Professor Ross Anderson
Information Security - Where Computer Science, Economics
and Psychology Meet
For years, people thought that the insecurity of the Internet was
due to a shortage of features, and so all through the 1990s we worked
vigorously on developing better encryption, authentication and filtering
mechanisms. But things didn't get any better. We began to realise
that failures - of both security and dependability - are intricately
tied up with incentives. Systems often fail because the people who
guard and maintain them don't bear the full costs of failure. Microsoft
doesn't accept liability for vulnerabilities that lead to millions
of its customers being hacked; DVD region coding is easy to subvert
because equipment vendors don't lose money when it fails; and ATMs
suffer more fraud in countries that let banks dump the costs of
fraud on customers.
This led to the emergence of a new field of study, information
security economics, which the speaker helped to found. It provides
valuable insights not just into `security' topics such as privacy,
bugs, spam, and phishing, but into more general areas such as system
dependability and policy. This research program has been starting
to spill over into more general security questions (such as law-enforcement
strategy), and into the interface between security and sociology.
The most recent development is the interaction with psychology.
As systems get harder to attack, the bad guys attack the users instead;
phishing only got properly going in 2004, but by 2006 cost British
banks £35m. We now know that most information security mechanisms
are too hard to use, being designed by geeks for geeks. We urgently
need to introduce bright ideas and best practice from psychology
and human-computer interface design. And in addition to these `micro'
scale concerns, there are many `macro' scale problems - why do people
overreact to terrorism, yet underreact to everything from environmental
degradation to road traffic accidents?
The challenge is to build a proper multi-disciplinary framework
for analyzing security problems - one that is both principled and
effective.
Ross Anderson is Professor of Security Engineering at Cambridge
University. He is one of the founders of a vigorously-growing
new discipline: the economics of information security. Many security
failures can be traced to wrong incentives rather than technical errors,
and the application of microeconomic theory has shed new light on
many problems that were previously considered intractable. The work
is particularly important for understanding fraud and online liability.
It is also giving insights into system safety and dependability, and
into more traditional security problems of interest to law enforcement
and the insurance industry. This multidisciplinary approach is now
spilling over into psychology and anthropology.
Ross also made seminal contributions to peer-to-peer systems; hardware tamper-resistance; emission security; copyright marking; crypto protocols; and the security of APIs. He was a coauthor of Serpent, a finalist in the competition to find an Advanced Encryption Standard.
Other papers document the failures of real world systems, including automatic teller machines, prepayment meters and medical record systems. He chairs the Foundation for Information Policy Research, the main UK think-tank on internet and technology policy issues. He is a Fellow of the IET and the IMA, and wrote the definitive book 'Security Engineering -- A Guide to Building Dependable Distributed Systems'.
For further information please see Professor Andersons website:
http://www.cl.cam.ac.uk/~rja14/
|
