FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) Risk Management Technologies enable cybersecurity, but achieving appropriate levels of security requires more than technology. The application of cybersecurity technologies requires significant insight into an organization’s goals, its abilities and modalities, and the nature of the threats it faces. Risk management is the ongoing process of identifying, assessing, and responding to risk. The NIST Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View, 28 presents a generally accepted process, consistent with international standards, for informationsecurity risk management at all levels of an organization. The NIST Framework for Improving Critical Infrastructure Cybersecurity 29 presents a flexible framework to help organizations manage and reduce cybersecurity risk and has been applied across a broad spectrum of organizations. Advances in risk management, such as those below, are needed to achieve the goals of the defensive elements: • Integrated cost modeling techniques that incorporate human factors (such as required expertise and ongoing training). • Risk models that incorporate information about known and projected vulnerabilities. • Integration of modeling, simulation, and exercises into risk management practice. Scientific Foundations Cybersecurity needs sound mathematical and technical methods with clear objectives; comprehensive theories (e.g., of defense, systems, and adversaries); principled design methodologies; models of complex and dynamic systems at multiple scales; and metrics for evaluating success or failure. Establishing scientific foundations in the areas below will directly support the goals and objectives for the cybersecurity defensive elements and priority areas: • Formal frameworks with quantitative definitions of threats, measurable security assumptions and guarantees, and efficient formal methods for evaluating compositions of systems, defenses, and adversaries. • Principled design techniques to construct secure systems with provable or measurable verification and validation of security properties, and characterizations of efficiency. • Reasoning frameworks to anticipate evolving and disruptive technologies and threats. • Theories and models aimed at understanding individual, organizational, and social needs, expectations, and behaviors around security, safety, and privacy in sociotechnical systems. Transition to Practice Federal agencies should increase R&D funding to cybersecurity R&D transition-to-practice activities, such as System Integrator Forums, Small Business Innovation Research activities, and consortium ventures. Streamlining and accelerating the acquisition process for the results of R&D should also remain a priority. Agencies should continue to assess and selectively utilize all contractual instruments at their disposal. For example, Other Transactions Authority can provide a mechanism to streamline and accelerate funding of R&D and allow agencies to reach performers who are typically not engaged in government-funded cybersecurity research. 28 29 https://doi.org/10.6028/NIST.SP.800-39 https://doi.org/10.6028/NIST.CSWP.04162018 (revised in 2018). – 25 –