DHS SCIENCE AND TECHNOLOGY
Office of University Programs -Protecting Critical Infrastructure
Office of University ProgramsScience and Technology Directorate
November 2, 2017
Topics• Critical Infrastructure Market• 16 Critical Infrastructure Sectors• DHS Organizational Chart• DHS National Critical Infrastructure Security and Resilience R&D
Plan (CISR) • National Protection and Programs Directorate • Office of University Programs• OUP and the Critical Infrastructure Resilience Institute at
University of Illinois at Urbana-Champaign • Upcoming Events
2
3
The critical infrastructure market is expected to increase from $87 billion in 2016 to $131 billion by 2021. • Drivers: smart grids, IT spending, automation, integrated functioning of cloud and CIP, increase
prevalence in cyber-attacks, and more efficient policy regulations and implementations.
An estimated 8.4 billion devices are connected to the internet currently worldwide. • Expected to increase to over 20 billion devices by 2020.• Drivers: fleet management in transportation, security/surveillance applications in government,
inventory and warehouse management applications in retail and industrial asset management in manufacturing
(source: Mordor Intelligence, Gartner, Forrester)
Financial Drivers
• Cyber Security Market was valued at $52.05 billion in 2015. Projected to grow to $114.08 billion by 2024 with a compound annual growth rate (CAGR) of 9.1%.
• The airport, oil and gas, banking, and government segments will exhibit maximum growth during the forecast period. North America, Europe, APAC, and the Middle East (in the same order) will have the highest CAGRs during 2015 to 2024 (10.7%,10.1%, 8.9%, and 7.1%)
• Increases in partnerships between traditional IT cyber security providers and infrastructure control system firms
• Legislation
4Source: Frost & Sullivan July 2016 Global Critical National Infrastructure Cyber Security Market Assessment
Designation of 16 Critical Infrastructure Sectors Sector Specific Agency- DHS
5
Sector Specific Agency- Non-DHS Chemical Sector
Commercial Facilities Sector
Communications Sector
Critical Manufacturing Sector
Dams Sector
Emergency Services Sector
Government Facilities Sector
Defense Industrial Base Sector
Energy Sector
Financial Services Sector
Food and Agriculture Sector
Healthcare and Public Health Sector
Water & Wastewater Systems Sector
Information Technology Sector
Nuclear Reactors, Materials, and Waste Sector
Transportation Systems Sector
6
Since 2013, over 150 research grants have been issued relating to critical infrastructure protection
An estimated 2,500 companies and institutions are conducting research in critical infrastructure resiliency.
DHS National Critical Infrastructure Security and Resilience R&D Plan (CISR)Policy Directive 21, Critical Infrastructure Security and Resilience (PPD-21) and Executive Order 13636, Improving Critical Infrastructure Cybersecurity• The coordinated release of these two policies underscores commitment to
integrating cyber and physical security and strengthening resilience across interrelated systems
• Requires DHS to provide a R&D plan that takes into account the evolving threat landscape, annual metrics, and other relevant information to identify priorities and guide R&D requirements and investments.
• 5 overarching R&D topics:• Develop the foundational understanding of critical infrastructure
systems and systems dynamics; • Develop integrated and scalable risk assessment and management
approaches; • Develop integrated and proactive capabilities, technologies, and
methods to support secure and resilient infrastructure; • Harness the power of data sciences to create unified, integrated
situational awareness and to understand consequences of action; • Build a crosscutting culture of CISR R&D collaboration.
8
DHS Critical Infrastructure Resilience Mission Support
• DHS National Protection and Programs Directorate (NPPD)• Office of Cyber and Infrastructure Analysis (OCIA) – supports
DHS implementation of PPD 21 which calls for integrated analysis critical infrastructure, and Executive Order 13636, identifying critical infrastructure where cyber incidents could have catastrophic impacts to public health and safety, the economy, and national security.
• OCIA Goals• Provide innovative analysis that impacts key decisions affecting the security and
resilience of critical infrastructure.• Establish strong collaborative relationships to ensure OICA’s analysis influences
key decisions.• Products – Hurricane, Storms, Earthquakes, Drought, Flood, Cyber, and Modeling
& Simulation, RRAP• The Office of Cybersecurity and Communications (CS&C) -
responsible for enhancing the security, resiliency, and reliability of the nation's cyber and communications infrastructure.
