Cybersecurity Research Challenges Jeannette M. Wing Assistant Director Computer and Information Science and Engineering Directorate National Science Foundation and President’s Professor of Computer Science Carnegie Mellon University Cybersecurity Summit, Crystal City, VA May 8, 2008

Outline The Setting: Then and Now What’s Missing Long-term outlook Big picture 5 new research areas Cybersecurity Jeannette M. Wing

The Setting: Then and Now We are at risk. Increasingly, America depends on computers. They control power delivery, communications, aviation, and financial services. They are used to store vital information, from medical records to business plans to criminal records. Although we trust them, they are vulnerable—to the effects of poor design and insufficient quality control, to accident, and perhaps most alarmingly, to deliberate attack. The modern thief can steal more with a computer than with a gun. Tomorrow’s terrorist may be able to do more damage with a keyboard than with a bomb. 1991 Computers at Risk, National Academies CSTB Study, p. 7. 8 networked systems 1999 Trust in Cyberspace, CSTB Study. 8 ubiquity 2001 September 11 everywhere, everyone, all the time, embedded, invisible, visible, mobile, wearable, handheld, remote, peta, tera, giga, mini, micro, nano, good guys, bad guys 2007 Improving Cybersecurity for the 21st Century, CSTB Study. Cybersecurity Jeannette M. Wing

Cybersecurity Jeannette M. Wing Credit: NCO/NITRD Credit: U.S. Department of Homeland Security Credit: NCO/NITRD Cybersecurity Jeannette M. Wing

What’s Missing in Our Thinking Be proactive, not reactive. We are using yesterday’s solutions to address today’s threats. We should be ready today for tomorrow’s threats. We are not. Anticipate the future. Long-term outlook Big picture view Foundational research Cybersecurity Jeannette M. Wing

Long-Term Outlook: Who and Why Threats Today: hackers, criminals Tomorrow: organized crime, terrorists, nation-state, enemy state Motivation Today: fame, money Tomorrow: power, control Attacks Use cyberattack as an amplifier of a physical attack Cyberspace is an enabler Attack the Internet More likely as we put more key functionality on-line Use cyberspace to hide Today (2008) Cybersecurity Jeannette M. Wing

Long-Term Outlook: How Today: code-level vulnerabilities Flaws in the code Tomorrow: component-level vulnerabilities Flaws in the design module, system, application, service, … aka interface mismatch, composition flaws, feature interaction, … Simple examples of design-level flaws - Netscape browser and Domain Name Server spoofing attack, Princeton [DFW96] - Google Desktop Search and Java applets, Rice [NFW04] - Microsoft Outlook and IE settings, Microsoft Research and Carnegie Mellon [PW05] Cybersecurity Jeannette M. Wing

Big Picture: It’s not just security Cyber Security and Information Assurance Big Picture: It’s not just security Trustworthy systems Security Reliability Privacy Usability people hardware program prog. lang. O/S compiler system arch. application service High Confidence Systems Holistic view Technical: The whole stack  Non-Technical Psychology and human behavior - Usable security - Social engineering attacks - Privacy - Insider threat - Attacker’s motivation Economics, risk management, law, politics Cybersecurity Jeannette M. Wing

Cybersecurity Jeannette M. Wing Credit: NCO/NITRD

What’s Missing? 5. Usability 1.Foundations 2. Software security 4. Privacy 3. Metrics 2. Software security 2. Composability 5. Usability What’s Missing? Cybersecurity Jeannette M. Wing Credit: NCO/NITRD

1. Foundations New models, logics, and theories for analyzing and reasoning about Security Reliability Privacy Usability Crypto for quantum Cybersecurity Jeannette M. Wing

Foundations: Security Models Yesterday: Security Perimeter - Bell-LaPadula model, Orange Book - Lampson’s access rights matrix - Secure O/S kernel Egeskov Slot, Denmark (1554) Today: “Security Without Borders” Spread of Code Red Worm 2001 drawbridge moat Where’s the perimeter? What do you try to protect? Cybersecurity Jeannette M. Wing

Foundations: Logics for Reasoning About Privacy Do you read these? What are they saying? Can you trust them? This privacy statement goes on for seven screenfuls! Cybersecurity Credit: Microsoft Jeannette M. Wing

Foundations: Cryptography Quantum/traditional cryptography immune to quantum-based attacks Traditional cryptography based on RSA is breakable by Shor’s quantum algorithm Credit: Oxford University Cybersecurity Jeannette M. Wing

2. Security Architectures What we have Point solutions to point problems, e.g., Code-level solutions buffer overruns Firewalls for intrusion detection What we need Integration of solutions Up and down the vertical stack, from hardware to appl’ns. At each layer, e.g., routers and links at the network layer Compositionality of components and services Cybersecurity Jeannette M. Wing

