Standardized and Repeatable Technology Evaluation for Cybersecurity Acquisition
Roger A. Hallman, Jose Romero-Mariona, Maxine Major, Megan Kline, Lawrence Kerr, Geancarlo Palavicini, John San Miguel, Josiah A. Bryan · 2017
Abstract : Cybersecurity is a growing concern for the United States Government, indeed the United States is on the receiving end of an estimated 100,000 cyber-attacks each day. Cybersecurity is a fast-growing market where technologies are constantly evolving to counter threats to information and operations systems. Across the U.S. Government as a whole, there is no standard and repeatable methodology for evaluating cybersecurity technologies. In this document, we introduce the Department of Defense (DoD)-centric and Independent Technology Evaluation Capability (DITEC), an experimental decision support service within the DoD, which aims to provide a standardized framework for cybersecurity technology evaluations in support of acquisition decision making. In addition to DITEC as a proof of concept, we describe a family of services including DITEC , an enterprise-level tool, and the Cyber-SCADA Evaluation Capability (C-SEC), an instantiation of DITEC for evaluating SCASA network cybersecurity technologies.