New approach needed to IT, says NIST’s top cyber scientist

NIST Senior Fellow Ron Ross (Source: FedScoop)

No amount of security software, firewalls or anomaly detection systems can protect an IT infrastructure that’s fundamentally insecure and a new approach to computer architecture is required to deal with the looming cybersecurity crisis, the National Institute of Standards and Technology’s top computer security scientist told the president’s commission on long-term cybersecurity.

The “only way” to address the looming cybersecurity crisis is “to build more trustworthy secure components and systems,” Ron Ross told the Commission on Enhancing National Cybersecurity during a Tuesday meeting in Minneapolis.

The commission, established by presidential order, held the latest in a series of public meetings to hear testimony about how to secure U.S. IT systems for the next decade.

“As a nation,” Ross said, “we are spending more on cybersecurity today than at any time in our history, while simultaneously continuing to witness an increasing number of successful cyberattacks and breaches.”

In other words: the security we currently have in place isn’t working.

The reason: “You cannot protect that which you do not understand … Increased complexity translates to increased attack surface.”

The result is “limitless” — and growing — opportunities for hackers “to exploit vulnerabilities resulting from inherent weaknesses in the software, firmware, and hardware components of the underlying systems and networks,” Ross said.

As organizations and users struggle to find and patch known vulnerabilities, the number of unknowns keeps growing as systems grow more numerous and complex and continue to be built in ways that are insecure.

Current approaches “fail to address the fundamental weaknesses in system architecture and design,” he said.

Ross called for a new approach based on “build[ing] more trustworthy secure components and systems by applying well-defined security design principles in a life cycle-based systems engineering process.”

Security, he observed, “does not happen by accident.”  Things like safety and reliability needs to be engineered in from the beginning, he argued, comparing the process to the “disciplined and structured approach” used to design structurally sound bridges and safe aircraft.

“Those highly assured and trustworthy solutions may not be appropriate in every situation, but they should be available to those entities that are critical to the economic and national security interests of the U.S.” like “the electric grid, manufacturing facilities, financial institutions, transportation vehicles, water treatment plants, and weapons systems.

This new approach “will require a significant investment of resources and the involvement of essential partnership including government, industry, and the academic community,” said Ross, comparing it to the moonshot of the 1960’s.

“The clock is ticking and time is short,” he concluded, “We have an opportunity to do what is necessary to protect our national treasure and defend the country in the brave new world of cyberspace.”