Foundational Cybersecurity Research Improving Science, Engineering, and Institutions (2017) / Chapter Skim
Currently Skimming:
3 Engineering, Operational, and Life-Cycle Challenges in Security Science
3 Engineering, Operational, and Life-Cycle Challenges in Security Science
Pages 34-42
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 34... ...
Improved cyber security requires good technology control, resilience, and reliability, highlighting the importance of research in software quality assurance as well as more traditional notions of software security research. LESSONS FROM DEVELOPMENT ORGANIZATIONS In addition to what the traditional industrial research and academic communities contribute, software development organizations developing commodity systems have made substantial efforts to improve their own practices and the systems they build.
|
From page 35... ...
Recently, the National Institute of Standards and Technology issued a report exploring how to reduce technical vulnerabilities in software.3 It offers an analysis of a number of technical approaches that can be applied in the software development process, their potential impacts, and suggestions for encouraging the development and use of a number of measure ments and metrics to help assess software. Research on how security outcomes relate to development practices and on the use of particular tools and software languages is foundational.
|
From page 36... ...
It is important to develop mechanisms whereby 4 For instance, in the Defense Advanced Research Projects Agency's clean-slate total system architecture research and development effort on a new capability-based hardware, new operating systems and low-level compartmentalization kernels, and extensions of common programming languages that reflect the capability mechanism, it is the LLVM compiler extensions that address the hardware and inherently prevent buffer overflows and numerous other common security flaws.
|
From page 37... ...
Researchers in these areas benefit hugely from industry contacts and trust relationships with practitioner colleagues. In cybersecurity, however, knowledge transfer can be difficult, since so much is sensitive, including information about vulnerabilities, threats, events, data affected, organizational impacts, roles of human actors, and so on.
|
From page 38... ...
Today, many organizations that are interested in improving the security of their products mobilize the vulnerability research community with "bug bounties." These bounties pay financial rewards to individuals or organizations that discover new vulnerabilities and report them so they can be corrected. Microsoft has sought to use bug bounties to improve product security by paying bounties for discoveries of bugs in prerelease software and by providing significant financial rewards to researchers who find ways to mitigate new classes of vulnerabilities.
|
From page 39... ...
Put another way, given fixed resources, should one set up a highly regimented, centrally controlled homogeneous infrastructure that is well administered or a federated heterogeneous infrastructure that may not be as well administered? The latter obviously has a larger attack surface, assuming appropriate independence, but the former is more susceptible to complete compromise once penetrated.
|
From page 40... ...
Adversaries change tactics and approaches frequently, and the organizations who successfully defend themselves adapt continuously. Moving toward better ways to describe and measure security and security-related properties of a system and of organizations will involve understanding how science, models, attacks, and defenses interact; how systems are engineered, deployed, and maintained; and how organizations decide to invest in, develop, and promulgate technologies, practices, and policies regarding security.
|
From page 41... ...
data C sets from industry can be shared with cybersecurity experts in academia such that long-term empirical studies can be conducted that will allow a wide range of cybersecurity metrics to be tracked and for formal experiments that test particular research hypotheses to be conducted. • ncreasing the resilience of up-front engineering for embedded I systems, SCADA systems, and the IoT.
|
From page 42... ...
• Considering observation itself as a fundamental scientific approach and developing an ongoing, realistic understanding of what the universe of deployed systems looks and behaves like through the use of monitoring, logging, and data analysis (real-time, lagged, and forensic) to inform ongoing cybersecurity research efforts and priorities.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.