syssec_red_book

25. The Dutch National Cyber Security Research Agendabotnet tracking, analysis of criminal infrastructures, and classificationand clustering of malware). Likewise, we need reliable methods forestimating the number of infected machines and the effectiveness ofcounter-measures. At the same time, we need arrangements to shapethe socio-economic forces that fuel or mitigate the spread and impactof malware. From a historical perspective, we should study trends inmalware—as doing so prepares us for new threats in time. Unless theseissues are researched jointly, only partial solutions of limited value willbe available.While originating in criminal behavior, the magnitude and impact ofthe malware threat are also influenced by the decisions and behaviorof legitimate market players, such as Internet Service Providers (ISPs),software vendors, e-commerce companies, hardware manufacturers, registrarsand, last but not least, end users. Here, critical questions focuson economic incentives for the variety of market players. These can beshaped by self-regulation, state regulation and liability assignment.3. Attack detection, attack prevention, and monitoringMalicious code and human attackers use ICT technology to launch attacks.The attacks include large-scale denial-of-service attacks, epidemic virusdistribution, and stealthy attacks on high-value targets. Sometimes theattack is stealthy or even dormant, as in the case of backdoors, while inother cases, the attacks are very noisy. Monitoring systems and networkshelps to detect and prevent the attacks as early as possible.Technological research challenges include binary hardening, networkmonitors, IDS and IPS systems, and attack analysis. For instance, todetect and prevent attacks, we need techniques and tools to spot andremove vulnerabilities from software, and monitoring systems to raisean alarm when a system behaves in an anomalous manner. Likewise,compliance monitoring is important for spotting vulnerabilities (in systemsand organizations) as early as possible. From an organizational andmanagement perspective, we need research into policies and protocolsfor monitoring, auditing, etc. From a legal perspective, we need clearrules for what is and what is not permitted in monitoring (and by whom),as well as ways to enforce these rules.4. Forensics and incident managementForensics and incident management are related, but different activitiesthat follow in the aftermath of an attack. Incident management consists ofrecovery (e.g., salvaging as much of the compromised system as possible),but also restoring systems and state, and becoming operational againat minimal cost. Part of the non-technical side of incident management152