FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) Strategic Framing This Plan focuses on thwarting malicious cyber activities and campaigns by developing S&T to support four defensive elements: Deter, Protect, Detect, and Respond. This strategy is driven by evidence-based evaluations and measurements of the efficacy and efficiency of cybersecurity S&T solutions. The solutions are effective if they achieve the desired security result; they are efficient when the measured units of benefit are greater than the minimized units of cost. Along with an investment in technology solutions, the Plan highlights the importance of investments in a diverse workforce of cyber professionals who can design and implement suitable cybersecurity measures as well as manage risk. Cybersecurity Context Cybersecurity must be understood as a multifaceted domain where a variety of social, technical, economic, and legal goals, actors, and processes interact. Solutions for improving cybersecurity need to be designed and evaluated in this multidisciplinary context. This Plan makes the following key observations about the cybersecurity domain: Adversaries. Adversaries will perform malicious cyber activities if they perceive that the potential benefits outweigh their expended effort and probable consequences. Defenders. Defenders must thwart malicious cyber activities against valuable and critical systems while technologies and threats are continually evolving. Users. Users will circumvent cybersecurity practices that they perceive to be irrelevant, ineffective, inefficient, or overly burdensome. Technology. Because technology connects the physical and cyber worlds, the risks and benefits of the two worlds are interconnected. Dual-use. Many security technologies can be used for either offensive or defensive purposes. Policy impact. National policies such as patents, regulations, or export controls can have significant impact on both research and the transition of research to practice. Challenges A fundamental research goal for cybersecurity is to make it less onerous while seeking to provide more effective protections. This challenge can be met by developing a deeper understanding of how to evaluate the quality of cybersecurity (including the assessment of the cyber risk), how to leverage cybersecurity mechanisms to support privacy needs, and how to manage tradeoffs between applying cybersecurity while maintaining delivery of vital services. To accomplish the vision of a trustworthy cyberspace and effective cybersecurity practices, priority should be given to developing solutions to the following goals: Better understanding of human aspects: Today, “cybersecurity” is characterized too narrowly as the practice of protecting computers, networks, data, and the resulting IT systems. This characterization needs to be expanded to explicitly include the sociotechnical issues and the roles of humans as developers, defenders, users, and adversaries and to elevate human-oriented issues to be among the priorities for cybersecurity R&D. The human aspects goal also focuses on ensuring that end-users and computer professionals can understand and make effective security decisions, and that systems and policies account for their abilities, needs, and expectations. –3–