FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) The Defensive Elements The value created by computing and networks will continue to be subverted by those seeking illicit gains. IT systems should be assumed to be vulnerable to malicious cyber activities, and perfect security is not possible. Security should be viewed as a flexible, ongoing process of self-evaluation and informed actions of adjusting and responding to threats as they evolve. The cybersecurity framing of Deter, Protect, Detect, and Respond addresses the full range of cybersecurity needs, and by doing so, it provides a structure for coordinating research and focusing on shared goals. This section describes each of the defensive elements. Deter The most effective way to secure a system from cyber threats is by deterring malicious cyber activities before they can compromise the system or the enterprise. Deterrence, in the broad sense used by this Plan, requires increasing the level of effort that adversaries must apply to achieve their objectives and increasing the possible negative consequences for them from their actions. If adversaries judge that the likely costs of malicious activities, including risks of prosecution or sanctions, are greater than their expected benefits, they are more likely to be deterred from attempting the activities. Increasing both the required level of effort and the negative consequences for adversaries is needed for successful deterrence. Deterrence through threats of retaliation (e.g., prosecution and sanctions) alone has not been effective against most malicious cyber activities due to current limitations with attribution of cyber attacks and prosecuting across jurisdictions. Challenges Deterrence requires effective, multipronged defenses that increase the number and types of resources an adversary must have. A successful cyber defense has many facets, ranging from the appropriate technological solutions (e.g., designing secure software, hardware, and operating systems), to network protocols and access controls, to human factors such as safe data handling by users. In this manner, effective deterrence relies on the other three defensive elements—Protect, Detect, and Respond—to increase the costs and decrease the benefits to adversaries of their malicious cyber activities. Deterrence also requires successful attribution of cyber attacks to specific offenders to dissuade them from pursuing cyber attacks. However, identifying the origins of individual malicious actions in cyberspace can be difficult, because the actors are often in different jurisdictions than the systems they attempt to breach, and they operate through proxies and other anonymizing procedures. Improving attribution will require progress in effectively collecting and sharing activity indicators across organizations and jurisdictions. A related challenge is developing forensic techniques that are robust enough to preserve evidence such that it is suitable for use in legal proceedings while also bolstering immediate detection and cyber analytical abilities. To meet these challenges, new technologies are needed to measure and verify the ability of an enterprise to thwart adversary efforts and to ensure that law enforcement, government agencies, and system and network owners can successfully attribute malicious activities to their sources. Examples follow of the needed capabilities: Modeling attackers, defenders, and users. Effective models of the actors in cybersecurity are critical to properly assessing attackers’ risks, costs, and capabilities. The Critical Dependencies, Human Aspects, section of this Plan gives a wide range of considerations for these models. In the context of deterrence, –6–