A disconnect between the primary research sectors and a lack of appropriate funding in each is leading to decreased technological progress, exposing a huge gap in security that is happily being exploited by cybercriminals.
That was the consensus from a panel at Wednesday's RSA Conference representing the private, academic and government sectors, discussing the challenges associated with research. Panelists included William Cheswick, technical staff member at AT&T Labs; Deborah Frincke, chief scientist, cybersecurity, Pacific Northwest Laboratory; Chenxi Wang, principal analyst, Forrester Research; Timothy Brown, SVP and distinguished engineer, CA Security Management; and Carrie Gates, research staff member, CA Labs.
The panel, entitled "The role of research in industry and government," began by noting that each sector has its own unique role to play in ongoing research. The private sector equals short-term, revenue generating projects. The academic sector contributes publishable, academia-oriented cases, while the government sector produces longer-term, socially beneficial programs.
The focus on research has changed over the years, said panel members, introducing a number of challenges, such as an ongoing decrease in funding of research labs across all sectors (lab investments are diminishing and labs are disappearing); the need for short-term and long-term research is increasing and the sectors can't keep up with the need; research without a near-term monetary return does not get the attention it often deserves, resulting in no revenue within the first few years; and research projects of 10-15 years require investment and resource stamina that is often too much for any sector to cope with, therefore research is left untouched, incomplete or non-actionable.
In order for research to be effective, collaboration must improve between the government, university, and industry sectors, panelists agreed.
A recent Forrester survey showed that companies typically spend 10-15 percent of their revenue on three-year research and development, according to Forrester's Wang. Eliminate the development aspect and increase the outlook to five years and companies, on average, invest no more than two percent of their revenue on pure research activities, she said.
AT&T Labs' Cheswick added that “big companies want their new idea to provide a return of $100 million within the first year of delivery before they will consider investing in it.”
Leaving this research gap open allows cybercriminals to connect the dots on our behalf, one panelist added. calling for each sector to find ways to work together to connect the research dots, ensuring that proper investments are made, keeping the labs alive, the research available and the cybercriminals away from our systems and data.
CA Security Management's Brown added, “We can't afford to be shy here. We need to provide testimony to Congress to seek proper funding for cybersecurity.”
An initial step in overcoming these challenges is to promote collaboration among the research sectors. Kim Jones, information risk manager for General Dynamics and an RSA Conference delegate, addressed the panel during a follow-up Q&A session. “I understand the value of research and recognize that security research as a whole is completely different from product development research. We can't just focus our research on building products. How can I get involved to help?”
The panel suggested attendance and promotion of collaborative academia/industry forums, as well as bringing research lab representatives into CSO/CISO forums.
In a follow-up interview with Brown, he elaborated on his theme. "Without effective research we will continue to fall behind the cybercriminals," he said. "Being proactive and moving ahead is necessary for our critical infrastructure, with a combination of government, university, and industry research."
The problem, he said, is that today the segments do not work well together and do not share enough information. "We need to move to a more collaborative environment that will work to solve the big important problems, as well as tackle the short-term tactical issues."
