On Cyber Security R&D, Education and the Proposed Czar

CA Community — Wed, 10 Jun 2009 18:45:00 GMT

Earlier today I had the opportunity to testify in Congress at a hearing on cyber security R&D. I appreciate that opportunity and am proud to have represented the views of CA, the Business Software Alliance (BSA) and industry in general in discussing cyber security research, development and education. You can read the testimony, but I thought I'd discuss here a few key points as they relate to the recently released White House Cyberspace Policy Review, possible activities for the to-be-named cyber security coordinator, and education as a key element to our nation's security online.

The area of R&D - the key focus of my testimony - was done collaboratively with the BSA, of which CA is a member. In my testimony, I highlighted perceived shortcomings in the Federal Plan for Cyber Security and Information Assurance Research and Development (CSIA plan) and suggested solutions for the cyber security agenda and the area of cyber security R&D. Specific items include:

The suggestion for a new method of defining R&D projects to supplement traditional requests for proposals. There should be a way for industry to more easily and proactively suggest R&D projects to various agencies and support them in almost a "sole source" initiative.
Improve long-term cyber security research. This view aligns with the Cyberspace Policy Review's emphasis on R&D in "game-changing technology that will help meet infrastructure objectives." The view of CA and BSA is that the government first check to see if commercially available solutions are available that provide the same or an equivalent capability. If commercial solutions exist - or could be readily adapted - this would allow the government to better use its resources and focus on research that may bring breakthroughs in technology for the long-term, rather than short- and mid-term solutions.
Facilitate the migration path of technologies developed through Federal R&D. This basically calls for research and technologies developed by federal agencies to become more available to industry through licensing, and for the intellectual property to remain with the industry for technologies developed by industry with government support.

The human element also is critically important to ensuring our nation is secure in the cyber world. Everyone must play a role. Everyone needs to know what the cyber security threats are and how to be smart online. This view also is in line with the Cyberspace Policy Review, and the government already has several efforts underway to educate the public. An important element to consider here, however, is education is not a "one-size-fits-all" option. Teens need slightly different education than the 60 and 70-year-olds who are online and federal programs must be aligned appropriately.

The other facet of education that I touched on in my testimony is that of our university and college systems. There are several government agencies supporting security higher education successfully, but there is always more we can do to keep the curricula on pace with the rapid changes in technology and to drive more interest in security specialization. More than ever we need to put individuals in the workforce who are not only skilled in secure coding, but also in security systems and architecture.

Securing our nation in cyberspace is critical. It's one of the most important arms races in the 21^st century and failure to win this race would change life as we know it today. To facilitate this effort, President Obama plans to appoint a Cyber Security Coordinator to work across the National Security Staff and the National Economic Council. The job has been loosely defined and much has been written, speculated and suggested about the role. What are the top 3 skills and background elements this person should have to effect change through this role? For example, what is most important - his or her security expertise, or the ability to bring together groups with agendas that are not perfectly aligned? Should this person be a Washington insider, or someone from industry or academia? Or a combination of all three? What do you think?

Security Management : Identity Management, Cyber Czar

On Cyber Security R&D, Education and the Proposed Czar