Federal Cybersecurity Research and Development Strategic Plan

 

2019 Federal Cybersecurity Research and Development Strategic Plan

Every four years, the applicable Federal agencies, working through the National Science and Technology Council and the NITRD program, develop and update the Federal Cybersecurity Research and Development Strategic Plan. This 2019 Federal Cybersecurity Research and Development Strategic Plan supersedes the 2016 Federal Cybersecurity Research and Development Strategic Plan. The Plan aims to coordinate and guide federally funded R&D in cybersecurity, including development of consensus-based standards and best practices. The Plan identifies four interrelated defensive capabilities (deter, protect, detect, and respond) and six priority areas for cybersecurity R&D (artificial intelligence, quantum information science, trustworthy distributed digital infrastructure, privacy, secure hardware and software, and education and workforce development) as the focusing structure for Federal cybersecurity R&D activities and investments to benefit the Nation.

Background

  • Request For Information (RFI)
    In preparation for the strategic plan update, the CSIA IWG posted a Request for Information (RFI) [Federal Register Doc. 2018-24668], seeking public input on Federal priorities in cybersecurity R&D. The RFI public responses received are posted here. Please note that these responses do not represent the views and/or opinions of the U.S. Government, NSTC NITRD Subcommittee, NITRD National Coordination Office, any other Federal agencies or government entities.

↑ top
 

2016 Federal Cybersecurity Research and Development Strategic Plan

As part of the President’s Cybersecurity National Action Plan (CNAP), the Administration released the 2016 Federal Cybersecurity Research and Development Strategic Plan, which was coordinated by the National Science and Technology Council. This is the most comprehensive Federal cybersecurity research and development (R&D) plan to date, and it updates 2011’s Trustworthy Cyberspace: Strategic Plan for the Federal Cybersecurity Research and Development Program. With the goal of making cyberspace inherently more secure, the plan challenges the cybersecurity R&D community to provide methods and tools for deterring, protecting, detecting, and adapting to malicious cyber activities. The plan defines near-, mid-, and long-term goals to guide and evaluate progress. Read more in the White House announcement of the strategic plan.

Background

↑ top
 

2011 Federal Cybersecurity Research and Development Strategic Plan

In 2011, Federal agencies released “Trustworthy Cyberspace: Strategic Plan for the Federal Cybersecurity Research and Development Program”, a strategic plan for cybersecurity research and development.

The strategic plan provides a framework for prioritizing Federal cybersecurity R&D in a way that concentrates research efforts on limiting current cyberspace deficiencies, precluding future problems, and expediting the infusion of research accomplishments into the marketplace. The main thrusts of the strategy are:

  • Inducing Change – using game-changing themes to understand the root causes of existing cybersecurity deficiencies with the goal of disrupting the status quo;
    • Tailored Trustworthy Spaces
    • Moving Target
    • Designed-In Security
    • Cyber Economic Incentives
  • Developing Scientific Foundations – minimizing future cybersecurity problems by developing the science of security;
    • Science of Security
  • Maximizing Research Impact – catalyzing coordination, collaboration, and integration of research activities across Federal agencies for maximum effectiveness; and
  • Accelerating Transition to Practice – expediting improvements in cyberspace from research findings through focused transition programs.

Achieving enduring trustworthiness of cyberspace requires new paradigms that re-balance security asymmetries of today’s landscape: the cost of simultaneously satisfying all the requirements of an ideal cybersecurity solution in a static system is impossibly high, and so we must enable sub-spaces in cyberspace to support different security policies and different security services for different types of interactions; the cost of attack is asymmetric, favoring the attacker, and so defenders must increase the cost of attack and must employ methods that enable them to continue to operate in the face of attack; the lack of meaningful metrics and economically sound decision making in security misallocates resources, and so we must promote economic principles that encourage the broad use of good cybersecurity practices and deter illicit activities.

↑ top
 

Publications and References

Strategic Plan Review

Strategic Plan Background

Presentations

Other References

↑ top