Consortium pushes for cybersecurity R&D

WASHINGTON — A consortium of 23 security research institutions is calling on the government and private companies to put more research and development muscle into a host of cybersecurity problems, including scanning individual computers for sources of attacks and code vulnerability scanners.

The Institute for Information Infrastructure Protection (I3P), a consortium of colleges and U.S. research laboratories, didn’t ask for a specific budget Thursday, but challenged the U.S. government and private industry to spend money in eight cybersecurity areas that are under-researched, according to the group.

I3P chairman Michael Vatis jokingly denied starting last weekend’s slammer worm attack on the Internet as a way of bringing attention to the R&D needs in cybersecurity. “We’re reminded of our vulnerabilities daily, and how vulnerable we are to attacks,” he said. “There’s a critical piece of this problem that to date has not received the attention and focus that is needed, and that is research and development.”

I3P, based at Dartmouth College in New Hampshire and funded through the U.S. Department of Commerce’s National Institute of Standards and Technology, released a 55-page R&D agenda Thursday. The I3P’s initial cybersecurity report, available at http://www.thei3p.org/, calls for more R&D in eight general areas:

1. Enterprise security management.

2. Trust among distributed autonomous parties.

3. Discovery and analysis of security properties and vulnerabilities.

4. Secure system and network response and recovery.

5. Traceback, identification and forensics.

6. Wireless security.

7. Metrics and models.

8. Law, policy and economics

The report goes into greater detail than the eight general areas, and the I3P brought experts to talk about each item during a kick-off event in Washington .

I3P member Wayne Meitzler, cybersecurity R&D program manager for the U.S. Department of Energy’s Pacific Northwest National Laboratory, called for more research into vulnerability scanners that could test for weaknesses in object code and source code.

Speaking about item No. 3, Meitzler said he’s not aware of any good object code vulnerability scanners that customers ranging from home users to corporations could use on their computers to detect bad code. “We have these new pieces of software we install on our computers, and we really don’t know the pedigree of that particular software,” he said. “Someone could easily embed malicious code in that particular software. The level of trust of the software that we pick up on a CD and put on our machine we really don’t understand, and we really don’t know.”

One audience member suggested that the use of more open-source software could help solve the problem of unknown source code. Meitzler said the I3P would be open to any software development models that could enhance security, including open source.

Victoria Stavridou, director of the System Design Laboratory at SRI International, suggested R&D also needs to focus on early warning systems for attacks. One way to accomplish that, she said, was to be able to scan individual computers, but she acknowledged that setting up technological sentries for individual computers would raise privacy concerns. “We need to make sure we build the system to respect not only the privacy of individuals but also of companies,” she said.

But Stavridou said computer networks need a better system of detecting when attacks are coming, instead of catching up after an attack has been launched. “Our networks are very large, they are open to all, and they are controlled by no one,” she added. “Our response operates at human speed. The problem is the attacks are not happening at human speed, they’re happening at cyberspeed.”

The panel also addressed wireless security as a continuing concern for many companies. More scientific methods are needed to understand wireless security issues, and more R&D is needed for technologies to address specific wireless problems, such as distributed denial of service of attacks, said Bob Hutchinson, manager of network systems survivability and assurance for Sandia National Laboratories.

“The bottom line is that modern pressures are pushing users to adopt this technology rapidly with an unknown risk,” he said. “We need wireless-specific research to address deficiencies and to create an adequately secure information infrastructure.”

The I3P, launched in September 2001, hopes the report will generate discussion about cybersecurity R&D needs, Vatis said. The group plans to issue follow-up reports addressing what problems have been fixed and what new problems appear, he said, and I3P is looking at setting up a common laboratory where companies can test cybersecurity products.

While R&D budgets weren’t a big part of the discussion, Vatis and others said they hope the report will spur the U.S. Congress to increase funding for cybersecurity R&D. Sharon Hays, deputy associate director for the Technology Office at the White House Office of Science and Technology Policy, said the report will help the White House decide what areas of R&D it should focus on.

Catherine Allen, chief executive officer of BITS, the technology arm of the Financial Services Roundtable, urged I3P to make business cases for each of the recommendations, but she and others attending the kick-off event praised the report as a good start to a national dialog about cybersecurity R&D.

Harris Miller, president of the Information Technology Association of America, said his organization may disagree with some of the specifics in the report, but “at least there is now an agenda people can react to and talk about.”