FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) Critical Dependencies Building on the dependencies identified in the 2016 Federal Cybersecurity Research and Development Strategic Plan, advancements in this Plan’s defensive elements and priority areas critically depend on continuing development of the following areas (listed alphabetically). Human Aspects Comprehensive cybersecurity requires understanding the human facets of cyber threats and secure cyber systems, and development of an informed and skilled cybersecurity workforce and general public. Many opportunities exist in economic, human, and social research for improving cybersecurity: • Advancing usable security research to design security techniques that improve usability and • • • • • • acceptability, cognitive efficiency and decision support, and collaboration both among people and with increasingly autonomous security systems. Conducting social and behavioral studies to help identify the strengths and weaknesses of incentive mechanisms to acquire and deploy cybersecurity measures. Developing psychological, sociological, and economic models of human weaknesses and strengths for use in analyzing security properties in systems and the respective roles of users, developers, operators, defenders, and adversaries. Validating models of adversary motives and susceptibility to deterrence actions such as denial, attribution, and retaliation. Preventing and detecting insider threats by designing systems, both human and technical, that can better identify insiders doing harm to their organizations’ cyber systems in real time. Pursuing studies of organizational, social, and programmer psychology to support more effective development, deployment, and adoption of security and privacy technologies. Modeling social and international norms, rules of engagement, and escalation dynamics of malicious cyber activities that range from phishing and ransomware, through censorship and information campaigns, to limited- and full-scale cyber-warfare to enable identification of institutional, social, and structural factors that promote or undermine a secure cyberspace. Research Infrastructure Access to advanced cybersecurity testbeds continues to be a hurdle for researchers. Testbeds are essential for researchers to be able to use actual operational data to model and conduct experiments on real-world system vulnerabilities and exploitation scenarios. Current methods fall short of realistically integrating human factors into experiments and accurately quantifying them as security variables to be tested. Data repositories exist today, but many are unable to deal with proliferation of massive datasets, do not support semantically rich data searches, and have limited data provenance information. The Federal Government, with industry participation, should expand the scope and fidelity of cybersecurity testbeds in multiple application areas such as cloud computing, manufacturing, energy delivery, transportation, information and networking systems, healthcare, and telecommunications. It should also enable multidisciplinary experimentation in computer science, engineering, mathematics, modeling, human behavior, sociology, economics, epistemology, and education. – 24 –