FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) key factors are modeling attacker effort (i.e., money, time, or computational cost), effectiveness, and risks, given the characteristics and capabilities of the defenders and users. Providing effective and timely attribution. Accurate attribution of malicious cyber activities to their sources opens a broad range of response options, such as sanctions or prosecution. Supporting robust investigations. Effective investigative tools for law enforcement create the basis for collecting the evidence required for successful prosecution of cyber adversaries. Sharing information for attribution. Effective mechanisms for sharing attribution information must be developed and must support investigations that cross international or domestic law enforcement jurisdictions. Protect The second defensive element, Protect, focuses on creating systems and networks that are highly resistant to malicious cyber activities through assurance-based engineering practices that will simultaneously protect a system and supply the verifiable evidence needed to support its assurance case. Challenges Limiting Vulnerabilities There are five essential approaches needed to produce software, hardware, or firmware with fewer defects that present security vulnerabilities, as described below: Design for security. In many cases, security vulnerabilities in a system are present from the start. To avoid systemic security vulnerabilities, system architects must begin with accurate threat models and a robust understanding of the intended applications. Further, security tools, policies, and systems must operate as part of larger sociotechnical systems. This demands design attention to interoperability, maintainability, and evolvability in the context of other technologies, and to how these tools can be adopted by and adapted to the human and organizational contexts in which they will be deployed. Build secure. Implementation errors can undermine the security of well-designed components. Although common vulnerabilities such as buffer overflows and memory leaks are well understood by most developers, they remain difficult to eliminate. Existing tools and practices that prevent developers from creating specific types of security vulnerabilities are imperfect and inefficient. To reduce common product vulnerabilities, tools and practices for software and hardware development are needed that significantly improve developer productivity and operational system performance. Verify security. Even when products are designed for security and are built to be robust, implementation errors may creep in during system development. In addition to undergoing functional testing, components should be subjected to rigorous security analysis throughout the development process. Because adversaries use static analysis tools and fuzzing tools to find previously unknown (“zero-day”) software vulnerabilities, rigorous application of these tools should be used to identify and eliminate vulnerabilities before a product goes to market. Maintain security. Inevitably, even software that is well-designed, implemented by knowledgeable developers with good tools, and subjected to comprehensive security testing still will have defects. When errors are identified, the software must be updated. The mechanisms used to update software can unintentionally introduce vulnerabilities instead of eliminating them. Building in secure mechanisms for updating software or firmware is essential to securing products throughout their lifecycles. –7–