009 - Imperative 2 Innovate and Accelerate Investment for the Security and Growth of Digital Networks and

Section eight of Report on Securing and Growing the Digital Economy. This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox dot org.

Recording by J. D. Gibson. Report on Securing and Growing the Digital Economy by the Commission on Enhancing National Cybersecurity Imperative two Innovate and accelerate investment for the security and growth of digital networks and the Digital Economy.

The challenge and the way forward. The Internet of Things IoT is a buzz phrase that is associated with a great deal of marketing hype, and as such was a term mostly ignored by policymakers and the public until about a year ago. In the digital world, the future arrives quickly, and the core technical idea behind the IoT, A proliferation of devices ranging from ordinary household appliances and toys to industrial process controllers, all connected to the Internet, is leading the way.

Within the past several years, the complex and expanding information technology network that was dominated by the Internet has become much more connected with the physical world. It is increasingly difficult to identify equipment or devices that are not or could not be connected to the Internet to provide improved capabilities in healthcare, transportation, retail, and other sectors of our economy and society. We are experiencing a revolution in which all objects in our daily lives are converging on similar computing and communication capabilities and therefore also on similar susceptibility to cyber threats.

Because this convergence causes the things in our lives to become infused with information technology and linked with worldwide connecttions, IoT users become meaningful participants in the nation's cybersecurity. The IoT blurs the distinctions between critical infrastructure regulated devices and consumer products. The less aware consumers are of this connectivity and its security implications, the more likely it is that personal devices, even devices as ordinary as coffee makers and thermostats, could be compromised by malicious actors.

Connected devices, which include both cyber physical IoT devices that interact with the physical world and other information technologies, such as smartphones and personal computers, are so ubiquitous that segregating them from networks that host critical infrastructure devices or other operational technology or OT managed devices may soon become completely impractical. The consequences for cybersecurity are enormous as we are just beginning to experienceriants. In September twenty sixteen, the largest distributed denial of service or d DOS attack ever recorded, almost twice as powerful as any before, was orchestrated using a botnet that relied on compromised IoT devices.

Another attack took place the following month. Purely personal or consumer technology can be used maliciously at large scale, with highly detrimental impacts. Indeed, as the attacks in recent months make clear, IoT devices can be significant weak links in our global networks, easily weaponized to deliver destructive and destabilizing attacks. And while the attacks we are witnessing today may appear to be limited mainly to DDoS, as the computing power in connected devices increases, and as we come to depend on them to control, either directly or indirectly, machinery with the power to create kinetic effects, whether electrical or mechanical, the dangers will increase dramatically.

We must improve the standards, guidelines, and best practices available to secure these connected devices and systems. Of course, these are effective only if they take hold and become part of the supply chain. It is essential that companies selling connected devices ensure that their suppliers require the same security and components and subcomponents, and that they take steps via the testing process to enforce those requirements. To understand the cybersecurity implications of the widespread deployment of connected devices, the public will need to be better educated and more involved.

The goal should be to achieve security by default in all connected devices, and to ensure that the consumer and integrator alike know what security capabilities are or are not contained in the u S devices. The IoT is an area of special concern in which fundamental research and development r and D is needed, not just to develop solutions that continue to foster innovation, but also to build in opportunities for reducing the risk involved with ubiquitous connectivity. In the United States, the private sector generally funds and focuses on near term research and on transitioning successful research from any source into commercial products.

Government funding of long term, high risk research and of mission specific r and D thus remains critically important. Despite the large overall investment in cybersecurity r and D, funding for creating inherently secure technology products, systems, and environments is, in comparison, relatively small. The government should invest in fundamental cyber R and D that will foster them the development of inherently secure, defensible, and resilient or recoverable systems. The private sector should help determine this research agenda and work with the federal agencies to ensure that the results of this research are readily usable in improving technologies, products, and services.

Recommendation two point one. The federal government and private sector partners must join forces rapidly and purposefully to improve the security of the Internet of Things IoT. The term IoT describes everything from jet engines to children's toys to industrial machinery. For example, a pocket step counter and an implanted pacemaker are both small battery powered health devices that sense body functions, can connect to networks, and take actions accordingly, both are squarely within the IoT, Yet one is life critical while the other is a disposable consumer good, and the two are almost entirely distinct in the considerations of design, security, and operation that went into creating them.

The IoT is collapsing our concepts of individual sectors, businesses, and architectures by its ubiquitous connectivity and use of other powerful capabilities such as network protocols and cloud computing. This technological development is forcing us to reconsider our definitions of sectors, perimeters, trust, and control. One main concern in assessing the security needs of an IoT device should be where and how it can be used. A pacemaker needs to be designed to exact specifications, while a consumer grade fitness tracker can be designed to a different set of security standards.