• safeguard federal government systems by reducing potential vulnerabilities, protecting against cyber intrusions, and anticipating future threats
9
DHS Science and Technology Directorate and University Outreach
Homeland Security Act 2002The Under Secretary for Science and Technology shall have the responsibility for:
• “[establishing] … a coordinated, university-based system to enhance the Nation’s homeland security”
• “supporting United States leadership in science and technology”
• “merit review of research and development projects … and the dissemination of research conducted or sponsored by the Department”
10DHS Science and Technology Directorate | MOBILIZING INNOVATION FOR A SECURE WORLD
Office of University ProgramsThe Office of University Program (OUP) streamlines access to the expertise of the Nation’s colleges and universities to address pressing homeland security needs:
• OUP makes it easy to tap into the intellectual power of America’s universities for homeland security research, development and education.
• DHS Components can access academic expertise to answer research questions, deliver technical solutions, and build a highly specialized workforce.
• OUP Program Managers provide individualized service to DHS Components and assist with finding needed R&D capabilities within OUP’s network of over 200 partner institutions.
• OUP offers established vehicles through which DHS Components and other partners can access the research and expertise found at the S&T Centers of Excellence.
11
COE Topic Alignment to DHS Missions
13
COE TopicsPrevent Terrorism &
Enhance SecuritySecure & Manage
Our BordersEnforce &
Administer Our Immigration Laws
Safeguard & Secure Cyberspace
National Preparedness &
Resilience
Law Enforcement Investigations
Arctic Domain Awareness
Applied Quantitative Analysis
Counterterrorism
Countering Biothreats
Transportation Security and Screening
Maritime Domain Awareness
Border Security, Trade and Immigration
Infrastructure Protection and Resilience
Natural Hazards and Resilience
DHS S&T | OFFICE OF UNIVERSITY PROGRAMS OVERVIEW
Focusing the CIRI Mission
Key Considerations
• Rapid expansion of the use of information and communications technologies (ICT) in all sectors has dramatically increased operational efficiency, reliability, and safety through improved control and situational awareness, while simultaneously creating new vulnerabilities and threat vectors.
• Reliance of all sectors on ICT increases the number, frequency, and type of interactions between cyber and physical systems.
• Humans and their actions or inactions complicate the identification and management of risk for organizations
• Identification and management of risk for organizations
CIRI R&D Themes
• Insurance and Business Case for Resilience• Macro and Micro Industrial Supply Chains• Infrastructure Dependencies and Interdependencies• Next generation communication
14
CIRI Thematic Areas Insurance and Business Case for Resilience
• Find economic ways to spread risk, primarily in cyber realms• Technologies able to assess risk to standards acceptable by insurers• Information sharing frameworks
Macro and Micro Industrial Supply Chains• “micro” means intra-organization, “macro” means inter-organization• Resilience issues in embedded systems• Analysis of resiliency in business and policy context
Infrastructure Dependencies and Interdependencies• “Situational awareness” of system dependencies/interdependencies• Exploration of resilience governance issues• Models of economic/social/physical impact of upsets
Communication• Dependency of critical infrastructures on communication• Mobile, Internet
15
U.S. Department of Homeland Security Commercialization Office: Product Realization Guide
17
DHS S&T Portfolio BasicResearch Innovation and TransitionTechnologyPhase Science TechnologyDevelopment Product Development
Technology Readiness Level(TRL) TRL 1 – TRL3 TRL 4 – TRL6 TRL 7 – TRL9
Manufacturing Readiness Level(MRL) MRL 1 – MRL3 MRL 4 – MRL6 MRL 7 – MRL10
KeyObjectives TRL 1 TRL 2 TRL 3 TRL 4 TRL 5 TRL 6 TRL 7 TRL 8 TRL 9“Back of theenvelope”environment – newapproachResearch hypothesis formulated
Basicelementsof science/technologyhave beenidentified (math/physics/ chemistry/analysis/ algorithm)Components of technology/science have been partiallycharacterizedRigorous analytical studies confirm basic principles
Science known toextent thatmathematicaland/orcomputer models and simulations arepossible.Analytical studies verify predictions, algorithms, proof of principlePreliminary system performance characteristics and
All requiredtechnologycomponents integrated for Proof of Concept.
