Workshop: Security of the Cyber Infrastructure

本提案计划举办一个研讨会，探讨有关网络基础设施安全的问题，旨在聚集具有数据访问、信息安全、计算机网络安全、数据和数据库安全、隐私和数据保密等跨学科专业知识的主要基础设施安全利益相关者，为保护基础设施的未来战略提供见解和方向。为了加强各级基础设施的安全，讲习班力求确定短期和长期战略要取得成功必须回答哪些问题。从技术和政策问题以及两者之间的相互作用来看，这项工作解决了基础设施保护的基本问题。计算机安全有三个重点：机密性、完整性和可用性（CIA）。基础设施的安全性涉及许多组件在不同级别上的动态交互：身份验证、授权、访问控制、审计和保证（AAAAA）。说明基础设施需要安全性的许多问题仍然没有解决。因此，重点包括：*如何定义和衡量基础设施中的安全性*如何定义安全策略，哪些安全策略应应用于各种基础设施组件，以及在必要时如何协调策略*如何将信任分配给控制整个网络路由的消息，等等。此外，研讨会还将探讨：*学术基础设施在提供安全基础设施方面的作用；*基础设施系统的机构和管理人员之间的伙伴关系，可以促进建立安全的全球基础设施；以及*确保能够满足技术和计算机与信息科学研究挑战所需的伙伴关系。更广泛的影响：由于互联网的基础设施虽然脆弱，但却是大多数人的生活、许多组织、公司和国家的经济结构的基础，本次研讨会希望提出一套加强基础设施安全的战略，并提出一套指导其实施的问题。预期讲习班将有助于获得充分的保证，从而在基础设施以及支持它的工具和技术方面达到期望的信心水平。

This proposal, planning a workshop to examine questions regarding the security of the cyber infrastructure, aims at gathering the main infrastructure security stakeholders with interdisciplinary expertise on data access, information security, computer network security, data and database security, privacy, and data confidentiality to provide insights and directions toward future strategies for protecting the infrastructure. With the goal of strengthening the security of the infrastructure at all levels, the workshop seeks to determine what questions have to be answered for short and long-term strategies to be successful. Looking at both technical and policy issues and the interaction between the two, the work addresses fundamental questions of infrastructure protection. Computer security has three main thrusts: Confidentiality, Integrity, and Availability (CIA). Security of Infrastructure involves the dynamic interaction of many components and at different levels: Authentication, Authorization, Access control, Auditing, and Assurance (AAAAA). Many questions illustrating the need for security in the infrastructure remain open. Hence, highlights include: * How security in the infrastructure should be defined and measured * How security policies should be defined, whose security policies should apply to various infrastructure components, and how policies should be reconciled when necessary * How trust should be assigned to messages that control routing throughout the network, etc. Additionally, the workshop may also look into: * The role that academic infrastructure can play in providing a secure infrastructure, * Partnerships between agencies and managers of infrastructure systems that may facilitate the creation of a secure world-wide infrastructure, and * Partnerships required ensuring that the technological and computer and information science research challenges can be met. Broader Impact: Since the infrastructure of the Internet, albeit fragile, underlies the fabric of most people's lives, economy of many organizations, companies, and nations, the workshop expects to present a set of strategies for strengthening security of infrastructure and a set of questions to guide their implementation. The workshop is expected to contribute in attaining sufficient assurance to lead to a desired level of confidence in the infrastructure and the tools and technologies that support it.