Agile Applied Research for Cybersecurity: Creating Authoritative, Actionable Knowledge When Speed Matters

Securing information systems from attack and compromise is a problem of massive scope and global scale. Traditional, long-term research provides a deep understanding of the foundations for protecting systems, networks, and infrastructures. But sponsors often need applied research that will create results for immediate application to unforeseen cybersecurity events. The Agile Research process is a new approach to provide this type of rapid, authoritative, applied research. It is designed to be fast, transparent, and iterative, with each iteration producing results that can be applied quickly. The idea is to engage subject-matter experts fast enough to make a difference. Agile Research requires new levels of collaboration and performance, plus adaptive organizational structures that support this new way of working. In addition to its application in Government, Agile Research is being employed in academic settings, and is influencing how research requirements and researchers are identified and matched, and research traineeship. 1. The Need for Agile Research Traditional, long-term research often involves extensive requirements definitions, comprehensive proposals, competitive awards, distributed organizational structures, complex funding protocols, and long-term performance that can extend for years or even decades [1]. These processes are embedded in the national research and development infrastructure, as embodied, for example, in Defense Advanced Research Projects Agency (DARPA), National Science Foundation (NSF), National Institutes of Health (NIH), Department of Energy (DOE), and other Government organizations. When the scope and scale of research requirements are large, as, for example, with autonomous vehicles or alternative energy, these traditional processes and their management and review procedures are essential to maintaining control across collaborating organizations and reducing risks of overruns and nonperformance. As such, they serve a vital role in conducting large-scale, long-term research projects to achieve national goals. These broad national research goals will always be with us. But events occur in cybersecurity areas that require fast and decisive responses in order to protect national well-being and even survival. These responses would benefit from rapid and authoritative analysis by the best minds and organizations. The traditional research infrastructure is ill-suited for this level of fast engagement and immediate application, leaving a pressing need for institutional innovations in the research infrastructure. An Agile Research process is being developed and implemented to address the need for fast and effective exploratory applied research in situations where speed is an overarching requirement. When attempts have been made to apply traditional methods in these situations, the research results, no matter how comprehensive and valuable, are often too late to be of use in the current cybersecurity event, and wind up as shelfware. Wells and Smyth [2] presented an agile approach to developing research methodology, arguing that qualitative research is emergent (which it is), so instead of thinking about the research methods a priori, the re5958 Proceedings of the 50th Hawaii International Conference on System Sciences | 2017 URI: http://hdl.handle.net/10125/41883 ISBN: 978-0-9981331-0-2