The Importance of Modeling – SENDSim, Part 2

By Greg Amis & Carl Hunt

From the beginnings of the SENDS Project and well before, you’ve heard it time and again: cybersecurity experts face a daunting mix of ever-changing threats and a technological landscape that grows in complexity every day. Preparing a robust plan for network defense requires not just a detailed understanding of information technology but a careful appreciation of how the actions and inactions of ordinary users can enhance or compromise security. In fact, people and how we represent them in planning and design are fundamental inputs of the Design process, as discussed in the 30 September blog, “Design and the Science of Cyberspace.”

Experience has shown that security plans may on the surface seem robust but can be circumvented by users in their quest to accomplish work tasks. Other plans may meet security and information assurance goals but inadvertently prevent legitimate operations from running effectively. Further, even the best plans and designs cannot be executed unless security experts can motivate institutional leaders and decision makers to appreciate the real threats against cybersecurity in an environment of increasingly tight budgets and conflicting priorities.

Fortunately, these are all issues that can be examined in considerable detail in an experimental environment that does not cause disruption in current plans and workforce policies. This experimentation, based on sound scientific principles within a controlled environment, falls within a technique known as agent-based modeling and simulation.

As we first introduced in the 13 September blog entry, “The Importance of Modeling – SENDSim, Part 1,” a major component of the SENDS Pilot Project is a modeling and simulation task that helps us better understand how people and information technology interact and the interdependencies that arise with the convergence of these two sources of vulnerability. We call the product output of this task SENDSim.

We are writing today about the technical nature of this task. As we get further along in the work, we will be able to describe the individual and organizational social nature of this critical component of SENDS.

In brief, SENDSim is being designed to help the cybersecurity expert face cyberspace security challenges by providing a platform for understanding threats, evaluating solutions, and communicating the benefits of a principled security plan to non-technical decision makers. Users can specify network designs, assumptions, and policy parameters. SENDSim then creates a simulated network, a simulated workforce using that network, and a simulated malware threat. The illustration of an early SENDSim screenshot below helps to visualize the components and interactions of SENDSim agent-actors (click to enlarge).

Incorporating modeling techniques from epidemiology and behavioral economics, SENDSim captures both the behaviors of the malware and the behaviors of the network users. These behaviors (based on intents and attitudes modeled on subject matter expert insights) include users’ appreciation of cyber threats, their level of technical sophistication, and their actions, such as choosing passwords, enabling and disabling features, and telling co-workers about threats and solutions.

Detailed visualizations demonstrate how malware infiltrates a network, spreads, and inflicts damage. In addition to standard cybersecurity metrics focused on technology, SENDSim adds metrics related to the workforce, such as productivity, as well as metrics related to cost.

By modeling both the behavior of malware and the behavior of non-malicious users, cybersecurity operators and experts will have a broader view of how their designs and policies impact both their security goals and the larger productivity and efficacy goals of the organization.

Cybersecurity experts are often charged with assessing the vulnerabilities of a network and recommending a course of action. SENDSim can also assist these experts make cyber threats more tangible for decision makers, helping them visualize possible threat scenarios and quantify those scenarios in terms of financial cost as well as in terms of information assurance and military readiness. Decision makers can then draw more informed conclusions that take the broader interests of the organization into account.

We are excited at the prospect SENDSim and potential follow-on modeling and simulation efforts might provide to both the near-term requirements of government and other users, as well as the likely ability to improve design over the lifespan of networks. The design functions required to implement any outputs from our Science of Cyberspace work will benefit greatly from these kinds of modeling and simulation efforts, helping us to test hypotheses and evidence gathered and generated in this endeavor.

Stay tuned for more about SENDSim and the modeling and simulation support to SENDS!

Design and the Science of Cyberspace

By Carl Hunt

During the earlier part of this week, I had the distinct pleasure of attending the Highlands Forum (HF) meeting at Newport, RI. This was HF 42, which followers of the Hitchhiker’s Guide to the Galaxy know this should have been a most illuminating session for the organizers and sponsors of this group (if you don’t, you have only to look it up on Wikipedia to be illuminated yourself!). Rather than repeat the background on the HF and its associate organization, the Highlands Group, you can find out more at: http://highlandsgroup.net/about.php?ID=1, and I will get on with telling you about Design and the Science of Cyberspace.

