syssec_red_book

AMethodologiesIn this appendix we outline the methodology used to create this Red Book. Welist the people we mobilized, the way we organized them, and the interactionswe had. We also list the procedure we followed and the meetings (physical andvirtual) we had. For completeness we also include the methodologies used inthe creation of the “Crisis of Prioritization” Report (section 15 in page 107) andthe ENISA Threat Landscape Report (section 22 in page 131).A.1 Cyber Security: A Crisis of PrioritizationIn addition to engaging the members of the PITAC Committee, the co-chairs ofthe Committee organized or participated in a number of meetings as follows:• April 13, 2004 PITAC Meeting: Members of US funding agencies presentedthe current state of funding: i.e. who funds what kind of cybersecurity research and to what level. PITAC members then discussed theissues addressed in the presentations. The public was then invited tomake comments and ask questions.• June 17, 2004 PITAC Meeting: The Subcommittee Chair gave an updateon the Cyber Security Subcommittee’s activities and solicited commentfrom PITAC members and the public.• July 29, 2004 Town Hall Meeting: The purpose of the Town Hall meetingwas to “solicit perspectives from the public on the current state of cybersecurity and the future measures needed to help ensure US leadership inthis area.” The participants were given a list of questions and asked toaddress them in their presentations.• November 19, 2004 PITAC Meeting. The Subcommittee Chair presentedthe draft findings and recommendations and PITAC members providedfeedback. Members of the public also provided comments.A.2 ENISA Threat LandscapeThe ENISA Threat Landscape [268], summarized in Chapter 22, originatedfrom processing 120 individual reports. Threat reports from 2011 are actually