Next Wave. Volume 19, Number 2.

摘要

The National Security Agency, the National Science Foundation (NSF), and the Intelligence Advanced Research Projects Activity jointly sponsored a workshop in November 2008 to consider whether a robust science of security was possible and to describe what it might look like. Experts from a broad set of disciplines including security, economics, human factors, biology, and experimentation met with government researchers to help lay the groundwork for potential future initiatives. Since then a number of programs focused on security science have been initiated, along with an effort to help build a robust collaboration community. This issue of The Next Wave is focused upon the topic of security science. Included are articles from six of the experts who attended the 2008 workshop and have continued to work in the area. Carl Landwehr from NSF provides a few historical examples to help us understand the evolution of cybersecurity. Adam Shostack from Microsoft provides another perspective on how science evolves and describes some steps he considers necessary to advance the development of cybersecurity science. Roy Maxion from Carnegie Mellon University (CMU) calls for greater scientific rigor in the way experimental methods are applied to cybersecurity. Dusko Pavlovic from Oxford University provides a unique and unexpected model for security to reason about what a security science might be. Anupam Datta from CMU and John Mitchell from Stanford University describe some of their joint work in one of the core problem areas for security how to compose secure systems from smaller building blocks. Alessandro Chiesa from the Massachusetts Institute of Technology and Eran Tromer from Tel Aviv University describe a novel approach based upon probabilistically checkable proofs to achieve trusted computing on untrusted hardware. The capstone article, contributed by Fred Schneider of Cornell University, methodically constructs a 'blueprint' for security science.