Research | Science of Security Virtual Organization

NSA SoS Research Initiative

The Science of Security (SoS) Initiative at the National Security Agency Research Directorate promotes foundational cybersecurity science that is needed to mature the cybersecurity discipline and to underpin advances in cyberdefense. Beginning in 2012, one part of the initiative is to fund foundational research at “Lablets.” With emphasis on building a community, each lablet created partnerships with other universities called “Sub-Lablets.” Science of Security researchers often freely collaborated with researchers in other institutions worldwide. The SURE project was founded to investigate cybersecurity in the cyber-physical systems realm and ran from 2014 to 2018. In 2018, CPS research was folded into the Lablet Research.

Mission & Goals

Critical cyber systems must inspire trust and confidence, protect the privacy and integrity of data resources, and perform reliably. To tackle the ongoing challenges of securing tomorrow’s systems we must develop the scientific underpinnings of security to understand what is possible in that domain as well as develop a collaborative community of researchers from government, industry and academia. As part of that effort NSA began funding academic “Lablets” focused on the development of a Science of Security (SoS) and a broad, self-sustaining community effort to advance it. A major goal is the creation of a unified body of knowledge that can serve as the basis of a trust engineering discipline, curriculum, and rigorous design methodologies. The results of SoS Lablet research will be extensively documented and widely distributed through the SoS Virtual Organization. Our intention is for the SoS VO to be our primary resource for describing Lablet research, and for creating a broad community effort to advance security science.

Hard Problems

Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.

Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.

Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.

Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.

Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.

Annual Reports

Virtual Institutes

The National Security Agency Research Directorate sponsors the SoS Virtual Institutes for advancing foundational research in the areas of AI for Cybersecurity, Trusted Systems, and Defense Mechanisms. These virtual institutes provide for a collaborative community in the topic area. These institutes are structure so that projects can be added or retired as the field advances.

Previously Funded Research Lablets

Carnegie Mellon University
International Computer Science Institute
North Carolina State University
University of Illinois at Urbana-Champaign
University of Kansas
Vanderbilt University

SURE Project

Mission and Goals

The project on the System Science of SecUrity and REsilience for cyber-physical systems (SURE) ran from 2014 to 2018, with the goal of developing foundations and tools for designing, building, and assuring cyber-physical systems (CPS) that can maintain essential system properties in the presence of adversaries. The technology base of SURE will provide CPS designers and operators with models, methods, and tools that can be integrated with an end-to-end model-based design flow and tool chain.