{"title":"Epilogue: The Past, Present, and a Possible Future","authors":"","doi":"10.1515/9781501759048-011","DOIUrl":"https://doi.org/10.1515/9781501759048-011","url":null,"abstract":"","PeriodicalId":219977,"journal":{"name":"A Vulnerable System","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129103192","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A Vulnerable SystemPub Date : 2021-09-15DOI: 10.7591/cornell/9781501758942.003.0006
Andrew Stewart
{"title":"Software Security and the “Hamster Wheel of Pain”","authors":"Andrew Stewart","doi":"10.7591/cornell/9781501758942.003.0006","DOIUrl":"https://doi.org/10.7591/cornell/9781501758942.003.0006","url":null,"abstract":"This chapter assesses how the feedback loop that emerged during the dot-com boom had created an ever-increasing number of new vulnerabilities that organizations needed to respond to by applying security patches. At the heart of the perimeter model of security was the firewall, but an organization's firewall had to permit web traffic to reach the organization's web server. If the web server had a vulnerability, which it almost certainly would experience over time, a hacker could compromise its security and likely then compromise the security of the operating system on which the web server was running. A desire for the focus of security efforts to be placed on operating system security was a curious return to the thinking of the 1970s and 1980s. Microsoft is best known for its computer software, and so its security efforts have historically been focused on software security. Ultimately, Microsoft was successful in reducing the number of security vulnerabilities in its software, in contributing to the creation of software security as a discipline, and in raising the profile of software security generally.","PeriodicalId":219977,"journal":{"name":"A Vulnerable System","volume":"136 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116329739","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A Vulnerable SystemPub Date : 2021-09-15DOI: 10.7591/cornell/9781501758942.003.0005
Andrew J. Stewart
{"title":"The Dot-Com Boom and the Genesis of a Lucrative Feedback Loop","authors":"Andrew J. Stewart","doi":"10.7591/cornell/9781501758942.003.0005","DOIUrl":"https://doi.org/10.7591/cornell/9781501758942.003.0005","url":null,"abstract":"This chapter evaluates the dot-com boom, which was a speculative bubble wherein the value of internet stocks rose for an extended period beyond anything that could be justified on economic grounds. Like other speculative bubbles, the dot-com boom was caused by an invention that created inflated hopes of financial profits. The World Wide Web provided people with the ability to consume entertaining content, to communicate in new ways, and to purchase products and services online. Since the web was a recently created set of technologies and protocols, the study of web security was therefore new by definition. Both Microsoft and Netscape struggled with how to secure mobile code. The two popular types of mobile code were Java and ActiveX, and each approached security differently. The chapter then considers the feedback loop that was created between hackers and the commercial security industry, which was a powerful engine that caused the size of the market for information security products to skyrocket.","PeriodicalId":219977,"journal":{"name":"A Vulnerable System","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115456395","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A Vulnerable SystemPub Date : 2021-09-15DOI: 10.7591/cornell/9781501758942.003.0009
Andrew J. Stewart
{"title":"Data Breaches, Nation-State Hacking, and Epistemic Closure","authors":"Andrew J. Stewart","doi":"10.7591/cornell/9781501758942.003.0009","DOIUrl":"https://doi.org/10.7591/cornell/9781501758942.003.0009","url":null,"abstract":"This chapter explores data breaches, nation-state hacking, and epistemic closure. After being compromised in a data breach, personal information, such as financial records and health history, is offered for sale on black markets. Criminals buy that information and use it to commit crimes such as identity theft and fraud. Breach disclosure laws have two intended goals: to enable the people whose information has been compromised to become aware of that fact and to perform a kind of public shaming of the organization that experienced the breach. The nation-states have also become so accomplished at hacking that they have forced a restructuring of the entire field of information security. Meanwhile, stunt hacking is a striking manifestation of the epistemic closure within the field of information security because it ignores the root causes of security failures and instead places the focus on the surface manifestation of those root causes.","PeriodicalId":219977,"journal":{"name":"A Vulnerable System","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131317414","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A Vulnerable SystemPub Date : 2021-09-15DOI: 10.7591/cornell/9781501758942.003.0011
Andrew J. Stewart
