Four Grand Challenges in Trustworthy Computing - Revision history

WikiSysop at 20:12, 23 July 2010

2010-07-23T20:12:54Z

← Older revision		Revision as of 20:12, 23 July 2010
Line 9:		Line 9:

	==Categorization==		==Categorization==
	* ~~Resources~~ by Type: [[Independent Reports]]		* Resource by Type: [[Independent Reports]]
	* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]; [[Usability/Human Factors]]		* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]; [[Usability/Human Factors]]

WikiSysop at 20:08, 23 July 2010

2010-07-23T20:08:14Z

← Older revision		Revision as of 20:08, 23 July 2010
Line 9:		Line 9:

	==Categorization==		==Categorization==
			* Resources by Type: [[Independent Reports]]
	* ~~Overview~~: [[Independent Reports]]

	* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]; [[Usability/Human Factors]]		* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]; [[Usability/Human Factors]]

WikiSysop: /* Key Words */

2010-07-14T15:18:12Z

Key Words

← Older revision		Revision as of 15:18, 14 July 2010
Line 20:		Line 20:
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_a_Public_Good \| Cyber Security as a Public Good]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_a_Public_Good \| Cyber Security as a Public Good]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#DDoS_Attack \| DDoS Attack]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#DDoS_Attack \| DDoS Attack]],
	~~[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries \| Information Asymmetries]],~~
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware \| Malware]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware \| Malware]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching \| Patching]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching \| Patching]],

WikiSysop: /* Key Words */

2010-07-14T15:11:23Z

Key Words

← Older revision		Revision as of 15:11, 14 July 2010
Line 14:		Line 14:
	* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]; [[Usability/Human Factors]]		* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]; [[Usability/Human Factors]]

	==Key Words==		==Key Words==
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Antivirus \| Antivirus]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet \| Botnet]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime \| Cyber Crime]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_a_Public_Good \| Cyber Security as a Public Good]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#DDoS_Attack \| DDoS Attack]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries \| Information Asymmetries]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware \| Malware]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching \| Patching]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Research_&_Development \| Research & Development]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability \| Software Vulnerability]]

	==Synopsis==		==Synopsis==

WikiSysop: /* Categorization */

2010-07-14T15:08:57Z

Categorization

← Older revision		Revision as of 15:08, 14 July 2010
Line 12:		Line 12:
	* Overview: [[Independent Reports]]		* Overview: [[Independent Reports]]

	* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]		* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]; [[Usability/Human Factors]]

	==Key Words==		==Key Words==

WikiSysop: /* Challenge 1: Eliminate Epidemic Attacks by 2014 */

2010-07-14T15:08:24Z

Challenge 1: Eliminate Epidemic Attacks by 2014

← Older revision		Revision as of 15:08, 14 July 2010
Line 43:		Line 43:
	===Challenge 1: Eliminate Epidemic Attacks by 2014===		===Challenge 1: Eliminate Epidemic Attacks by 2014===

	Epidemic attacks are intended to provoke catastrophic losses in the worldwide computing and communications infrastructure. Characterized by their extremely rapid spread, the costs (to legitimate users) of successful epidemics have risen in recent years to billions of dollars per attack. ~~The4~~ challenge is to eliminate the threat of all epidemic-style attacks such as viruses and worms, spam, and denial-of-service attacks within the decade.		Epidemic attacks are intended to provoke catastrophic losses in the worldwide computing and communications infrastructure. Characterized by their extremely rapid spread, the costs (to legitimate users) of successful epidemics have risen in recent years to billions of dollars per attack. The challenge is to eliminate the threat of all epidemic-style attacks such as viruses and worms, spam, and denial-of-service attacks within the decade.