We need both a set of general security principles specified in international standards and IoT recommendations tailored to specific sectors, applications, and risks. The United States must lead a global push to drive security and secure development concepts into IoT design and development. The hour for doing so is already late. The first generations of IoT devices, billions in number, have already been deployed in homes, hospitals, and automobiles across the nation.

Some devices are secure, but most are not, as seen in recent attacks and in malware that exploits poor security designs, developments and configurations. In devices, weak security carries enormous safety implications. Moreover, privacy protections are frequently an afterthought in the design of these devices. Some observers argue that the window for securing IoT devices has closed, but the Commission believes that an opportunity to make the standard secure to market still exists, particularly in the production of single purpose, life critical or safety items for consumers.

Consumer labels, and rating systems are discussed further in Imperative three Action Item three point one point one. The private sector and government must partner in this effort, as they are already doing in some areas, including the developments of self driving cars. Where IoT is deployed in life critical environments, designers and manufacturers need to closely examine the balance between efficiency and security to ensure that security is not compromised in life threatening ways.

For the sake of innovation, driving security requirements away from the end user, particularly for consumer facing IoT connected devices, is critical. Agencies that currently regulate IoT devices should follow the example of the National Highway Traffic Safety Administration NHTSA and begin working immediately with industry to develop voluntary and collaborative guidelines to secure IoT devices. For example, automotive manufacturers have called for a consistent set of federal guidelines for autonomous vehicles, and they have worked with the NHTSA on such rules.

Action Item two point one point one to facilitate the development of secure IoT devices and systems within sixty days, the President should issue an executive order directing INIST to work with industry and voluntary standards organizations to identify existing standards, best practices, and gaps for deployments ranging from critical systems to consumer or commercial uses, and to jointly and rapidly agree on a comprehensive set of risk based security standards, developing new standards where necessary.

Short term, these risk based security standards should be scalable and tailored to the direct impacts of a device or system being compromised, while still achieving a common baseline level of security. Of course, these security standards alone will not benefit the public unless consumers are able to readily assess whether the devices they purchase comply with them. Yet, consumers cannot be expected to understand the technical details of the variety of connected devices they use.

To bridge this information gap, non governmental organizations on the model of UL or Consumer Reports should develop clear and understandable labels to assist consumers in understanding the cybersecurity risks of the products they purchase. These labels should be based, at least in part, on whether and to what degree a given device conforms to the standards and best practices that in ist identifies, consumer labels and rating systems are discussed further in Imperatives three, Action Item three point one point one.

Together, standards and conformity assessments can positively impact almost every aspect of the IoT. The federal government's procurement process may also be used to incentivize conformity with these standards by making conformance an explicit component of vendor bids or product selection Action Item two point one point two. Regulatory agencies should assess whether effective cybersecurity practices and technologies that are identified by the standards process in Action Item two point one point one are being effectively and promptly implemented to improve cybersecurity, and should initiate any appropriate rule making to address the gaps medium term.

Because devices that use common computing platforms and span multiple markets, areas and infrastructures are proliferating, federal reguls pulatory agencies should start any new regulatory action using a standards based approach. They should cite items identified and developed in Action Item two point one point one where practical and in accordance with omb guidance, as well as undertaking public private partnerships. The NIST led process should include the active participation of appropriate federal and state regulatory bodies to facilitate their efforts.

Omb's Office of Information and Regulatory Affairs ORIA, in coordination with Federal Standards officials as defined in OMB circular as one one nine, should monitor and assess the state of IoT and connected device cybersecurity and report on progress and gaps on a regular basis. If additional gaps are identified that regulation is unable to address, OMB should work with Congress to propose appropriate action Action Item two point one point three. The Department of Justice should lead an interagency study with the Departments of Commerce and Homeland Security to work with the Federal Trade Commission, the Consumer Product Safety Commission, and interested private sector parties to assess the current state of the law with regard to liability for harm caused by faulty IoT devices and provide recommendations within one hundred eighty days short term to the extent that the law does not provide appropriate incentives for companies to design security into their products and does not offer protections for those that do.

The President should draw on these recommendations to present Congress with a legislative proposal to address identified gaps, as well as explore actions that could be accomplished through Executive Order Action Item two point one point four. The Industrial Control System Cyber Emergency Response Team ICs CERT should develop and communicate guidelines for IoT cybersecurity and privacy best practices for rapid deployment and use. Short term. Initial best practices should include requirements to mandate that IoT devices be rendered unusable until users first change default usernames and passwords.

Weak usernames and passwords would be rejected by the device. ICs CERT, DHS, and NIST should work with industry and fund grants to develop secure, open source software that has purpose built to support certain types of IoT devices over the full life cycle of each product. Recommendation two point two, The federal government should make the development of usable, affordable, inherently secure, defensible, and resilient or recoverable systems its top priority for cybersecurity research and development R and D.

