In December 2011, the Executive Office of the President’s National Science and Technology Council released Trustworthy Cyberspace: Strategic Plan for the Federal Cybersecurity Research and Development Program, a set of R&D priorities for U.S. government agencies. Another is agility. The solutions that the National Science and Technology Council seeks will allow for flexible levels of trust and protection for different tasks and users, and will be able to adapt to new threats and challenges. Not only should they protect against a wide range of vulnerabilities, they should be able to evolve to fight attack vectors that will emerge in the future. They must also be able to detect, counter, and remediate problems quickly with the help of automation, requiring Big Data solutions to speed analysis.
Rigorous metrics are a third theme that runs through the R&D priorities. How secure are our systems? How dangerous are the threats? What is the cost of a security measure versus a possible attack? There is not yet an established way to answer or examine these questions. Our understanding of security, vulnerabilities, and cyberspace is still in its infancy, and Trustworthy Cyberspace aims to apply scientific rigour to the field so that it leaves the realm of art and becomes a true science. This means using the scientific method of observation, hypothesis, testing, then theory to establish fundamental laws which will enable better modelling and prediction.
