Authentication, Detection, Identification

• Develop fast and scalable methods for high-confidence authentication.

• Explore approaches that could self-monitor traffic and users to detect either anomalous users or unusual traffic patterns.

• Develop intruder-detection methods that scale to function efficiently in large systems.

Containment

• Develop the tools and design methodologies for systems and networks that support graceful degradation in response to an attack.

• Develop mechanisms to contain attackers and limit damage rather than completely shutting down the system once an intrusion is detected.

• Explore how to fuse a simple, basic control system used during “crisis mode” with a sophisticated control system used during normal operations.

Recovery

• Develop schemes for backing up large systems, in real time and under “hostile” conditions, that can capture the most up-to-date, but correct, snapshot of the system state.

• Create new decontamination approaches for discarding as little good data as possible and for removing active and potential infections on a system that cannot be shut down for decontamination.

Cross-cutting Issues in Information and Network Security

• Develop tools that support security-oriented systems development.

• Find new ways to test bug fixes reliably.

• Develop better system-administration tools for specifying security policies and checking against prespecified system configurations.

• Create new tools to detect added and unauthorized functionality.

• Develop authentication mechanisms that provide greater security and are easier to use.

• Create and employ metrics to determine the improvement to system security resulting from the installation of a security measure.

• Monitor and track emerging types of attack and explore potential consequences of such attacks.

• Understand why previous attempts to build secure systems have failed and recommend how new efforts should be structured to be more successful.

C3I Systems for Emergency Response

• Understand how to transition gracefully and with minimal disruption from a unit-specific communication system to a systemwide structure.

• Define new communication protocols and develop generic technology to facilitate interconnection and interoperation of diverse information sources.

• Develop approaches for communication systems to handle surge capacity and function in a saturated state.

• Develop methods to provide more capacity for emergency communication and coordination.

• Create self-adaptive networks that can reconfigure themselves as a function of damage and changes in demand and that can degrade gracefully.