1. Cybersecurity for future Presidents An undergraduate course for non-specialists

2. Some undergrads at your institution today may rise to positions of responsibility 1964 2003

3. In those positions, they are likely to confront issues of system/data/information security and privacy

4. Few students become presidents immediately following graduation

5. What can we teach students now to help them deal with decisions they will be asked to make in 20, 30, or 40 years? How can we help them ask the right questions of their advisors?

6. Or, what do we know about cybersecurity now that will still be helpful in 20 – 40 years? ?

7. 12 Potential Questions to Address • What cybersecurity/privacy issues will confront future Presidents? • What is computing about? • What is cybersecurity about? • How do cyberattacks work? • What is cryptography and how can it help? • How can individuals be associated with actions in a computer? • How can intellectual property be protected in a computer? • What notable events (attacks/failures) have happened to date? • What is cyberwarfare? • What public policies control cyberspace? • Could we build stronger systems (i.e. reduce vulnerability)? • What issues will confront future Presidents? (reprise)

8. Not many students will be POTUS* • More will become corporate officers • Nearly all will become voters A course like this one should not only benefit the future POTUS but help inform the citizenry It can also benefit us by helping us identify what we think has lasting value and where there are gaps to be filled *President Of the United States

9. Credit The fundamental idea for the course is stolen from Prof. Richard A. Mueller, who for many years has taught “Physics for Future Presidents” to UC Berkeley undergraduates

10. Discussion, please!

11. What cybersecurity/privacy issues may confront a future President? • Public vs. private controls • Regulation, standards, liability • Agency vs. agency (which agency to put in charge of what) • Issues for Corporations • Issues for individuals <back>

12. What is computing about? • von Neumann machines and others • Logic • What can be automated? • What can't? • Information theory (basics) • Information systems and networks • Control systems and sensors <back>

13. What is cybersecurity about? What are we trying to protect? • digital assets (cash/securities) • intellectual property (commercial) • private information • system control What properties do we want to assure? • reliability, safety, security --> dependability Against what sorts of threats? • accidents • malicious exploitation of accidental faults • malicious insertion of engineered flaws Economic factors Game theory background <back>

14. How do cyberattacks work? • phishing, social engineering • Denial of service attacks, flooding • Attacking a system through its inputs • Attacking a system through the supply chain • Side channel attacks • Network / system configuration issues <back>

15. What is cryptography and how can it help? • Concept of difficulty of a computation • Symmetric / asymmetric crypto • Key management • Cryptographic protocols • Encrypted computing (secure multiparty computation, private information retrieval) • What can cryptography not do? • Quantum computing potential and effects <back>

16. How can individuals be associated with actions in a computer? • Authentication, anonymity, accountability, forensics • Privacy and surveillance • Limits on accountability <back>

17. How can intellectual property be protected in a computer? • Watermarking, fingerprinting, sandboxing, etc. • What limits what can be done? <back>

18. What notable events have happened? • Internet worm and details • Black-holing of Internet traffic • Accidental targeting of Chinese Embassy in Belgrade, Yugoslavia • Botnets and the Spam economy • Automotive control systems • Stuxnet <back>

19. What is cyberwarfare? • Information warfare background: breaking ciphers (Enigma, Venona, etc.) • Estonia and Georgia incidents • Computer network exploitation / computer network attack • Can cyberwarfare be automated? <back>

20. What public policies control cyberspace? • Public sector vs private sector • Health information controls • Financial information controls • Control systems and liability • Espionage and warfare • Fair information practices • International aspects <back>

21. Could we build more defensible systems? • Known techniques • Where they have been used -- and where they haven't • Possible future approaches • Controlling future technology <back>

22. What cybersecurity issues may confront a future President (reprise)? • Revisit the issues with deeper understanding <back>