1. Andrew Yang, Ph.D. Associate Professor of CS, CIS, IT Cyber Security Institute Tackling the Challenges of Securing the Cyber Space - An academia perspective 1

2. Cyber security challenges What can the academia do to help? The UHCL Cyber Security Institute Challenges faced by the academia Discussions (Q&A) 5/8/20132UHCL-CSI

3. Challenges of Cyber Security 1.convenience/functionalities/usability vs security - Users want useful and/or fun technology “ The user's going to pick dancing pigs over security every time. ” — Bruce Schneier 5/8/20133UHCL-CSI http://threelittlepigsbar-b-q.com

4. Challenges of Cyber Security 5/8/20134UHCL-CSI 2.The Internet has become the primary computing platform. Standalone apps  Web-based  Cloud computing Q: What are your most frequently used computer applications these days? - Gaming ? - Search engines ? - Emailing, Texting - Facebook, LinkedIn, Twitter, … - Amazon, eBay, … - Word processors - Wikipedia, Google maps, … - Google Docs, SkyDrive, Google Drive, Evernote, … - Web browsers (HTTP)

5. Challenges of Cyber Security 5/8/20135UHCL-CSI 3.Astronomical data growth -Facebook processes more than 500 TB of data daily (8/22/2012: http://news.cnet.com/)http://news.cnet.com/ -Q: How much data are on the Internet? The big four online storage & service companies (Google, Microsoft, Amazon, and Facebook) have got 1,200 petabytes (or 1.2 million terabytes) http://sciencefocus.com/qa/how- many-terabytes-data-are-internet http://sciencefocus.com/qa/how- many-terabytes-data-are-internet http://www.space.com/19580-astronomy-mystery- nova-star-explosion.html

6. Challenges of Cyber Security 5/8/20136UHCL-CSI 4.Rich data types HTML, XHTML, XML, MP3, MP4, … MPEG4, AVI, WMV, … JPEG, GIF, BMP, … JavaScripts, Java Applets, … Encrypted data (SSL, IPSec, …)

7. Challenges of BIG Data 5/8/20137UHCL-CSI Data science: extracting meaning from data and creating data products Business intelligence (BI)  Data scientists  Threat detection ? Q: How do you discover unknown threats? Q: Forecasting of threats? http://en.wikipedia.org/wiki/Data_science

8. Challenges of Cyber Security 5/8/20138UHCL-CSI 4.Evolving technologies 5.New technology may bring new vulnerabilities! 6.Evolving tactics by attackers

9. BYOD or not BYOD ? 5/8/20139UHCL-CSI a 5/2012 study: http://www.zdnet.com/ http://www.zdnet.com/

10. Challenges of Cyber Security 5/8/201310UHCL-CSI 7.Ineffective sharing of threats and mitigation info National Information Exchange Model (NIEM) -an XML schema for data exchange among federal, state and local governments -more widespread adoption across federal agencies -The DoD has adopted the NIEM. (Oct., 2012) Source: http://www.fiercegovernmentit.com http://www.fiercegovernmentit.com

11. Presidential Directive & EO Feb. 12, 2013 -The Presidential Policy Directive on Critical Infrastructure Security and Resilience -President’s executive order -making the protection of America’s information and data assets a priority -information sharing among public and private partners 5/8/2013UHCL-CSI11  By mid June, DHS, working with the U.S. attorney general and the director of National Intelligence, will create a roadmap that will help with the timely production and release of unclassified cyber threat reports, including those aimed at specific industrial sectors. (http://www.securityinfowatch.com/)http://www.securityinfowatch.com/

12. Challenges of Cyber Security 5/8/201312UHCL-CSI 8.Insufficient cyber security workers -A zero-unemployment job market? Alan Paller SANS (2011) https://files.sans.org/

13. Challenges of Cyber Security 5/8/201313UHCL-CSI SANS Four Quadrants of Security Skills (2011)

14. Challenges of Cyber Security 5/8/201314UHCL-CSI SANS Four Quadrants of Security Skills

15. Cyber security challenges  What can the academia do to help? The UHCL Cyber Security Institute Challenges faced by the academia Discussions (Q&A) 5/8/201315UHCL-CSI

