A Scientific Research and Development Approach To Cyber Security December 2008 Submitted to The Department of Energy

The Department of Energy has the responsibility to address the energy, environmental, and nuclear security challenges that face our nation. In support of this mission, it operates national laboratories and scientific user facilities, performs basic and applied research and engineering, and works to assure reliable energy delivery and to maintain our nuclear deterrence capabilities. Despite ubiquitous dependence on electronic information and on networked computing infrastructure, cyber security practice and policy is largely heuristic, reactive, and increasingly cumbersome, struggling to keep pace with rapidly evolving threats. Advancing beyond this reactive posture will require transformation in information system architecture and new capabilities that do not merely solve today's security challenges!they must render them obsolete. The need is critical not only to the Department of Energy but also to other federal agencies and to the private sector. The Department of Energy is uniquely poised to undertake this work, complementing efforts at other agencies and industry.