Budget puts squeeze on computer security research

Some analysts see no evidence that tight budgets have constrained cybersecurity efforts at the National Institute of Standards and Technology. But others say that the agency's limited budget has undermined other security efforts, including the security product certification program known as the National Information Assurance Partnership (NIAP).

NIAP began as a joint program administered by officials from NIST's Computer Security Division and the National Security Agency's Information Assurance Directorate. As reported in a recent advisory committee's report, budget limitations have forced NIST officials to turn the NIAP program over to NSA. As a result, the program's value has been diminished for federal civilian agencies and the private sector, whose security needs differ from NSA's. "If NIST's funding were increased, what you might see is NIST working with other industry sectors to make protection profiles more relevant for those sectors," said David Wilson, vice president for product management and support at Xacta Corp., which makes security software.

Others familiar with a recent advisory board report on NIST's Computer Security Division agree that budget constraints are limiting the ability of NIST's computer security experts to provide practical security guidelines in many new areas.

"Those things are not happening -- research on incident exercises and how to respond to a cyber incident, sensor deployment, penetration testing, vulnerability management, convergence-related issues, [radio frequency identification] -- all of these are areas for which I know NIST would like to put together guidelines, and I just don't think the funding is there," said Paul Kurtz, executive director of the Cyber Security Industry Alliance, a cybersecurity advocacy group.