16. The academia can help … 5/8/201316UHCL-CSI Fill the gap between the demand and the supply of talents -Cyber security certificate programs -Degree programs Research and development on ‘cyber science’ Knowledge dissemination -Forums, seminars, web portals Cultivate the next generation of cyber workers/warriors -Summer camps, competitions, …

17. The Texas Cybersecurity Education and Economic Development Council (TCEEDC)

18. Cyber security challenges What can the academia do to help?  The UHCL Cyber Security Institute Challenges faced by the academia Discussions (Q&A) 5/8/201318UHCL-CSI

19. Cyber Security Collaboration Model Strategy: Accelerate Bay Area Houston’s cyber security industry by leveraging the synergy created through the collaborative efforts of the community, academia, local and state government, DoD, Federal protection agencies, and regional business sectors. 19May 8, 2013UHCL CSI

20. operations Collaborative R&DEducationCorporate & Community Services Research projects  Original research by - CSI faculty - postdoc researchers - graduate research assistants  Collaborative research with - JSC researchers - high tech companies’ researchers - faculty in other colleges Research results are integrated into the UHCL curricula. Research findings & experiences are published and shared with the community Research and development contracts with government agencies and business organizations 20 Knowledge acquisition & transfer Repository of cybersecurity research results Continually updated cybersecurity knowledge base - New vulnerabilities - New protection technologies - Reviews of vendors and tools Advancement of cybersecurity research and development are integrated into class teaching. Up-to-date knowledge is transferred to start-up companies and cybersecurity professionals via collaborations and/or consulting. Knowledge sharing Research publications and presentations Online sharing of papers and project experiences On-site research seminars On-site research workshops and/or conferences Supporting UHCL’s computer science, engineering and other programs with respect to cybersecurity knowledge and technologies Certified cybersecurity curriculum by NSA, NIST, etc. Raising user and community awareness of cybersecurity by offering free seminars Summer camps for high schoolers Summer research experience for college students May 8, 2013UHCL CSI

21. 21May 8, 2013UHCL CSI

22. The Cyber Security Collaboration Forum (4/4/2013, Gilruth Center) 5/8/2013UHCL-CSI22

23. Space Systems Protection in Cyber Risk Environment The U.S. aerospace industry and civil/commercial space operations community exists in an increasingly contested environment. New challenges from the cyber front to U.S. economic and technical superiority as well as critical mission and infrastructure capability are emerging daily. NASA is moving to address these new challenges by adapting and applying time- tested system engineering methods and philosophies to the new domains of cyber risk assessment, cyber-defense and their element in space systems mission assurance. This presentation will discuss the new environment in which the U.S. aerospace sector must operate, some of the methods NASA has used to adapt, and some lessons learned and future opportunities. Jason A. Soloff Lead, Systems Security Engineering Human Exploration & Operations Mission NASA/JSC 5/8/201323UHCL-CSI

24. Cyber security challenges What can the academia do to help? The UHCL Cyber Security Institute  Challenges faced by the academia Discussions (Q&A) 5/8/201324UHCL-CSI

25. Challenges faced by Academia 5/8/201325UHCL-CSI Q: Why aren’t there more cyber security courses and programs in colleges and universities? Saturated CS and IT curricula Insufficient cyber security specialists Administration’s support Lack of funding … -Labs -Faculty development, hiring -Program development

26. Conclusion 5/8/201326UHCL-CSI Securing the cyber space presents major challenges. Effectively facing the challenges require not only innovations, but also collaborations among all communities (government, military, intelligence, legal, law enforcement, industries, academia, and the general public). Colleges and universities play a central part in the solution (workforce development, R&D, services). A non-profit research and education institute situated in a university can become an integrating and sharing platform for cyber security solutions.

27. 27

28. Discussions (Q&A) 5/8/201328UHCL-CSI