The HF brings together speakers of diverse disciplines to transport ideas from the edge (and there are many edges!) to the core (DoD’s central repository of current problems, doctrines and operational pursuits: my definition, by the way). The current theme for the HF’s discussions is about shaping how “beliefs, behaviors and outcomes takes place in a massively interconnected world” (from the Agenda for HF42). If you’ve seen a SENDS briefing or read the SENDS Science of Cyberspace White Paper (available in the SENDS Substrate), you have come across that term, “massively interconnected world” more than a few times. This is a marvelous and central challenge for our nation in the age of cyberspace.

As we learned in HF42 this week, however, it’s probably best not to rely solely on the principles of pure emergence (see the 9 and 10 September discussion on emergence and exchange) to spit out “solutions” to these challenges. Rather, we should consider the contributions that principles of Design can make to a sustained progress within this new world. HF42 colleague Bruce Mau (http://www.brucemaudesign.com/) continuously challenged the participants throughout the 3-day meeting to think about how we can apply design principles to security as a “national experience.”

According to Bruce, the current problems we face in conflict and international relationships have changed what it is and what it means to have an American “national experience.” To recapture (or perhaps recreate?) an American way of life will require thoughtful design that accommodates the massive interconnectivity the HF and others are studying and assessing. The creation or adaptation of a Science of Cyberspace also requires this level of thinking in terms of Design.

In fact, we should be thinking about creating the conditions for Design and Emergence to coevolve, if you will, so that we aren’t completely surprised at the outcomes. Designs are probably akin to military planning in that no plan ever survives first contact with the enemy. But the process of planning, and designing I’m sure, brings about context for the coevolutionary (ecological, if you will) consideration of problems and solutions in ways that force us to think through relationships and interdependencies that better prepare us for the unknown future.

After this week, I’m quite certain we need to think through the design of the Science of Cyberspace and SENDS, and I will be scrambling to address it! It is my sincere hope that Bruce and others in HF42 will join this pursuit of design within the Science of Cyberspace and help us get it right, not only for America but for everyone. More on Design to come…

Cyberspace's impact on our perception of time

by Craig Harm
Cyberspace has and is changing the way we look at and deal with time. I would like to open with a short overview of how cyberspace has developed to produce an environment that is making us rethink our perspectives on time. Then, as food for discussion, I am proposing a couple of specific areas where our perspective of time is changing due to cyberspace. My intent is not to compose a comprehensive research piece on time and cyberspace but instead I hope my thoughts stimulate discussion.
From the first humans counting on their fingers, we have looked for better and faster ways to help us with increasingly complex mathematics. While the early abacus and the slide rule were crucial developments in man’s calculating tools, they were still analog devices. The advent of mechanical adding machines in the 17^th Century and their offshoot, the cash register in the 19^th Century were some of the first mechanical systems to help us with faster more complex calculators. Then in 1944, Howard Aiken at Harvard University built the first electromechanical machine. While it was very slow and huge, it could be called the first computer as its function could be altered by its programming.
These first steps in development occurred over centuries. In only the half century that has followed; gears and motors were replaced with relays, the relays were replaced by electronic switches and the switches replaced with circuits. While the history may be of interest to some, it is important to note that the interest and motivation for the development of these systems all seem to have been driven by the same desire to do more and more complex problem solving faster. The rate of change cyberspace undergoes is continuing to increase at exponential rates: it was just 15 years ago that e-mail came into being—today, it is a major workflow tool.
For centuries human communications networks remained unchanged and stable. There were two ways to transfer information, by land or by sea. The key element in the time to transfer information was the geographic distance between the two parties. With the advent of the telegraph and the telephone, distance was no longer a factor; rather, volume and information retention become the more dominate factors, often restricted by human memory and note-taking. Now, the interconnection of increasingly fast high-volume computation capabilities which created cyberspace bridges all those gaps. Now, geographic location and distance have become negligible factors; the technical inhibitions against transfer and storage of information have also been largely overcome. Broadband is only now empowering the majority of society’s connectivity, and we are just the first few years into the social networking phenomena.
The former ways of knowledge accumulation and transfer were tried and true and had been in use for so long humans could not imagine alternate methods until cyberspace was discovered. Now the 21^st century is well underway and many of us have become so accustomed to the rates of change of new communications methods nothing seems to surprise us any longer. Nonetheless, human behavior introduces constant surprises. These changes and surprises, and the profound impacts on human culture and emerging societies, both physical and virtual, demand in-depth and systematic formulation of cyberspace understanding and knowledge. Connected collectivity, operating at the speed of cyberspace still presents challenges to perception and understanding, however.
So as we consider our perceptions of time and how cyberspace is changing that perception consider how business is conducted in today’s cyberspace-enabled environment and how our expectations and management of time are changing as well. Enabled through a connected network of computers we conduct almost any transaction instantaneously. Multi-task capable computers enable applications to run simultaneously. Mathematical problems too complex for the human brain to process are done in the blink-of-an-eye. Functions and capabilities are developing so fast we often are found in a dilemma to buy a system now or wait for the next generation system to be released. Communications have become so easy and so pervasive we are suffering from overload.
What has all this done to us?