	It is possible to imagine approaches that might be effective at deterring epidemic attacks if they were further developed and deployed:		It is possible to imagine approaches that might be effective at deterring epidemic attacks if they were further developed and deployed:

WikiSysop: /* Categorization */

2010-07-14T15:08:10Z

Categorization

← Older revision		Revision as of 15:08, 14 July 2010
Line 11:		Line 11:

	* Overview: [[Independent Reports]]		* Overview: [[Independent Reports]]

			* Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]

	==Key Words==		==Key Words==

WikiSysop: /* Additional Notes and Highlights */

2010-07-14T15:05:38Z

Additional Notes and Highlights

← Older revision		Revision as of 15:05, 14 July 2010
Line 87:		Line 87:
	==Additional Notes and Highlights==		==Additional Notes and Highlights==

	Expertise Required:		Expertise Required: None

WikiSysop: /* Challenge 4: Secure the Ubiquitous Computing Environments of the Future */

2010-07-14T15:05:29Z

Challenge 4: Secure the Ubiquitous Computing Environments of the Future

← Older revision		Revision as of 15:05, 14 July 2010
Line 81:		Line 81:

	===Challenge 4: Secure the Ubiquitous Computing Environments of the Future===		===Challenge 4: Secure the Ubiquitous Computing Environments of the Future===
			The fourth and final grand challenge is to protect our future technological base. For the dynamic, pervasive computing environments of the future, we will give computer end-users security they can understand and privacy they can control. Technology can easily outrun comprehensibility, and a trustworthy computing base should not make this worse. By the same token, identity will be many-faceted and ubiquitous in a world of pervasive computing, and individuals should be able to maintain control of it.

			Experience teaches us that it is important to treat security as a driving concern from the earliest stages of system design. Also, our experience with the adoption of the Internet is evidence that information security has to reflect the sensibilities of the underlying social systems as opposed to simple technological systems. If the systems of the future are deployed without adequate security, or if our privacy is compromised in the name of technological change, we may not be able to regain it. It is important to issue a call to the security community to assert a leadership role now.

	==Additional Notes and Highlights==		==Additional Notes and Highlights==

	Expertise Required:		Expertise Required:

WikiSysop: /* Challenge 3: Develop Accurate Risk Analysis for Cybersecurity */

2010-07-14T15:03:56Z

Challenge 3: Develop Accurate Risk Analysis for Cybersecurity

← Older revision		Revision as of 15:03, 14 July 2010
Line 66:		Line 66:

	===Challenge 3: Develop Accurate Risk Analysis for Cybersecurity===		===Challenge 3: Develop Accurate Risk Analysis for Cybersecurity===
			Even the best technology for enabling trustworthy computing will be ineffective if it is not deployed and used in practice. Executives, corporate boards of directors and chief information officers are jointly responsible for balancing investments and risks, and use many metrics for determining whether or not a projected return on investment (ROI) justifies the investment. Spending for new information security measures is such an investment for most organizations.

			ROI analysis has proved to be remarkably ineffective in spurring effective investments in information technology. Despite CERT/CC data and daily newspaper headlines that document the increasing costs of attacks and vulnerabilities of the computing base, investments for information security in all types of organizations, expressed as a percentage of overall IT spending, has actually decreased since September 11, 2001.

			A major reason for this seemingly irrational behavior on the part of decision-makers is the lack of effective models of risk. In other words, ROI analysis is only valid if there is some assurance that increasing spending on security measures actually increases security. In this regard, trustworthy computing is still in its infancy and models are needed that put information security on the same level as financial systems with regard to accurate risk modeling.

			The challenge of the research community is to develop, within ten years, quantitative IT risk management that is at least as effective as quantitative financial risk management. The February 2005 PITAC report placed quantitative benefit-cost modeling at number nine on its list of “Cyber Security Research Priorities.”

			Being able to accurately model and ultimately predict such failures is the ultimate goal of this challenge. Without a widely accepted system of risk measurement, effective management of investment and risk is quite hopeless. Without an effective model, decision-makers will either over-invest in security measures that do not pay off or will under-invest and risk devastating consequences.

			Two aspects of measurement that will need the most determined attention are:
			# Measuring the wrong thing is ultimately worse than not measuring anything at all.
			# Because choices and decisions need to be made by many organizations over long periods of time, the measures need to be consistent, unbiased and unambiguous.

	===Challenge 4: Secure the Ubiquitous Computing Environments of the Future===		===Challenge 4: Secure the Ubiquitous Computing Environments of the Future===

← Older revision		Revision as of 15:18, 14 July 2010
Line 20:		Line 20:
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_a_Public_Good \| Cyber Security as a Public Good]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_a_Public_Good \| Cyber Security as a Public Good]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#DDoS_Attack \| DDoS Attack]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#DDoS_Attack \| DDoS Attack]],
	~~[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries \| Information Asymmetries]],~~
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware \| Malware]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware \| Malware]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching \| Patching]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching \| Patching]],