Defense Advanced Research Projects AgencyTagged Content List


Relating to digital systems and information

Showing 34 results for Cyber + Automation RSS
To be effective, Department of Defense (DoD) cybersecurity solutions require rapid development times. The shelf life of systems and capabilities is sometimes measured in days. Thus, to a greater degree than in other areas of defense, cybersecurity solutions require that DoD develops the ability to build quickly, at scale and over a broad range of capabilities.
For the past decade, cybersecurity threats have moved from high in the software stack to progressively lower levels of the computational hierarchy, working their way towards the underlying hardware. Despite growing recognition of the issue, there are no common tools, methods, or solutions for chip-level security currently in wide use. This is largely driven by the economic hurdles and technical trade-offs often associated with secure chip design. Further, modern chip design methods are unforgiving – once a chip is designed, adding security after the fact or making changes to address newly discovered threats is nearly impossible.
Modern-day software operates within a complex ecosystem of libraries, models, protocols and devices. Ecosystems change over time in response to new technologies or paradigms, as a consequence of repairing discovered vulnerabilities (security, logical, or performance-related), or because of varying resource availability and reconfiguration of the underlying execution platform. When these changes occur, applications may no longer work as expected because their assumptions on how the ecosystem should behave may have been inadvertently violated.
The Department of Defense (DoD) maintains information systems that depend on Commercial off-the-shelf (COTS) software, Government off-the-shelf (GOTS) software, and Free and open source (FOSS) software. Securing this diverse technology base requires highly skilled hackers who reason about the functionality of software and identify novel vulnerabilities.
The growth of the internet-of-things (IoT) and network-connected composed systems (e.g., aircraft, critical-infrastructure, etc.) has led to unprecedented technical diversity in deployed systems. From consumer IoT devices developed with minimal built-in security, which are often co-opted by malware to launch large distributed denial of service (DDoS) attacks on internet infrastructure, to remote attacks on Industrial Control System (ICS) devices, these newly connected, composed systems provide a vast attack surface. While the diversity of functionality and the scope of what can now be connected, monitored, and controlled over the Internet has increased dramatically, economies of scale have decreased platform diversity.