FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) latency requirements are pushing analytics and data processing close to the network edge where the data are first collected. Fog and edge computing have emerged to meet this need. In fog computing, computation and storage are moved as needed to nodes between cloud servers and edge nodes. Computations that require only local data can be performed at the intermediate nodes, while global processing continues to be performed in cloud servers. This hierarchy of data processing services has evolved to become a new paradigm, with fog nodes communicating directly with each other as needed to perform global-level computations. Edge computing started as the introduction of applications in mobile network base stations, but it has developed into an edge-centric computing paradigm in which edge nodes communicate in peer-topeer fashion to perform tasks and compute data of immediate local value. This computing paradigm can take advantage of fog and cloud nodes to provide stable resources when needed. End-to-end security becomes complex and challenging when data are located in centralized cloud servers, intermediate fog nodes, and edge devices. Addressing this context, the 2019 Federal Cloud Computing Strategy20 recommends implementing security controls at the data layer in addition to the network and physical layers, thus providing a multi-layer protection strategy. Internet of Things The Internet of Things is now a reality as a growing number and variety of consumer devices, home appliances, and sensors used for transportation and municipal services share compute power, network connectivity, and ability to be controlled remotely. The IoT environment is complex, and its security challenges are just as complex. IoT devices are often limited in computational, data storage, communication, and available power resources. Approaches to authentication, encryption, and security policy enforcement that work for the desktop and server environment will not be deployable to a resource-constrained device. Usability and human factors are also a challenge for the secure design of IoT because the devices have limited user interfaces, and the typical user of consumer devices is not trained in cybersecurity and may not make reliably good security and privacy decisions. Cyber-Physical Systems and Critical Infrastructure Cyber-physical systems (CPS) are engineered systems that are built for and depend upon the seamless integration of computation and physical components. Examples of such systems can be seen in “smart,” Internet-connected manufacturing assemblies, traffic flow controls, rescue robots, border security drones, and consumer medical devices, among a host of others. Advances in CPS will enable advanced capability, adaptability, scalability, resiliency, safety, security, and usability that will expand the horizons of these increasingly critical systems. As CPS systems become more complex, the interdependence of components increases the vulnerability to attacks and cascading failures. The algorithms that control CPS may be complex and opaque, and their security may depend on autonomous cyber defense rather than human intervention, as well as on secure analog and digital electronic hardware. Furthermore, restoration and resiliency of CPS systems after a fault or cyber attack may be challenged by the potential overload on the physical systems. R&D Goals • Develop methodologies and standards to support seamless, end-to-end security across interconnected networks with multiple owners, trust domains, topologies, networking 20 https://www.whitehouse.gov/wp-content/uploads/2019/06/Cloud-Strategy.pdf – 16 –