{"title":"Epilogue","authors":"Andrew J. Stewart","doi":"10.7591/cornell/9781501758942.003.0011","DOIUrl":"https://doi.org/10.7591/cornell/9781501758942.003.0011","url":null,"abstract":"This epilogue argues that the information security challenges of today will remain intractable until the past is better understood. Indeed, the three stigmata — data breaches, nation-state hacking, and epistemic closure — became manifest precisely because the past is so easy to overlook. Given these challenges, there is the question of what should be done. There must be a special effort to better understand how complexity affects information security and how that complexity can be managed. Modern programming languages that do not fall prey to certain kinds of security vulnerabilities are an example of a means by which accidental complexity can be reduced. A second example is the removal of unnecessary security decisions from both end users and technology practitioners.","PeriodicalId":219977,"journal":{"name":"A Vulnerable System","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115399174","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A Vulnerable SystemPub Date : 2021-09-15DOI: 10.7591/cornell/9781501758942.003.0007
Andrew J. Stewart
{"title":"Usable Security, Economics, and Psychology","authors":"Andrew J. Stewart","doi":"10.7591/cornell/9781501758942.003.0007","DOIUrl":"https://doi.org/10.7591/cornell/9781501758942.003.0007","url":null,"abstract":"This chapter addresses how the human user of a computer is in a prime position to act in ways that could compromise the security of the entire system. It looks at the harmful technocratic paternalism at the heart of the field of information security. The RAND Corporation and the early researchers had expected that a computer operating system could impose its will on the users of the computer, in effect forcing them to be secure. That philosophy was adopted by those who worked in the field of information security in the subsequent decades and manifested as a revealed preference for technological solutions. However, with the rise of email and the web, the user and their decisions became crucial to the security of the overall system. The possibility that security could be accomplished through technology alone was revealed to be a machine fantasy. The security of a computer is beholden to the whims of the user, and those whims are driven by the chaotic influence of economic motivations and psychological factors.","PeriodicalId":219977,"journal":{"name":"A Vulnerable System","volume":"os-43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127784112","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A Vulnerable SystemPub Date : 2021-09-15DOI: 10.7591/cornell/9781501758942.003.0010
Andrew Stewart
{"title":"The Wicked Nature of Information Security","authors":"Andrew Stewart","doi":"10.7591/cornell/9781501758942.003.0010","DOIUrl":"https://doi.org/10.7591/cornell/9781501758942.003.0010","url":null,"abstract":"This chapter studies the wicked nature of information security. It has always been unlikely that there will be a breakthrough in any one specific area of information security that will solve the problems that exist across the entirety of the field. An alternative approach has been to step outside the field of information security and examine information security problems from the perspective of other fields. The security of every computer system depends on a myriad of factors, including the technologies that are employed, the incentives of the users, and the environment in which those technologies and users reside. This means that there is a limit to how much each discipline within the field of information security can contribute to improving the security of any system, whether it be software security, network security, user education, passwords, or cryptography.","PeriodicalId":219977,"journal":{"name":"A Vulnerable System","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123267775","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A Vulnerable SystemPub Date : 2021-09-15DOI: 10.7591/cornell/9781501758942.003.0008
Andrew Stewart
{"title":"Vulnerability Disclosure, Bounties, and Markets","authors":"Andrew Stewart","doi":"10.7591/cornell/9781501758942.003.0008","DOIUrl":"https://doi.org/10.7591/cornell/9781501758942.003.0008","url":null,"abstract":"This chapter focuses on the obsession with technical security vulnerabilities at the beginning of the twenty-first century. A vulnerability that is not common knowledge and for which no patch has yet been released is referred to as a zero-day vulnerability. The term zero-day refers to the fact that there have been zero-days' advance warning, meaning no days, regarding the risk that the security vulnerability represents. Security technologies such as intrusion detection systems and antivirus software normally try to detect known patterns of attack and so typically would be unlikely to detect the use of a zero-day vulnerability. The chapter then looks at stunt hacking, which was portrayed as a way to draw attention to dangerous vulnerabilities. What went unsaid was that stunt hacking was a means by which hackers and commercial security companies could promote themselves and their technical skill sets.","PeriodicalId":219977,"journal":{"name":"A Vulnerable System","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130491041","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
求助内容：
应助结果提醒方式：