andrew yang, ph.d. associate professor of cs, cis, it cyber security institute

Tackling the Challenges of Securing the Cyber Space

- An academia perspective

1

• Cyber security challenges

• What can the academia do to help?

• The UHCL Cyber Security Institute

• Challenges faced by the academia

• Discussions (Q&A)

5/8/2013 2UHCL-CSI

Challenges of Cyber Security

1. convenience/functionalities/usability vs security - Users want useful and/or fun technology

“The user's going to pick dancing pigs over security every time.” — Bruce Schneier

5/8/2013 3UHCL-CSI

http://threelittlepigsbar-b-q.com

Challenges of Cyber Security

5/8/2013 4UHCL-CSI

2. The Internet has become the primary computing platform.     Standalone apps  Web-based   Cloud computing

Q: What are your most frequently used computer applications these days?

- Gaming ?- Search engines ?- Emailing, Texting- Facebook, LinkedIn, Twitter, …- Amazon, eBay, …- Word processors- Wikipedia, Google maps, …- Google Docs, SkyDrive, Google Drive, Evernote, …- Web browsers (HTTP)

Challenges of Cyber Security

5/8/2013 5UHCL-CSI

3. Astronomical data growth- Facebook processes more 

than 500 TB of data daily (8/22/2012: http://news.cnet.com/)

- Q: How much data are on the Internet?  

The big four online storage & service companies (Google, Microsoft, Amazon, and Facebook) have got 1,200 petabytes (or 1.2 million terabytes)  http://sciencefocus.com/qa/how-many-terabytes-data-are-internet

http://www.space.com/19580-astronomy-mystery-nova-star-explosion.html

Challenges of Cyber Security

5/8/2013 6UHCL-CSI

4. Rich data types

HTML, XHTML, XML,

MP3, MP4, …

MPEG4, AVI, WMV, …

JPEG, GIF, BMP, …

JavaScripts, Java Applets, …

Encrypted data (SSL, IPSec, …)

Challenges of BIG Data

5/8/2013 7UHCL-CSI

• Data science: extracting meaning from data and creating data products

• Business intelligence (BI)

Data scientists

Threat detection ?

Q: How do you discover unknown threats?

Q: Forecasting of threats?

http://en.wikipedia.org/wiki/Data_science

Challenges of Cyber Security

5/8/2013 8UHCL-CSI

4. Evolving technologies

5. New technology may bring new vulnerabilities!

6. Evolving tactics by attackers

BYOD or not BYOD ?

5/8/2013 9UHCL-CSI

• a 5/2012 study: http://www.zdnet.com/

Challenges of Cyber Security

5/8/2013 10UHCL-CSI

7. Ineffective sharing of threats and mitigation info

National Information Exchange Model (NIEM)

- an XML schema for data exchange among federal, state and local governments

- more widespread adoption across federal agencies

- The DoD has adopted the NIEM. (Oct., 2012)

Source: http://www.fiercegovernmentit.com

Presidential Directive & EO• Feb. 12, 2013

- The Presidential Policy Directive on Critical Infrastructure Security and Resilience

- President’s executive order - making the protection of America’s information and data assets a 

priority- information sharing among public and private partners

5/8/2013 UHCL-CSI 11

By mid June, DHS, working with the U.S. attorney general and the director of National Intelligence, will create a roadmap that will help with the timely production and release of unclassified cyber threat reports, including those aimed at specific industrial sectors. (http://www.securityinfowatch.com/)

Challenges of Cyber Security

5/8/2013 12UHCL-CSI

8. Insufficient cyber security workers- A zero-unemployment job market?

Alan PallerSANS(2011)

https://files.sans.org/

Challenges of Cyber Security

5/8/2013 13UHCL-CSI

• SANS Four Quadrants of Security Skills (2011)

Challenges of Cyber Security

5/8/2013 14UHCL-CSI

• SANS Four Quadrants of Security Skills

• Cyber security challengesWhat can the academia do to help?

• The UHCL Cyber Security Institute

• Challenges faced by the academia

• Discussions (Q&A)

5/8/2013 15UHCL-CSI

The academia can help …

5/8/2013 16UHCL-CSI

• Fill the gap between the demand and the supply of talents- Cyber security certificate programs- Degree programs

• Research and development on ‘cyber science’

• Knowledge dissemination- Forums, seminars, web portals

• Cultivate the next generation of cyber workers/warriors- Summer camps, competitions, …

The Texas Cybersecurity Education and Economic Development Council (TCEEDC)

• Cyber security challenges

• What can the academia do to help?The UHCL Cyber Security Institute

• Challenges faced by the academia

• Discussions (Q&A)

5/8/2013 18UHCL-CSI

Cyber Security Collaboration Model Strategy: 

Accelerate Bay Area Houston’s cyber security industry by leveraging the synergy created through the collaborative efforts of the community, academia, local and state government, DoD, Federal protection agencies, and regional business sectors. 

19May 8, 2013 UHCL CSI

 operations Collaborative R&D Education Corporate & Community Services

Research projects 

Original research by-  CSI faculty-  postdoc researchers-  graduate research assistants

Collaborative research with-  JSC researchers-  high tech companies’

researchers-  faculty in other colleges

Research results are integrated into the UHCL curricula.

Research findings & experiences are published and shared with the community

Research and development contracts with government agencies and business organizations

20

Knowledge acquisition & transfer 

Repository of cybersecurity research results

Continually updated cybersecurity knowledge base

-     New vulnerabilities-     New protection technologies-     Reviews of vendors and tools

Advancement of cybersecurity research and development are integrated into class teaching.

Up-to-date knowledge is transferred to start-up companies and cybersecurity professionals via collaborations and/or consulting.

Knowledge sharing 

Research publications and presentations

Online sharing of papers and project experiences

On-site research seminars On-site research workshops

and/or conferences

Supporting UHCL’s computer science, engineering and other programs with respect to cybersecurity knowledge and technologies

Certified cybersecurity curriculum by NSA, NIST, etc.

Raising user and community awareness of cybersecurity by offering free seminars

Summer camps for high schoolers

Summer research experience for college students

May 8, 2013 UHCL CSI

21May 8, 2013 UHCL CSI

The Cyber Security Collaboration Forum (4/4/2013, Gilruth Center)

5/8/2013 UHCL-CSI 22

5/8/2013 23UHCL-CSI

• Cyber security challenges

• What can the academia do to help?

• The UHCL Cyber Security InstituteChallenges faced by the academia

• Discussions (Q&A)

5/8/2013 24UHCL-CSI

Challenges faced by Academia

5/8/2013 25UHCL-CSI

Q: Why aren’t there more cyber security courses and programs in colleges and universities?

• Saturated CS and IT curricula

• Insufficient cyber security specialists

• Administration’s support

• Lack of funding … - Labs- Faculty development, hiring- Program development

Conclusion

5/8/2013 26UHCL-CSI

• Securing the cyber space presents major challenges.

• Effectively facing the challenges require not only innovations, but also collaborations among all communities (government, military, intelligence, legal, law enforcement, industries, academia, and the general public).

• Colleges and universities play a central part in the solution (workforce development, R&D, services).

• A non-profit research and education institute situated in a university can become an integrating and sharing platform for cyber security solutions.

27

• Discussions (Q&A)

5/8/2013 28UHCL-CSI