FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) systems also must address their continual evolution through development and operational phases as defects are detected and fixed; new missions, markets, and platforms are targeted; and new capabilities are added. Further, fixing software defects imposes a risk of introducing additional defects, which squarely points to a need for improved management of software development and testing. R&D Goals • Develop cost- and threat-proportionate integrated root-of-trust alternatives for various hardware • • • • • • devices, ranging from low-cost IoT devices and networked sensor devices to server computers. Develop techniques for authenticated secure boot, authenticated secure software updates, and authenticated secure software execution with security guarantees extending from the hardware layer to the application layer. Develop novel processes, techniques, and mechanisms that protect against reverse-engineering efforts. Develop mechanisms and tools that verify the security properties of hardware. Develop secure debug and testing techniques. Develop crypto-agility to migrate existing advanced encryption standards-based infrastructure to post-quantum cryptographic solutions. Develop hybrid cryptography schemes for cost-proportionate security. Develop efficient general solutions against code-reuse attacks. Develop new software development methodologies that allow rapid revision and regression against security goals. Develop secure update mechanisms that support the full range of product formats (i.e., proprietary and open source); applications (e.g., enterprise services and IoT); and lifecycles. Develop empirical understanding of software defect rates, effort, and calendar time that are achievable with alternative software development and sustainment technologies, and of relationships between software defects and software vulnerabilities. Based upon empirical understanding, develop paradigm and supporting technology to develop and sustain software with less than 1 defect per 100,000 lines of code (LOC) without compromising quality attributes, cost, or schedule. Develop tools and techniques for effective management of software systems. Education and Workforce Development There is a shortage in the United States of qualified cybersecurity workers, and the supply-demand gap is increasing in both quality (the competence required) and quantity. This gap threatens all sectors of the national critical infrastructure and will throttle aspirations in the advancement of AI and QIS. The gap is deeply rooted in the education and training infrastructure; it includes a shortage of qualified teachers, trainers, and advanced faculty. 24 The current culture of treating cybersecurity as an add-on requirement is a barrier to effective, efficient solutions and complicates the successful adoption of innovative technologies. The sociotechnical challenges involving human, social, organizational, economic, and technical factors, and the complex interaction among them require engagement with all sectors of society. This requires increasing diversity and inclusion and broadening participation in the R&D community. In addition, scientists and engineers often lack experience in business formation and may not understand the commercial viability of their innovations, hindering the effective transfer of technology to products. 24 https://www.nist.gov/system/files/documents/2018/07/24/eo_wf_report_to_potus.pdf – 21 –