EAGER: Collaborative: Policies for Enhancing U.S. Leadership in Cyberspace

网络安全受到零日漏洞利用的威胁（以前没有披露的软件漏洞，因此是潜在的攻击载体）。对于那些可能是敌对国家的主要网络大国来说，这种威胁是严重的。公布零日漏洞可以增强国内网络基础设施的弹性（如果对手发现了相同的漏洞），并且可以给其他国家提供主动修补其系统的机会，增加他们不会被渗透的信心。然而，传播零日漏洞利用有一个明显的缺点，即该漏洞利用失去了作为武器的价值，因为各国可以修补自己的系统来抵御它。因此，公布的成本是失去了用于威慑和/或未来进攻性网络行动的此类漏洞利用。美国的政策最近开始解决政府应该公布哪些零日漏洞的问题，以加强国家安全和增强他人的信心。该项目分析了发布漏洞或补丁的各种成本和收益，并研究了如何通过政策或技术手段降低成本。在一项新的合作中，计算机科学家Stephanie Forrest和政治学家Robert Axelrod正在开发综合方法来解决迅速扩大的网络冲突问题，结合历史分析，技术研究，战略分析和计算建模。 该项目侧重于美国政策可以在网络空间中提供额外领导力的三个领域：零日漏洞的公布;中立基础设施的标记，例如与医院或宗教场所相关的网络，以及保护中立网络空间的共同规范;以及互联网互操作性的维持，允许不同网络上的互联网用户直接通信而不受干扰。这些发现可能有利于国家安全，因为它为政策制定者提供了一种评估发布漏洞或补丁的成本和收益的方法。该项目为有关网络议程的辩论注入了新鲜和及时的声音，提出了减少国家行为者之间冲突的可能性和影响的具体措施。

Cybersecurity is threatened by the zero-day exploits (software vulnerabilities that have not been previously disclosed and are therefore potential vectors for attack). The threat is serious for exploits in the hands of major cyber powers that are potentially hostile nations. Publication of a zero-day exploits can enhance the resilience of domestic cyber-infrastructure (if an adversary has discovered the same exploit), and it could give other countries the opportunity to patch their systems proactively, increasing confidence that they will not be penetrated. Communicating zero-day exploits, however, has the obvious drawback that the exploit loses value as a weapon, because countries could patch their own systems to resist it. Thus, the cost of publication is the loss of such exploits for use in deterrence and/or future offensive cyber operations. U.S. policy has recently begun to address the question of which zero-day exploits known to the government should be published, both to enhance national security and to instill confidence by others. The project analyzes various costs and benefits of publishing exploits or patches, and studies how the costs might be mitigated whether through policy or technical means. In a new collaboration, computer scientist, Stephanie Forrest, and political scientist, Robert Axelrod, are developing integrated approaches to the rapidly expanding problem of cyber conflict, combining historical analysis, technical research, strategic analysis, and computational modeling. This project focuses on three areas where U.S. policy could provide additional leadership in cyberspace: publication of zero-day exploits; labeling of neutral infrastructure, such as networks associated with hospitals or religious sites, and shared norms to protect neutral cyberspaces; and sustainment of Internet interoperability, which allows Internet users on different networks to communicate directly without interference. The findings may benefit national security by giving policymakers a way of assessing the costs and benefits of publishing exploits or patches. This project injects a fresh and timely voice into debates about the cyberagenda, suggesting concrete measures for minimizing the likelihood and impacts of conflict among state actors.