Composition of Components and of Security Policies Global Security Policy (GSP)  Consider more simply, SPA  SPB: SPA  SPB  GSP SPA  SPB  SPA and SPA  SPB  SPB ? Local Security Policy (SPA) Local Security Policy (SPB) || Consider the composition A || B: A || B GSP A || B SPA and A || B SPB ? Component A Component B Cybersecurity Jeannette M. Wing

Google Desktop Search Google Desktop Search results www.google.com results Cybersecurity Jeannette M. Wing Credit: Google

Netscape and Domain Name Server Give me an IP address for user.foo.com browser DNS server Here is one: 1.2.3.4 Names to IP addresses mapping user.foo.com [1.2.3.4, 1.2.3.5, 1.2.3.6] user.bar.com [1.2.3.5, 1.2.3.7] Cybersecurity Jeannette M. Wing

3. Security Metrics Challenge #3: Computing Research Associates Grand Challenges on Trustworthy Computing, November 16-18, 2003 http://www.cra.org/grand.challenges Challenge #3: Within 10 years, develop quantitative information-systems risk management that is at least as good as quantitative financial risk management. Cybersecurity Jeannette M. Wing

Measuring the Relative Attack Surface Windows NT 4 Windows 2000 Windows Server 2003 RASQ RASQ with IIS enabled RASQ with IIS Lockdown 100 200 300 400 500 600 700 3. Windows in “lockdown” mode for NT4.0 and 2000 are each more secure than raw mode. 1. Windows Server 2003 is “more secure” than previous versions. 2. Windows w/IIS enabled is only slightly worse for Windows Server 2003, in contrast to its predecessors. Cybersecurity Jeannette M. Wing

Attack Surface Attacks system surface 1. Methods 2. Channels 3. Data Attacks Entry/Exit Points The attack surface of a system is the ways in which an adversary can enter the system and potentially cause damage. Reduce the attack surface  Increase system’s security Cybersecurity Jeannette M. Wing

4. Privacy Today: Threats to citizens’ privacy in many sectors of daily life Health, financial, e-commerce, social networks, e-voting Fundamental challenge: Once someone learns a secret about you, you cannot take away that knowledge Different from security (e.g., revoking access to a file, changing a lock on a door) Cybersecurity Jeannette M. Wing

Privacy: A Few Questions to Ponder What does privacy mean? How do you state a privacy policy? How can you prove your system satisfies it? How do you reason about privacy? How do you resolve conflicts among different privacy policies? Are there things that are impossible to achieve wrt some definition of privacy? How do you implement practical mechanisms to enforce different privacy policies? As they change over time? How do you measure privacy? (Is that a meaningful question?) Cybersecurity Jeannette M. Wing

Privacy and Confidentiality Doctor Billing bill X-ray Patient Database Only the doctor may see the privacy policy What other privacy policies does the database enforce? Unfortunately, such confidentiality policies are embedded in source code. Cybersecurity Jeannette M. Wing

Privacy and Software Analysis extraction tool application code policy Cybersecurity Jeannette M. Wing

5. Usability The user is the weakest link in security. Challenges Striking a balance between control and convenience Users are human. Targets of social engineering attacks Sources of insider threats Cybersecurity Jeannette M. Wing

Usable Security (IE) Clicking Your Way Through Security Cybersecurity Jeannette M. Wing

Usable Privacy (Firefox) Clicking Your Way Through Privacy Cybersecurity Jeannette M. Wing

Summary of Research Challenges New research foci Theoretical foundations: models, logics, crypto Software architecture Metrics Privacy Usability Enhanced investments in existing research foci: Software security engineering Networking Testbeds Cybersecurity Jeannette M. Wing

Summary of What’s Missing Anticipate tomorrow’s threat. Take a broad view. Long-term Holistic Research Basic research in new areas Enhanced investments in existing areas Education Cybersecurity Jeannette M. Wing

Good guys and bad guys are in a never-ending race! Trustworthy Security Axiom Good guys and bad guys are in a never-ending race! The Good Guys try to ensure the Security Properties. The Bad Guys launch the Security Attacks. Cybersecurity Jeannette M. Wing

Thank you.

Academia-Industry Relations Old Model Go it alone Individual work Slow, serial Focus on ideas Basic research Less focus on specific ideas Simpler regulations Funding sufficiency Companies had money Indirect benefits New Model Partnered Joint work Fast, parallel Focus on IP Bayh-Dole (1985) Applied research More focus on specific ideas Complex regulations Tax rules, export rules, COI Funding challenges Research $ at program manager level Direct benefits Cybersecurity Jeannette M. Wing

Credits Copyrighted material used under Fair Use. If you are the copyright holder and believe your material has been used unfairly, or if you have any suggestions, feedback, or support, please contact: jsoleil@nsf.gov Except where otherwise indicated, permission is granted to copy, distribute, and/or modify all images in this document under the terms of the GNU Free Documentation license, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation license” (http://commons.wikimedia.org/wiki/Commons:GNU_Free_Documentation_License) Cybersecurity Jeannette M. Wing