ORD andCONOPSdeveloped. SecurityAssessment
Execute TTA / TCA asapplicable Program Manager identified. Successful T&E in a simulated
S&T and the end-user / customerdevelop final transition plan; Transition Plan developed. (TRL7
Technology componentsareform, fit, and function compatible with an operationalsystem.
All critical programdocumentationcompleted. Planning underway forthe
Basic scientificprinciplesobservedPhysical laws andassumptions
Analytical studies reported inscientificjournals/conference proceeding/technical reportsPaper studies show that applicationis feasiblePotential system or component application(s) have been identified–proof of principle
measures have been identifiedandestimated.Predictions of elements of technology capability validated by Analytical Studies. Recommended nextsteps.Paper studies indicate that system components ought to work together
Proof of Conceptconducted.IPT briefed on progress of the technology’sdevelopment.
updated.OMB 300 andAcquisition Plan completed (if required).
operational environmentconducted.End user / customer briefedon the results ofT&E.
and 8)Technology successfully demonstrated in anoperational
Technologyproductionaddressed and planned byDHS and the end-user / customer.
integration of the nextgenerationtechnology into the existing program components.
used in newtechnologies/sciencesdefinedHave some concept in mindthat
Performance predictions/uses made of each elementIndividual parts of the technology work (no real attemptat integration)Modeling & Simulation only used to verify physical principles
Experiments carried out with small representativedatasets(realworld)Laboratory research equipment to verify physical principles identified.Laboratory experiments verify feasibility (principle,
The customer briefed ontheProof of Conceptresults. FRDfinalized.
IPT certified readiness for thetransition of theTechnology. Program TransitionManager
Initial SecurityGuidelinesdeveloped. Draft Program AssessmentRating
environment. (TRL 7 and8) Updates made to theORD. Risk Management Plan,Program
Training Plan developedandimplemented. (TRL 8 and9) Operational TestReport
End-user fully demonstratesthetechnology inCONOPS. Lessons Learnedcompleted.
may berealizablePaper studies supportbasic principles (literaturesearch)
Know whatexperimentsyou need todo (researchplan/ approach)Know capabilities and limitations of researchers and research facilities:identifywho/wherework tobe doneQualitative idea of risk areas (cost,schedule,
component, subcomponent test ordemo)Scaling studies have been started (size, environment, component integrations)Description/outline of algorithmsavailable.Algorithms run in laboratoryenvironment
SEMP finalized andupdated.(TRL 4, 5, &6) TEMP completed andupdated.
assisted intransitiondocumentationdevelopment. Technology scan andmarket
Tool (PART) plan exists, if required.National Environmental Policy Act (NEPA) plan /assessment.
Cost Analysis and PMPupdated.Strategic Program Planning conducted.
completed.Limited User Test (LUT) Plan developed.
After Action Reviewcompleted. Sustainment Plan iscompleted.
Formulation of conceptsthatmight be realizable (draft road map) – “If – then”statements
performance, impactsof idea)An apparent theoretical or empirical design solution identifiedIdentify the DHS area the technology/science will support
ScientificfeasibilitydemonstratedWhat is the academicenvironment?Are there research centers interested in this area of science/ technology?What technologies exist elsewhere within DHS S&Tthat
(TRL 4, 5, &6)ConfigurationManagement Planexists.
survey.(ongoing)Analysis of Alternatives developed and updated. (TRL5
InteroperabilityAssessment. Operations andMaintenanceManual completed /updated. Security Manualdeveloped.
Physical andfunctionalinterfaces clearlydefined
Has a Feasibility StudyWhitePaper beendeveloped?Has a potential DHSmission
Have potential homelandsecurity end-users beenidentified?Customer expresses interest in application (market survey?)Requirement tracking system defined tomanage
may integratewith thisprogram or technology?Cross-technology uses assessed and identified (multi-use enhancementconsidered)Customer/user identified and participates in requirements definition/generation.