As part of the overall R and D Agenda, the Commission recommends that federal R and D funding for cybersecurity increase by approximately four billion dollars over the next ten years for the federal civilian agencies, with a high priority given to efforts that will result in the use integration and deployment of affordable, inherently secure privacy, protecting usable, functional, resilient, recoverable, and defensible systems. Current efforts in cybersecurity R and D are not as well coordinated and balanced as they should be.

Many resources, in terms of time, talent, and funding are being used to develop additional reactive capabilities that identify threats and vulnerabilities, provide some additional protection, detect threat activity, and respond to threat actions. We will be unable to shift the advantage in cybersecurity away from attackers until we collectively recognize that continued dependence on reactive cybersecurity makes it easier for attackers to find compromised systems. OUR R and D priorities should be rebalanced to address this need and to maximize impact.

Far too few resources are being devoted to creating inherently secure technology products, systems, and environments, or to understanding how existing technology supporting this goal can best be adopted and integrated. Dramatic increases are needed in cybersecurity capabilities in the systems on which they rely, particularly in the civilian commercial sector, as well as the technology products and services that those systems use. Such a significant increase can be accomplished only through a national R and D effort targeted at creating defensive systems that are usable, secure, and resilient.

These systems should be designed, built, deployed, and configured in such a way that they are inherently secure, protect privacy, degrade gracefully, and support simple and fast recovery when compromises occur while still maintaining functionality and supporting business needs and missions. An inherently secure system would be unassailable. That is, it would be a system for which significant vulnerabilities either provably do not exist or are exceptionally hard to find an exploit without quick detection and remediation.

The best approach to achieving such systems entails interweaving development practices using computationally hard protections, conducting empirical analysis throughout the system's development life cycle, and implementing system components in ways that are verifiable, accountable, and adaptable. Private investment in products and services tends to undervalue cybersecurity, as the urge to be first to market too often outweighs the need to be secure to market. In addition to rebalancing and increasing funding for work on more inherently secure technologies, the federal government should direct more attention to cybersecurity related research outside of traditional technical areas.

Support should be provided for cybersecurity R and D focused on human factors and usability, public policy, law metrics, and the societal impacts of cybersecurity. Advances in these areas are critical to ensuring the successful adoption and use of both existing technologies and those that are being developed. This research would especially assist in meeting the cybersecurity needs of users, particularly individuals and small and media sized businesses. Action Item two point two point one.

The Director of the Office of Science and Technology Policy OSTP should lead the development of an integrated government private sector cybersecurity roadmap for developing usable, affordable, inherently secure, resilient and recoverable privacy protecting functional and defensible systems. This effort should be backed by a significant R and D funding increase in the President's budget request for agencies supporting this roadmap. Short term, today's systems are not resilient against serious attack.

That is, they are not inherently secure, and defending them as difficult and in some cases not even possible. Software for these systems has been developed using software components, programming languages, and testing methods and other practices that do not appropriately take security into account. Although the current scope of cybersecurity r and D includes enabling the creation of resilient systems, this work must be broadened at its timeframe accelerated. In the past, defensible systems were difficult to use, did not support the workflow of businesses, and consequently were not employed markets, users, and society more generally did not understand or appreciate such systems.

While current products exist that support this goal of inherent security, they are not sufficiently integrated into US government systems or the devices and network in our national economy. Focused research is needed to address this issue. Making secure systems and devices the norm requires more thoughtful and coordinated R and D planning to set goals for the next decade. It also requires increases in R and D funding for researchers in government, industry, and academia so that those goals can be met.

The Federal cyber Security Research and Development Strategic Plan, released in February twenty sixteen, includes several federal R and D objectives that support the creation of more resilient software. These should be built on and expanded in conducting this research. Greater use should be made of challenge competitions with money, prizes and other creative approaches that engage individuals and teams of innovators. These competitions should include development of new technologies along with innovation in the use and systems integration of existing inherently secure technologies.

The cybersecurity community has had some success with the challenge competition model, especially the Cyber Grand Challenge created recently by the Defense Advanced Research Projects Agency DARPA. These efforts should be sustained, multi year and iterative. Examples of possible challenge competition topics include privacy enhancing technologies, IoT security, defect free software, blockchain, and pervasive encryption Action Item two point two point two. The US government should support cybersecurity focused research into traditionally underfunded areas, including human factors and usability policy, law metrics, and the social impacts of privacy and security technologies, as well as issues specific to small and medium sized businesses where research can provide practical solutions short term.

The federal, civilian and Defense R and D agencies should support academia, industry, and research foundations conducting research that supports the ostp LAD plans. This support should all also includes cybersecurity policy research. A useful complement to, but not substitute four.