Enabling Distributed Security in Cyberspace: Building a Healthy and Resilient Cyber Ecosystem with Automated Collective Action

This study was prepared under the direction of Philip Reitinger, Deputy Under Secretary for the National Protection and Programs Directorate (NPPD), U.S. Department of Homeland Security, with support from the NPPD Cyber Strategy Staff, the federally funded Homeland Security Systems Engineering and Development Institute (HS SEDI), and the NPPD Office of Cybersecurity and Communications (CS&C). In 2010, NPPD sponsored a government workshop to discuss a draft of this paper. Recommendations from that workshop have been incorporated.This study explores a future – a "healthy cyber ecosystem" - where cyber devices collaborate in near-real time in their own defense. In this future, cyber devices have innate capabilities that enable them to work together to anticipate and prevent cyber attacks, limit the spread of attacks across participating devices, minimize the consequences of attacks, and recover to a trusted state.This study presents three building blocks as foundational for a healthy cyber ecosystem: automation, interoperability, and authentication. The paper then considers how these building blocks contribute to ecosystem maturity and explores incentives for creating such a system. It concludes with thoughts on the way ahead.The envisioned end-state is focused specifically on capabilities that can be achieved in the near- and mid-term by utilizing standards-based software and information to strengthen self-defense through automated collective action. This paper is meant to provoke discussion and further exploration of the topic.