources and also may have been processed, transformed, interpreted, and aggregated by numerous entities between the original sources and the consumers. Without good knowledge about the sources and intermediate processors of the data, it can be difficult to assess the data’s trustworthiness and reliability, and hence its real value to the decision-making processes in which it is used.

TOPIC NUMBER: TTA 11TITLE: Hardware-Enabled Trust

DESCRIPTION:

Hardware can be the final sanctuary and foundation of trust in the computing environment, based on the technologies that can be developed in the area of hardware-enabled trust and security. With cyber threats steadily increasing in sophistication, hardware can provide a game-changing foundation upon which to build tomorrow’s cyber infrastructure. But today’s hardware still provides limited support for security and capabilities that do exist are often not fully utilized by software. The hardware of the future also must exhibit greater resilience to function effectively under attack.

TOPIC NUMBER: TTA 12TITLE: Moving-Target Defense

DESCRIPTION:

In the current environment, our systems are built to operate in a relatively static configuration. For example, addresses, names, software stacks, networks, and various configuration parameters remain relatively static over relatively long periods of time. This static approach is a legacy of information technology system design for simplicity in a time when malicious exploitation of system vulnerabilities was not a concern.

TOPIC NUMBER: TTA 13TITLE: Nature-Inspired Cyber Health

DESCRIPTION:

Today, weeks and months may elapse before successful network penetrations are detected through laborious forensic analysis. Despite their potential to function with intelligence, today’s typical network components have very limited understanding of what passes through them, coupled with a correspondingly short memory. In the future, network components must have heightened ability to observe and record what is happening to and around them. With this new awareness of the system health and safety, these “self-aware systems” enjoy a range of options: these system may take preventative measures, rejecting requests which do not fit the profile of what is good, a priori, for the network; these systems can build immunological responses to the malicious agents which they sense in real time; these systems may refine the evidence they capture for the pathologist, as a diagnosis of last resort, or to support the development of new prevention methods. In the future, system owners should be able to monitor and control such dynamic cyber environments.

TOPIC NUMBER: TTA 14TITLE: Software Assurance MarketPlace (SWAMP)

DESCRIPTION:

Technical Topic Area #1 on Software Assurance describes the need to address threats throughout the software development process and called for new methods, services, and capabilities in build, test, and analysis phases in order to improve the quality and reliability of software used in the nation’s critical infrastructures. Specifically, TTA#1 solicits ideas for research and development of new tools and methods for software analysis, and for applying new and existing capabilities in test and evaluation activities. This TTA (#14) focuses on the research infrastructure necessary to enable these software quality assurance and related activities.

 

For more content see:

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]