PMP updated. (TRL 4, 5, and6)Risk ManagementPlan updated. (TRL 4, 5, and6)
& 6)Entry Criteria Checklist completed and delivered tothe
Interoperabilitydemonstrated.MDs reviewed toassure compliance.
space beenidentified?How will the programbe funded?Know who cares about technology/science, e.g., sponsor, funding source (users/participants: researchers, national/international, private, government, academia, military)
requirements creepInvestment Strategy Sheet (estimated funding requirements for 5year plan)Have rough idea of how to market technology (Who is interested, outreach, marketsurvey)Develop a TechnologyRoadmap.
Rudimentary best value analysis performed,notincludingcost factors.Customer identifies transition window(s) of opportunityMetricsestablishedRiskareasidentifiedRiskmitigationstrategies identifiedCurrent manufacturing/use/ application concepts assessedProducibility needs for key breadboard components identifiedHas a Technology Maturity Assessment been conducted?(Analysis of present stateof theart shows that technologyfillsaneed)Develop Quality Control Plan to includestandards
Program CostAnalysisupdated. (TRL 4, 5, and6) Quality Assurance Planexists.Program TransitionManager engaged in transitionplanning.
TM.PDD created, approved,and signed. (TRL 5 &6)Director approvedthe transition.
MRL6Capability to producesystem prototype in product relevant environment.Production cost drivers andgoals analyzed andset
MRL7Production pilotbeginsProducibility of system in production representative environment
MRL8Manufacturing pilotcomplete, ready for low-rateproduction
MRL9/10Manufacturing processes established and deliverquality productsMRL 10 – System is at full production rate. Products meet all engineering, performance, quality and reliability requirements.
MRL4Materials, machines andtooling have been demonstrated ina
MRL5Manufacturing cost/goals identified. Potentialmaterials
Specific to CommercializationFinalize ManufacturingPlan.Finalizeengineering documentation. Update MarketingPlan.Develop and implement a test plan for qualitycontrol.
Specific to CommercializationIP Protection andLicensing. Prepare sales releasepackage.Verify and update quality control requirements.
Specific to CommercializationFinalize qualityplan. Finalize marketingplan.Finalize manufacturingand assemblyroutines.
Know who will perform research and where it will bedone
confor-mance, reliability testing,etc.Develop Marketing Plan to include market size and research.
laboratoryenvironment Producibilityassessments
sourcesidentified. Capability toproduce
initiated prototype components inproductMRL1Basic manufacturingimplications identified
MRL2Manufacturing conceptsidentified
relevantenvironmentMRL3Manufacturing proof of concept developed Producibility for key breadboard components identified
KeyDeliverables FeasibilityStudy (WhitePaper)Initial scientific observationsreported in journals/conferenceproceedings/technicalreports
Program Cost AnalysisPaper study showing that application is feasibleModeling & Simulation Report only used to verify physical principles
TechnologyMaturity AssessmentProgram CostAnalysis (updated)
Proof of ConceptReport.FunctionalRequirements Document. SEMP (TRL 4, 5, and6)
ORD andCONOPS.SecurityAssessment (updated). Program DefinitionDocument
Germane to both Acquisition and CommercializationTechnology TransitionAgreement (TTA), orTechnology
Germane to both Acquisition and Commercialization Transition Plan(draft). ORD / FRD Documentation
Germane to both Acquisition andCommercialization Limited User Test (LUT)Plan. Deployment orTransition
Germane to both Acquisition and Commercialization CustomerFeedback. Lessons-learned.
Literature searchreportRoad Map(draft)Written report of findingsand recommendations(preliminary
Market survey identifying potentialcustomer interestAnalytical studies reported in scientific journals/conference proceeding/technicalreports
Functional Requirements(draft)Proof of Concept Plan (Predictions of elements of technology capability validatedby
TEMP (TRL 4, 5, and6) Quality AssurancePlan.ConfigurationPlan Management.
(PDD). OMB 300 Capital AssetPlan. AcquisitionPlan. Entry CriteriaChecklist.
Commercialization Agreement(TCA)as applicable Initial SecurityGuidelines. Draft Program AssessmentRating
Risk ManagementPlanProgram CostAnalysisPMP(updated). Strategic ProgramPlanning
Plan. TrainingPlan. Operational TestReport. CustomerAcceptance
After-actionReview.Sustainment Plan is completed(a. Spiral Development Assessment, b. Preplanned Product Improvement,c.
productplan). Feasibility Reviewmeeting.
