FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) identified in the National Defense Strategy. The development of a secure hardware and software foundation are further supported in the 2018 National Cyber Strategy. Challenges The following paragraphs describe cybersecurity challenges in hardware (HW) and/or software (SW), as indicated in the side headings: • Trusted hardware and secure supply chain (HW). The foundation of computing is built on the • • • • • • 23 premise that hardware can be trusted: the hardware executes as specified and does nothing less and, more importantly, does nothing more, i.e., it does not execute instructions or functions without explicit commands to do so. Since much hardware originates offshore, maintaining trust in the hardware supply chain is crucial. Hardware Trojans or backdoors that exfiltrate information remain a great concern. Other concerns relate to theft of intellectual property; compromised supply chain with aged or untrusted parts; and verification of third-party intellectual property, which may be cloaked with unknown features that increase the attack surface or add complexity that makes verification difficult. Adverse possession (HW/SW). In a distributed computing environment, there are multiple opportunities for an adversary to gain physical possession of a remote device, allowing the adversary to observe the device functions, obtain data/memory/software dump, de-package and reverse-engineer hardware, supply malicious inputs to the system, and emulate device behavior. Both a remote device’s hardware and software must stand up to physical attacks. Hardware vulnerabilities (HW). It is difficult to patch hardware vulnerabilities. Recent attacks against commercial microprocessors demonstrate the vulnerabilities of microprocessor systems.23 Design-for-security (HW/SW). Both hardware and software should be designed with security considerations right from the beginning of the design process. Security features such as authentication, access control, and encryption are relatively well understood, yet design-forsecurity has remained elusive due to lack of good security abstractions, lack of integrated tool suites to aid in secure design, and the economics of design. There is a need for quantifiable and measurable security abstractions that effectively capture current and future attacks to advance design-for-security, short of which, defensive design will remain a piecemeal approach prone to vulnerabilities. Similarly, there is a need to define roles and permissible actions for various actors, including users, system administrators, and underlying software systems, early in the design cycle to formally verify the security of systems against these roles. Economics of security (HW/SW). Economics of design favors component reuse, often resulting in feature sets larger than necessary, which increases the attack surface and compounds verification problems. Furthermore, developers are less likely to provide the low-defect software that security requires if doing so imposes time and effort penalties. Secure update (SW). It is crucial that the software of a system remains updatable to allow newly learned vulnerabilities to be patched, compromised assets to be isolated and contained, and software to evolve as needed. Effective management (SW). Software systems must be designed so the security and privacy aspects can be effectively configured and managed, and so they take into consideration the various levels of expertise of the people charged with performing such tasks. Security for software National Academies of Sciences, Engineering, and Medicine. Beyond Spectre: Confronting New Technical and Policy Challenges: Proceedings of a Workshop. Washington, DC: The National Academies Press (2019); https://doi.org/10.17226/25418. – 20 –