FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) Verify authenticity. The four approaches listed above offer the potential to dramatically reduce the number of vulnerabilities in hardware and software, but only if users deploy authentic, unaltered products. Objective measures for supply-chain assurance are needed to increase an organization’s ability to confirm a product’s provenance. Research into objective measures for supply-chain assurance (e.g., cryptology-based markers) is needed to achieve these aims. Enforcing Security Principles Better techniques are needed for enforcing security principles where efficacy and efficiency are lacking in current mechanisms. Several important system requirements are noted below: Authenticate users, devices, and systems. User authentication is a traditional building block for enforcement of security policy, but deployment of strong multifactor authentication systems continues to present challenges. The proliferation of Internet of Things (IoT) and autonomous systems increases the need for strong and efficient authentication of devices. Control access. Access controls build upon authentication to support the implementation of security policies and authorizations. Systems often rely on coarse-grained access controls even though more robust mechanisms such as role-based access controls are available. To accurately enforce security policies, improvements in access control efficiency are needed for system administrators. Use encryption mechanisms to protect data. When standard protection mechanisms fail and an adversary gains access to an IT system, or when data are transmitted across networks where eavesdropping is possible, cryptographic methods could deny intruder access to plaintext data and ensure that adversary modifications do not escape notice. Decryption of data is currently required to perform system operations or modifications, thus creating opportunities for a patient adversary; more efficient techniques that operate directly on encrypted data would offer greater security and privacy. Cryptographic tools and techniques are also needed for constrained environments (e.g., lightweight cryptography) and for long-term confidentiality (e.g., quantum-resistant cryptography). Mitigate vulnerabilities. Current systems continue to include many legacy components with undiscovered and unmitigated vulnerabilities. Technologies are needed to neutralize malicious cyber activities on legacy systems. Data analytics offers new opportunities to capitalize on security data and identify malicious activities in the absence of established signatures. However, as discussed later in the AI and Privacy Priority Area sections of this Plan, data analytic strategies can raise new security and privacy challenges of their own, such as adversarial machine learning and leakage of private data. Detect Detection seeks to ensure that system and network owners and users have situational awareness and understanding of ongoing (authorized and malicious) activities and move towards largely automated detection and warning abilities. Challenges Provide situational awareness. Systems and networks are highly complex, and device mobility increases complexity. To defend networks and systems, it is necessary to identify all of a system’s critical assets, when devices have been added or removed, and attributes and anomalies associated with the users. Real-time change detection is essential, including schemes that are flexible for dynamic network conditions and enable comparisons against known good system states. –8–