NSF’s Security Program in the United States

Introduction

The United States faces serious cyber threats upon the U.S. national infrastructures:

• A massive cyber attack upon our Nation’s critical infrastructures which is credible and
  that would have staggering adverse consequences
• Technology convergence, innovation and even rapid obsolescence open cyber
  vulnerabilities faster than old vulnerabilities can be closed
• Globalization of information technology despite its benefits also has adversely affected
  our technical leadership and competitiveness

NSF and the Trustworthy ComputingProgram have an obligation:

• Exercise leadership in science and technology to build trust in cyberspace
• Ensure scientific and technical excellence
• Balance portfolio of theoretical and experimental research
• Meet and exceed the expectations of the legislation enacting CyberTrust
• Create a technological future for cyber space that benefits and advances society
  for generations to come

A Short History of the NSF’s Security Program

NSF invested in trust and security before an official named program:

• FY01: Research Program “Trusted Computing” initiated ($4-6M/yr)
• FY02: Boehlert/Hall Bill, Committee on Science, for NSF and NIST (THE Cyber Security Research and Development Act (H.R. 3394), Bill called for authorization of nearly $600M for NSF in 5 CT focus areas)
• FY03: Increasing focus in specific research programs (Trusted Computing, Security-related network research (NeTS),– Data and Application Security and Embedded and Hybrid Control Systems Security)
• FY04: Integrated CISE-wide program – “Cyber Trust” (Two Center-scale activities awarded: CCIED, STIM (now SAFE), and an entire suite of cyber security activities managed under one integrated, cross-cutting program to foster multidisciplinary collaboration – computer
  scientists, engineers, mathematicians, and social science researchers)
• FY05-08: Continuing “Cyber Trust” program ( Two Center-scale awards: TCIP, ACCURATE; 15 Team/Large awards, 60 individual/small group awards — per year; and $35M for FY05, $24M for FY06, $34M for FY07, $33M for FY08)

In FY2009 Cyber Trust transitioned into Trustworthy Computing (TC)

Deeper and broader than CT. There are five areas; proposals that cut across privacy and usability
particularly welcome:

• Foundations: new models that are analyzable, cryptography, composability (even though security is not a composable property), new ways to analyze systems
• Privacy: threats, metrics, security, regulation, database inferencing, tradeoff with other requirements
• Usability: for lay users and security administrators
• Security Architecture: Beyond point solutions, putting techniques together (like intrusion tolerance), towards a future Internet (including secure hosts and applications)
• Evaluation: especially experimental, testbed design and deployment

NSF Strategic Mission in Trustworthy Computing

Support leading-edge fundamental research on computer-based
systems and networks that:

• Function as intended, especially in the face of cyber events
• Process, store and communicate sensitive information according to specified policies
• Address the concerns of individuals and society about privacy
• Educate the next workforce and inform the public

Systems of national significance, e.g., in critical infrastructures, finance,
elections, healthcare, national defense, national-scale databases, air traffic
control, and systems important to individuals, e.g., automobiles, office
systems, homes.

Collaborative activities addressing the full scope of dependable systems
(reliability, safety, security, etc.) and other research areas (e.g.,
confidentiality and usability of research data)

The Many Topics of Security funded by Cyber Trust

(over 400 ongoing projects, 387 PIs and Co-PIs)

• Cryptography: provable security, key management, lightweight cryptographic systems,
  conditional and revocable anonymity, improved hash functions
• Formal methods: access control rule analysis, analysis of policy, verification of
  composable systems, lightweight analysis, on-line program disassembly
• Formal models: access control, artificial diversity and obfuscation, deception
• Defense against large scale attacks: worms, distributed denial of service, phishing,
  spam, adware, spyware, stepping stone and botnets
• Applications: critical infrastructures, health records, voice over IP, geospatial databases,
  sensor networks, digital media, e-voting, federated systems
• Privacy: models, privacy-preserving data-mining, location privacy, RFID networks
• Hardware enhancements for security: virtualization, encryption of data in memory, high
  performance IDS, TPM
• Network defense: trace-back, forensics, intrusion detection and response, honeynets
  Wireless & Sensor networks: security, privacy, pervasive computing
• New challenges: spam in VoIP, “Google-like” everywhere, virtualization, quantum
  computing, service oriented architecture
• Metrics: Comparing systems wrt security, risk-based measurement
• Testbeds and Testing Methodology: DETER. WAIL, Orbit and GENI, scalable
  experiments, anonymized background data
• (Research spans the space: foundations, hardware, operating systems, networks,
  applications, usability)

NSF Inter-Agency Activities including Planning and Coordination

Joint research funding and activities

• DARPA co-funding: FY04 Cyber Trust awards (Secure Core: processor, OS kernel, security services (Princeton, USC-ISI, NPS); Formal verification using ACL2 (U. Texas Austin); Detect security-related software errors (UC Berkeley, UMD, Stanford))
• DHS and DoE co-funding: FY05 Cyber Trust center-scale award on Trustworthy Cyber
  Infrastructure for the Power Grid (TCIP)
• DHS co-funding: ITR on biometrics (UWV, Clarkson), DETER testbed
• DNI, DoD: National Cyber Defense Initiative (NCDI)
• ARO: Co-organized workshop on security/privacy for sensor networks & embedded systems
• DoD Panel on Network Security Issues: NSF GENI Overview
• NIH: Planning joint solicitation on confidentiality & usability of research data
• SBE, Microsoft, IBM: Workshop on privacy and data confidentiality
• Treasury: Discussions on secure and resilient recovery mitigation of systems against insider
  attacks and possible co-sponsorship
• Japan and European Commision: Workshops leading to focused collaborations; EU focused
  on experimental evaluation, collaborative defenses and privacy; supplemental travel grants
  for Japanese researchers and NSF researchers for collaborative research by respective S&T
  agencies

NSF has a leadership role that fosters inter-agency collaboration

• INFOSEC Research Council (IRC)
• National Coordination Office (NCO) Cyber Security and Information Assurance (CSIA)

Opportunities and Future Directions for NSF Security Research

Future Directions: Increasing emphasis:
• Understand the key assumptions that will drive security research
• Anticipating and understanding future cyber threats arising from advances in
• Pervasive computing (esp privacy, provenance, attestation)
• Service oriented architectures (esp composable provable trusts, policies)
• Cross-enterprise (and cross-coalition) sharing and interoperation
• Research into the foundations of trust
• The limits of what can and cannot be known about trust
• Is there a Science of Security
• Covert channels and information hiding affecting security and trust
• Special economic and societal impact
• Anonymity, anti-spam, anti-spyware, competitiveness, critical infrastructures
• Towards an overarching security architecture that integrates the many but specific solutions NSF PIs have developed

Test beds and Methodology for Experimentation and Evaluation:
• Continued joint development of research testbeds including DETER, ORBIT, …
• Repository of anonymized sharable test data based on actual events/behaviors
• Open source software and wide-distribution of benchmark results