Trust in Cyberspace

Full Title of Reference

Trust in Cyberspace

Full Citation

Nat'l Research Council, Trust in Cyberspace (Fred B. Schneider ed., National Academy Press 1999). Web

BibTeX

Categorization

• Resource by Type: Independent Reports
• Threats and Actors: Military Networks (.mil); Public Data Networks; Telephone
• Issues: Incentives; Public-Private Cooperation; Risk Management and Investment
• Approaches: Government Organizations

Key Words

Computer Network Attack, COTS Software, Cyber Security as an Externality, Cyber Security as a Public Good, Denial of Service Attack, Interdependencies, Research & Development, Risk Modeling, SCADA Systems, Software Vulnerability

Synopsis

This book, edited by a study committee convened by the Computer Science and Telecommunications Board (CSTB) of the National Research Council, provides an assessment of the current state of the art procedures for building trustworthy networked information systems. It proposes directions for research in computer and network security, software technology, and system architecture. In addition, the book assesses current technical and market trends in order to better inform public policy as to where progress is likely and where incentives could help.

To be labeled as trustworthy, a system not only must behave as expected but also must reinforce the belief that it will continue to produce expected behavior and will not be susceptible to subversion. The question of how to achieve assurance has been the target of several research programs sponsored by the Department of Defense and others. Yet currently practiced and proposed approaches for establishing assurance are still imperfect and/or impractical. Testing can demonstrate only that a flaw exists, not that all flaws have been found; deductive and analytical methods are practical only for certain small systems or specific properties. Moreover, all existing assurance methods are predicated on an unrealistic assumption—that system designers and implementers know what it means for a system to be “correct” before and during development. The study committee believes that progress in assurance for the foreseeable future will most likely come from figuring out (1) how to combine multiple approaches and (2) how best to leverage add-on technologies and other approaches to enhance existing imperfect systems. Improved assurance, without any pretense of establishing a certain or a quantifiable level of assurance, should be the aim.

Key Findings:

• The public telephone network (PTN) is increasingly dependent on software and databases that constitute new points of vulnerability. Business decisions are also creating new points of vulnerability. Protective measures need to be developed and implemented.

• In some respects, the Internet is becoming more secure as its protocols are improved and as security measures are more widely deployed at higher levels of the protocol stack. However, the increasing complexity of the Internet’s infrastructure contributes to its increasing vulnerability. The end points (hosts) of the Internet continue to be vulnerable. As a consequence, the Internet is ready for some business use, but abandoning the PTN for the Internet would not be prudent for most. The Internet is too susceptible to attacks and outages to be a viable basis for controlling critical infrastructures. Existing technologies could be deployed to improve the trustworthiness of the Internet, although many questions about what measures would suffice do not currently have answers because good basic data (e.g., on Internet outages) is scant.

• Operational errors represent a major source of outages for the PTN and the Internet. Some of these errors could be prevented by implementing known techniques, whereas others require research to develop preventative measures.

• The design of trustworthy networked information systems (NISs) presents profound challenges for system architecture and project planning. Little is understood, and this lack of understanding ultimately compromises trustworthiness

• To develop an NIS, subsystems must be integrated, but little is known about doing this. In recent years, academic researchers have directed their focus away from large-scale integration problems; this trend must be reversed.

• It is clear that networked information systems will include commercial off the shelf (COTS) components into the foreseeable future. However, the relationship between the use of COTS components and NIS trustworthiness is unclear. Greater attention must be directed toward improving our understanding of this relationship.

• Although there are accepted processes for component design and implementation, the novel characteristics of NISs raise questions about the utility of these processes. Modern programming languages include features that promote trustworthiness, and the potential may exist for further gains from research.

• Formal methods are being used with success in commercial and industrial settings for hardware development and requirements analysis and with some success for software development. Increased support for both fundamental research and demonstration exercises is warranted.

• Security research during the past few decades has been based on formal policy models that focus on protecting information from unauthorized access by specifying which users should have access to data or other system objects. It is time to challenge this paradigm of “absolute security” and move toward a model built on three axioms of insecurity: insecurity exists; insecurity cannot be destroyed; and insecurity can be moved around.

• Cryptographic authentication and the use of hardware tokens are promising avenues for implementing authentication.

• Obstacles exist to more widespread deployment of key management technology and there has been little experience with public-key infrastructures, especially large-scale ones.

• Because NISs are distributed systems, network access control mechanisms play a central role in the security of NISs. Virtual private networks and firewalls have proven to be promising technologies and deserve greater attention in the future.

• In its necessary efforts to pursue partnerships, the federal government also needs to work to develop trust in its relationships with the private sector, with some emphasis on U.S.-based firms.

• The National Security Agency’s (NSA) organization must increase its efforts devoted to outreach and recruitment and retention issues.

• Defense Advanced Research Projects Agency (DARPA) is generally effective in its interactions with the research community, but DARPA needs to increase its focus on information security and NIS trustworthiness research, especially with regard to long-term research efforts.

• An increase in expenditures for research in information security and NIS trustworthiness is warranted.

Additional Notes and Highlights

Expertise Required: Technology - Moderate