FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) Detect vulnerabilities. Changes in system configuration, installation of new applications, or discovery of new techniques may reduce a system’s level of protection or create new vulnerabilities. Tools are required to identify shortcomings in protection measures in near real-time so the situation can be remediated. Qualified personnel to serve on vulnerability assessment “red teams” are scarce. Effectively detect rapidly evolving malicious cyber activities. Operations are highly dynamic, and context is significant; as a result, current tools have many false positives and false negatives and fail to differentiate malicious cyber activities from authorized operations. Many techniques for recognition of malicious cyber activities are also retrospective in nature: these tools look for malicious activities that conform to a known historical pattern. Such tools are rendered useless when faced with innovation by an adversary. R&D is required to ensure that detection techniques can reliably detect the full range of adversaries’ malicious cyber activities and reduce detection time. In particular, tools are needed that can detect zero-day malware and innovative sequences of operations with acceptable levels of false positives and negatives. Behavioral intrusion detection and heuristic tools, which look for anomalies compared to system baseline activities, offer a promising avenue of research. Scalable mathematical techniques capable of extracting useful information from extremely large datasets could lead to more effective detection of malicious cyber activities from data sources such as network logs. Respond Effective defense entails the ability to adapt, counter, recover, and adjust to malicious cyber activities. Cyber defenders must respond rapidly and effectively to adversarial activities whether precisely targeted or on a global scale. Systems must withstand these events such that their critical mission and operational functions still meet minimum performance requirements and substantial damage is avoided. Resilient systems will continue to perform correctly during and after such activities and will recover from adverse effects. To sustain resiliency, systems must also dynamically adapt to changing threats. Moreover, effective response includes countering malicious cyber activities by imposing additional costs on adversaries. Countering is aimed at exposing, degrading, disrupting, or blocking malicious activities. Challenges As cybersecurity technologies are integrated into complex systems and systems of systems, responses often have unforeseen dependencies and coupled interactions. Developers and users need visibility and insight into these system behaviors, as well as analytic techniques and response pathways that maintain clarity and trust and avoid unintended consequences. Another challenge comes from the increasing use of autonomous systems, which must support response, recovery, and adjustment with little or no interaction with (or even knowledge on the part of) cyber defenders. The implications of autonomy must be considered as resilience design principles and technologies advance. Multiscale risk governance presents technical challenges to current cyber defense activities. Decisions that increase, decrease, or shift factors that contribute to risk are made at many levels and at multiple scales. Decisions made at one level can affect other levels in complex and difficult-to-understand ways. Technical approaches are needed to identify and understand risk dependencies and explore resulting decision spaces. Complicating this process is that the time within which decisions must be made and implemented continues to shrink: detection, assessment, and mitigation of cyber threats and malicious activities must occur faster than the speed at which adversaries can exploit systems. In this ever- –9–