16 November 1998
Source: Excerpt from
Critical Foundations:
Protecting America's Infrastructures, Part 2:
http://www.pccip.gov/part2.pdf
| Objective | Increase investment in infrastructure assurance R&D from $250 million to $500 million in FY 99, with incremental increases in investment over a five-year period to $1 billion in FY 04. Target investment in specific areas with high potential to produce needed improvements in infrastructure assurance. |
Federal R&D efforts are inadequate for the size of the R&D challenge presented by emerging cyber threats. Only about $250 million per year is being spent on federal infrastructure assurance-related R&D, of which 60 percent—$150 million—is dedicated to information security. There is very little research supporting a national cyber defense. The Commission believes that real-time detection, identification, and response tools are urgently needed. We concluded that market demand is currently insufficient to meet these needs.
R&D for infrastructure protection requires partnership among government, industry, and academia to ensure a successful and focused research and technology development effort.
| We Recommend: | The President propose an increase in the federal investment in infrastructure
assurance research to $500 million in FY99 and incremental increases in annual
funding over a five-year period to $1 billion in FY04 for a targeted R&D
program focusing on the six R&D areas listed below.
|
| We Recommend: | The National Research Council define, more fully, a national infra-structure assurance research program and lead an effort with departments and agencies already engaged in R&D relevant to each infrastructure. |
Few infrastructures are taken for granted more than our fresh water systems. There is little chance of a threat reducing the quantity of available water sufficiently to endanger the population or cause industrial collapse. But there is risk of malicious attacks over time undermining public confidence. Alternatives for protecting the water supply are few. The most feasible approach we found is a research effort focused on water contamination detection technologies. Effective applications could be developed commercially and implemented at the state and local level.
| We Recommend: | The creation of a specific R&D program to provide the scientific knowledge and technology necessary to allow highly toxic chemical and biological agents to be detected, identified, measured and treated in near real-time in the nation’s water supply systems. The program should be administered by the EPA. |
Real time detection of cyber threats is a special challenge to the R&D community. While this area is included in our recommendation above for additional R&D investment, it is central to the future security of our infrastructures. Some effort is under way, but it requires continued funding and high priority.
Although many industry and government groups are dedicated to ensuring the technical performance of next generation telecommunications networks, there has been no cohesive effort for protecting this infrastructure against the emerging threat of cyber attack. Such effort should include a system of surveillance, assessment, early warning, and response mechanisms to mitigate the potential for cyber threats. Although current methodology for this centralized effort does not exist, several of the basic technical elements required are successfully deployed on a small-scale basis, or in research, and could be integrated into a limited cohesive, national cyber response element.
Conceptually, a successful cyber attack warning and response system would include:
1) A means for near real-time monitoring of the telecommunications infrastructure.2) The ability to recognize, collect, and profile system anomalies associated with attacks.
3) The capability to trace, re-route, and isolate electronic signals that are determined to be associated with an attack.
| We Recommend: | The R&D program include a priority effort to develop such an Early Warning and Response capability. |
Considering the serious and growing threat of a chemical or biological attack, chemical and biological agent detectors and effective protective and clean-up equipment are urgently needed and should be included in R&D efforts.