1. Our ability to send and receive communications has driven us to an expectation of immediacy. There was a lag-time expectation when letters and “snail-mail” communications were the norm, we would measure the time with a calendar in days or weeks. With omnipresent e-mail in today’s society that lag-time as dwindled to something we now measure with a watch or stop-watch in minutes or hours. Even the famous Miss Manners now says you should always respond to e-mail or find a suitable method to acknowledge receipt within one business day. This almost instantaneous response culture is forcing us into habits that make us feel disposed to focus more on e-mail response time than content.
2. If we want something now, we can get it now. Well maybe not physically, but intellectually. The connected- connectivity of cyberspace seems to make omnipotence just a search and a click away. And each search should only have to last a few minutes at most. We expect to find what we are looking for at first glance, and if we can’t we move on. We see this expectation manifested in advertising. The Netflix family “The Right-Nows” who expect and do everything “right-now. The Bing TV commercial about search overload is a satirical example of how the immediacy of information availability is changing how and when we think of things.
3. The responsiveness, agility, and volume Cyberspace provides are driving us culturally to shorter and shorter attention spans. Think of how we read and review our e-mail. With the volume, diversity and frequency of e-mail traffic we no longer have time to compose or read lengthy, explanatory notes. If something does not immediately capture our attention, we tend to disregard it and move on. We simply have to move on or we cannot get through the information. With the advancement of computer volume and speed, the diversity of topics and the ease of access to our interests we can easily become distracted away from those things that need extended, devoted time. The immediacy of news and information about any subject imaginable is driving us to move from one topic, issue or event to another with very little dwell time. As they say, old news gets boring and our propensity to look for new topics causes us to soon forget ongoing issues. Cable news may have been the first to bring this phenomenon to the forefront, cyberspace exasperates it. YouTube, FaceBook, news feeds and blogs are just a few of the cyberspace environments that experience this phenomenon of short-lived information.
4. Our willingness to wait for new technologies is becoming more and more tolerable. The time between version updates, computing advancements, and technology implementation is continuing to grow shorter and shorter. With the costs of older technology dropping as new technology comes out, there is an inclination to wait, as maybe the existing prices will drop with the release of the new technology. Or the converse is true; the old technology will soon become obsolete so we may as well wait. Think of the rush and push for the release of Windows 7. With warnings of ending support for older Windows versions coming out from Microsoft, the retail industry moving to sell new machines loaded with Windows 7 and our interest in the new capabilities promised many people withheld buying new hardware and software until Windows 7 was released.
5. Cyberspace has added a completely new element into our time management. The activities available within cyberspace, the connectivity cyberspace provides and ease of access are increasingly adding to our daily lives and tasks. Just because it is out there or available does not mean it can fit into the existing priorities of our daily lives. Complaints about the volume and management of e-mail ring from the business world, academics and our personal lives. Compound that with keeping up with news feeds, social networks and web-based entertainment and you have the makings of a true crisis in daily time management.

I am sure there is much more to this topic than what I have expressed in this blog. In fact, the availability of this blog and your interest in reading it is causing changes to your own perceptions of time. You may be thinking of time related questions about this SENDS blog. What is the frequency of postings? How often does it need to be checked? Can I set up a reminder to help me manage my reviews? Are the topics still viable or have they already been overtaken but subsequent items that compete for my interest?
I look forward to your comments and discussions.