An Integrated Framework for Innovation Management in Cyber Security and Privacy

Abstract

This paper is concerned with increasing the impact of publicly funded research and development (R&D) in cyber security and privacy. In the context of a high level of threat, there is a pressing need for firms and institutions to implement innovative and robust cyber security and privacy technologies. This particular challenge requires a systematic coordinated approach across both the public and private sectors. The innovation ecosystem involves complex interactions between key actors such as policy makers, incumbent service providers, and new innovators, each with their own view of how to increase the impact of R&D in cyber security and privacy. Drawing on R&D literature and roadmapping theory, this paper presents a framework and research tool for establishing an integrated view of innovation management in cyber security and privacy.

Appendix

Increasing the impact of publicly funded R&D in the United States – Desk-based roadmapping
Source	Roadmap label		Documented evidence
A roadmap for cybersecurity research [34]	1.1	Stakeholder collaboration	Public-private collaboration among government, industry, and academia, + extraordinary economic, social, and technological forcing functions
	1.2	Metrics and benefits (large scale systems)	Metrics need to be experimentally evaluated and benefits to large scale systems clearly demonstrated
	1.3	Proven demonstrations	Proven demonstrations of effectiveness are required, this would help roll-out adoption in practice
	1.4	Preparation for test evaluation	Design mechanisms, policies, and plans for test evaluation that can be incrementally deployed
	1.5	New ways of managing IPR (Intellectual Property Rights)	Innovative approaches to licensing and sharing intellectual properties for global scale technologies
	1.6	Committed to system trustworthiness	Overarching commitment to system trustworthiness, going beyond past approaches
	1.7	Monitoring and accountability	Recognition of the pervasive needs for monitoring and accountability
	1.8	Critical areas for technology application	Understanding critical areas suitable for technology application
Cross sector roadmap for cybersecurity of control systems [27]	2.1	Bridging new and legacy systems	Encourage R&D into tying legacy systems into upcoming security solutions
Homeland Security – cybersecurity R&D priorities [35]	3.1	Address critical weaknesses	Driving security improvements to address critical weaknesses
	3.2	Solutions to emerging threats	Discovering new solutions for emerging cyber security threats
	3.3	New, tested technologies	Delivering new, tested technologies to defend against cyber security threats
Trustworthy cyberspace: Strategic Plan for the Federal Cybersecurity R&D Program [36]	4.1	Early stage transition plan	Early stage transition plan in place, that includes commercialization pathways, tech transfer coordination, proactive program management, and resources to reward success in transitioning
	4.2	Shifting risk to the private sector	Private sector is willing to take on significant risk-taking and shepherd research through the commercialization process
	4.3	Create cross-agency forums	Participation in cross-agency security entrepreneur forums, PI meetings, laboratory expos, and defense venture catalyst initiative
	4.4	Leverage networked environments for test and evaluation	Cross-agency activities designed to leverage available operational and next generation networked environments to support experimental deployment, test and evaluation in public and private environments
	4.5	Develop partnerships for mature technologies	Cross-agency activities designed to develop partnerships for mature technologies, through open system integrator forums (VCs, SIs, government), and small business innovative research conferences
	4.6	Rewards for program managers	Government funded R&D to build-in rewards for government program managers and principal investigators for commercial success
Cybersecurity game-change R&D recommendations [37]	5.1	Incubators for radical R&D	Support game-changing R&D using incubators and Federal start-up funding
	5.2	Seed funding for industry led R&D	Support industry-based research consortia to lead and direct focused R&D using seed funding
	5.3	University and industry partnering	Support universities to create industrial partner programs designed to stimulate pre-competitive cooperation among industrial partners
	5.4	Quality talent in public sector roles	Recruit experienced high quality talent into government program manager roles, supporting technology transfer
Cyberspace policy review: assuring a trusted and resilient information and communications infrastructure [38]	6.1	Rapid adoption of R&T (Research and Technology)	Federal government to work with industry to develop migration paths and incentives for rapid adoption of research and technology development, including collaboration between academic and industrial laboratories
	6.2	Define goals for standards bodies	Federal government, in collaboration with private sector and other stakeholders, should use the infrastructure objectives and R&D framework to help define goals for national and international standards bodies
Roadmap to achieve energy delivery systems cybersecurity [39]	7.1	Industry forum for commercialization	Develop a matchmaking forum to connect researchers, vendors, and asset owners to accelerate research from concept to commercialization
	7.2	Industry need and evidence based investment	Develop mechanisms for utility and vendor engagement for pilot research studies to address the business case up front. Create a forum for industry to detail and request R&D topics
	7.3	Focus funding on multi-disciplinary projects	Require diverse (academic, lab, industry) participation to receive funding
	7.4	Data protection for vulnerability data	Support legislation that protects entities who disclose vulnerabilities in good faith to the appropriate parties
Federal R&D strategic plan [40]	8.1	Departments report R&D requirements	Required to provide Congress with a strategic plan based on an assessment of cyber security risk to guide the overall direction of Federal cyber security and information assurance R&D for IT and networking systems
	8.2	Departments create scientific foundation	Through existing programs and activities, support research that will lead to the development of a scientific foundation for the field of cyber security, including research that increases understanding of the underlying principles of securing complex networked systems, enables repeatable experimentation, and creates quantifiable security metrics