DHS moves ahead with cybersecurity R&D efforts
New pilot programs will include private sector firms and incident data
Computerworld - SAN MATEO, Calif. -- The Department of Homeland Security is actively planning several new pilot projects that officials hope will help solve one of the most pressing cybersecurity research problems to date: a lack of real-world attack data.
"The cybercommunity has suffered for years from the lack of good data for testing," said Douglas Maughan, security program manager at the Homeland Security Advanced Research Projects Agency, which is part of the DHS's Science and Technology Directorate.
That's why the DHS is moving ahead rapidly with a new program called Protected Repository for Defense of Infrastructure Against Cyber Threats (Predict), said Maughan, who spoke at an industry conference here sponsored by the U.S. Secret Service.
The Predict program has been under way since February and is aimed at getting large private-sector infrastructure companies to volunteer real-world incident data that researchers can use to test prototype security products.
"We're looking to collect large, different types of data," said Maughan. He noted that the government wouldn't hold the data and said those who volunteer for the program can have data "anonymized."
Maughan said the program would rely on a trusted access repository process that includes a government-funded but third-party hosted data repository with written agreements with data providers. Researchers can apply to take part in the program, and data owners would be allowed to stop specific researchers from accessing their data, said Maughan. So far, nearly two-dozen enterprises have indicated interest in the program, which is scheduled to go live after Jan. 1.
The agency is also spearheading a new vender-neutral cybersecurity test bed, known as DETER for Cyber Defense Technology Experimental Research, that will help develop next-generation security technologies for the nation's critical infrastructure. The goal is to construct a homogeneous emulation cluster based on the University of Utah's Emulab facility, said Maughan.
So far, he said, $14 million has been earmarked for the program, which allows researchers to focus on security vulnerability prevention and detection and test the security and trustworthiness of operational systems. The DHS plans to hold an industry day on Sept. 27 to answer questions about the program, and plans to award pilot project contracts in mid-January 2005.
Along with the DETER test bed, the DHS has formed an ad hoc government/industry steering committee to study and develop security pilot projects for the Domain Name System, a critical part of the Internet infrastructure that converts text names of Web sites into Internet Protocol addresses. The goal is to develop pilot projects to study specific threats and vulnerabilities to the DNS, including loss of service due to
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast Best Practices: How to Improve Business Continuity with Virtualization VMware solutions include a range of business continuity capabilities to help ensure availability for applications across your virtualized environment. Learn More>>
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- Live Webcast
Enhance Your Virtualization Infrastructure With IBM and Vmware
Date: Wednesday, May 14, 2014, 1:00 PM EDT
Virtualization technology is now expanding beyond the server compute elements to encompass networking and storage...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts