Unusable Security for Attackers [From the Editors]

IF 2.9 4区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

IEEE Security & Privacy Pub Date : 2023-11-01 DOI:10.1109/msec.2023.3308648

Mary Ellen Zurko

引用次数: 0

Abstract

One of the things that makes security research different from other research is the presence of attackers, potentially or in actuality. The early research I was exposed to barely touched on the attacker. The Trusted Computer System Evaluation Criteria from the 1980s had hardly a whisper of functionality specifically for countering attacks, beyond auditing security relevant events. When we were researching and composing secure systems, most of us thought that antivirus, when it emerged, was a fool’s game. Who could possibly catch all the different ways an attacker might go about breaching a system? The first question put to a presentation on intrusion detection system (IDS) research was predictably “How did you know that the system was free of attacks when you baselined it?”

查看原文本刊更多论文

攻击者无法使用的安全性[来自编辑]

使安全研究与其他研究不同的事情之一是攻击者的存在，潜在的或现实的。我接触到的早期研究几乎没有涉及攻击者。20世纪80年代的可信计算机系统评估标准(Trusted Computer System Evaluation Criteria)除了审计与安全相关的事件外，几乎没有专门针对攻击的功能。当我们在研究和编写安全系统时，我们大多数人认为防病毒技术刚出现时是一种愚蠢的游戏。谁能抓住攻击者破坏系统的所有不同方式呢?在一个关于入侵检测系统(IDS)研究的演讲中，第一个问题不出所料地是“当你设定基线时，你怎么知道系统没有受到攻击?”

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

IEEE Security & Privacy 工程技术-计算机：软件工程

CiteScore

4.30

自引率

5.30%

发文量

159

审稿时长

6-12 weeks

期刊介绍： IEEE Security & Privacy’s primary objective is to stimulate and track advances in security, privacy, and dependability and present these advances in a form that can be useful to a broad cross-section of the professional community—ranging from academic researchers to industry practitioners. It provides articles with both a practical and research bent by the top thinkers in the field of security and privacy, along with case studies, surveys, tutorials, columns, and in-depth interviews and podcasts for the information security industry. Through special issues, the magazine explores other timely aspects of privacy in areas such as usable security, the Internet of Things, cloud computing, cryptography, and big data. Other popular topics include software, hardware, network, and systems security, privacy-enhancing technologies, data analytics for security and privacy, wireless/mobile and embedded security, security foundations, security economics, privacy policies, integrated design methods, sociotechnical aspects, and critical infrastructure. In addition, the magazine accepts peer-reviewed articles of wide interest under a general call, and also features regular columns on hot topics and interviews with luminaries in the field.