R&D center to offer 'building blocks' of cybersecurity
Connecting state and local government leaders
NIST's National Cybersecurity Center of Excellence plans to add a federally funded center to help accelerate adoption of existing cybersecurity technology.
There is no lack of commercially available tools to counter rapidly evolving cyber threats, but putting them into place and having them work together efficiently can be a challenge.
Available tools often are not used because the technology might be difficult to use, might not be widely known or might be too expensive to be practical. Integrating products from different vendors into a single, cost-effective system also can be difficult.
The National Institute of Standards and Technology is planning to help agencies and other organizations put those tools in play, partnering with a non-profit organization to provide technical and project management support for its National Cybersecurity Center of Excellence (NCCOE).
The new federally funded research and development center would be the first of its kind dedicated to cybersecurity and would facilitate cooperation between the private sector and the NCCOE. NIST has released an initial notice of its intent to partner with such a center and expects to issue a request for proposals this summer. The non-profit organization will have to be fully organized to bid on the contract.
The center of excellence was established last year by NIST, the State of Maryland and Montgomery County to help speed the adoption by government and industry of off-the-shelf tools to protect IT systems and networks. Initial workspace is located at University of Maryland facilities in Rockville, and NIST provides overall management. The proposed R&D center would provide research, development, engineering and technical support for NCCOE projects.
The proposed center would not work on development of new technologies but on the implementation and integration of existing ones, said NCCOE deputy directory Nate Lesser.
“We focus on increasing the rate of adoption of technology,” Lesser said. “We are very much focused on technology that is available today,” that could be implemented by users within 12 months. “We believe that existing security technologies are not as widely used as they could be.”
The NCCOE will partner with private industry to develop “building blocks,” a sample architecture that could be used to address a need. The specifications would be in the public domain and could be used or adapted to particular needs.
NCCOE will work on solutions to security problems identified by other organizations. A “use case” will be developed for each project, articulating the business and operational needs that will be addressed and the challenges to meeting them, together with a high-level architecture. The use case will be published to the tech community soliciting recommendations for components and products that could help solve the problems, and interested vendors will work with the labs to produce a building block example.
NCCOE is ramping up to full operational capacity, and four labs have been established in its initial facilities. In April it signed agreements with 11 companies that will contribute hardware, software and personnel and share best practices.
At the moment, NCCOE has just one active project, Health IT, and has published its first use case for the use of mobile devices for the secure exchange of electronic health care information. The center expects to issue a use case for continuous monitoring this summer, Lesser said.
NCCOE also collaborated with industry last year on a scheme for enforcing geolocation restrictions for cloud computing, so that agencies could ensure that sensitive work remains on secure servers. This was published as a NIST Interagency Report.
NIST identified in its notice a range of R&D, engineering and technical support needed from a partner:
- Developing frameworks and implementation strategies for investment in and adoption of cybersecurity controls and for the transfer of federal technology to the private sector.
- Providing systems and engineering support.
- Delivering plans for applying cybersecurity standards, guidelines and best practices in government and the private sector.
Comments on the proposed federally funded research and development center should be sent by July 22 to NIST contracting officer Keith Bubar at keith.bubar@nist.gov.
NEXT STORY: DataGauss fast way destroy hard drives