Qualitative idea of risk areas (cost,schedule, performance, impacts of idea)5 year Investment Strategy/Funding requirements documented Preliminary product plans (approved
Analytical Studies. Recommended nextsteps.)Program ManagementPlan (PMP)draft
PMP (updated). (TRL 4, 5, & 6)Risk Management Plan (updated). (TRL 4, 5, and6) Program CostAnalysis
Analysis of Alternatives.(TRL5 and6)Initial producibilityof componenttechnology
Tool (PART) plan, if required.National Environmental PolicyAct (NEPA) initial assessment, if required.
Documentation (if conducted). Operations/MaintenanceManual SecurityManual. FinalizedInteroperability
Document.Initial Systems-levelMetrics Assessment.
Emerging Threat(s) Assessment, d. Technology Refresh / Insertion, e. Quality Assurance / Metrics Report, f. Risk ManagementReassessment.).
and ongoing).New Technology roadmaps (approved for further development and implementation). Updated market assessmentand
End-user/CustomerStatusReviewAnalytical study/testreports. Detailed product and marketing
(updated). (TRL 4, 5, and6)End-user / CustomerStatus Review.
completedInitial ManufacturingPlan developed.
InteroperabilityAssessment. Assurance Report. (TRL 7 and8)Specific to CommercializationEngineering documentation package release andmanufacturing plan. Updated marketingplan. Test plan for qualitycontrol.Development PhaseReview meeting.
Specific to CommercializationIP Protection andLicensing.Manufacturing and sales plan release package is to bedistributed. Pilot Phase Reviewmeeting.
Specific to CommercializationDemonstrate that a defect-free product can be manufactured on scheduleand at a cost consistent with the target pricepoints.
Specific to CommercializationFinalized product plan sales release package is to bedistributed.Sales Release PhaseReview mtng.Execution of acceptance, shipment, and after-sales supportof the newproduct.
technologyscan.Demonstrate ability to manufacture prototype components
plan. Quality controlplan. Optimization Reviewmeeting. Manufacturing conceptsdefined
ManagementReview Internal TechnicalReview Internal TechnicalReview Internal TechnicalReview Capstone IPT andTechnology Capstone IPT andTOG Capstone IPT and TOG reviews Capstone IPT and TOG reviews Capstone IPT andTOG S&T Director ofTransitionCorporate review meeting of the Corporate review meetingto TechnologyMaturity Oversight Group (TOG) reviews reviews(ongoing). Development Phasereview Corporate review of the reviews Capstone IPT and TOG reviewspreliminary productplan. approve preliminary productplan Assessment (ongoing). Analysis of theengineering meeting. manufacturing releasepackage. Analysis and review of the Corporate review of the finalized Feasibility Reviewmeeting. and technologyroadmap Optimization Review meeting. Analysis of the engineeringand and manufacturingplan. Comprehensive analysis of the Pilot Phase reviewmeeting. manufacturingplan. product plan and salesrelease Results and follow up actions. Results and follow up actions Results and follow up actions. manufacturingplan. Results and follow up actions. engineering and manufacturingplan. Results and follow up actions. Results and follow up actions. package. ManufacturingReadiness MRA MRA Results and follow up actions. MRA Results and follow up actions. MRA MRA Sales Release Phasemeeting.Assessment(MRA) TRA TRA MRA TRA MRA TRA TRA MRATechnologyReadiness TRA TRA TRAAssessment(TRA)
• 20‐30%?• 20‐30%?
WorkforceTraditional
and Training
Stand Alone
Knowledge Products
Hardware, software
Linked Knowledge
Product
What is the Appropriate Mix of ‘ProjectTypes’?
The selection of ‘the types of projects’ is critical to establishing expectations for project outputs, potential of COE contributions to the field and articulating the development pathways
• 15‐25%? • 15‐30%?
What are the technical development steps for each type of project?
What are the intellectual property considerations for each grouping in order to realize the end goal?
18
Upcoming Events • November 9th – DHS Critical Infrastructure Facebook Tech Talk • November 16 – CIRI Mobile Communications Technical
Discussion • December 12-13th – Artificial Intelligence & Quantum Computing
Workshop• January 30-31st – DHS/CIRI Biannual Review
19