Consortium pushes for cybersecurity R&D
IDG News Service -
A consortium of 23 security research institutions is calling on the government and private companies to put more research and development muscle into cybersecurity. Among other things, the group would like to see more effort put into the development of code vulnerability scanners and technology for scanning individual computers for sources of attacks.
The Institute for Information Infrastructure Protection (I3P), a group of colleges and U.S. research laboratories, didn't ask for a specific budget today. But it challenged the U.S. government and private industry to spend money in eight cybersecurity areas it feels are underresearched.
I3P Chairman Michael Vatis jokingly denied starting last weekend's Slammer worm attack on the Internet as a way of bringing attention to R&D needs in cybersecurity. "We're reminded of our vulnerabilities daily -- and how vulnerable we are to attacks," he said. "There's a critical piece of this problem that to date has not received the attention and focus that is needed, and that is research and development."
I3P, based at Dartmouth College in Hanover, N.H., and funded through the U.S. Department of Commerce's National Institute of Standards and Technology, released a 55-page R&D agenda today (download PDF).
The I3P's initial cybersecurity report calls for more R&D in eight general areas: enterprise security management; trust among distributed autonomous parties; discovery and analysis of security properties and vulnerabilities; secure system and network response and recovery; traceback, identification and forensics; wireless security; metrics and models; and law, policy and economics.
The report goes into detail about what the organization wants, and the I3P brought experts to talk about each item during a kick-off event in Washington.
I3P member Wayne Meitzler, cybersecurity R&D program manager at the U.S. Department of Energy's Pacific Northwest National Laboratory, called for more research into vulnerability scanners that could test for weaknesses in object code and source code.
Meitzler said he's not aware of any good object-code vulnerability scanners that customers ranging from home users to corporations could use to detect bad code on their computers.
"We have these new pieces of software we install on our computers, and we really don't know the pedigree of that particular software," he said. "Someone could easily embed malicious code in that particular software. The level of trust of the software that we pick up on a CD and put on our machine we really don't understand, and we really don't know."
One audience member suggested that the use of more open-source software could help solve the problem of unknown source code. Meitzler said the I3P
Reprinted with permission from
Story copyright 2009 International Data Group. All rights reserved.
Security
Additional Resources



Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
Death to PST Files
Download Now
The Tangled Web: Silent Threats & Invisible Enemies
Download Now
Tape Killed the IT Guy
Watch Now
Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity
Download Now
BRM: What You Can Do To Reduce Risk In Challenging Times
Watch this webcast now!
What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices
Download Now
Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".
eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

