On Information Security, Karl Popper and a peasant

1. 4. How can levels of Cyber Conflict and Cooperation be measured and compared across technical changes? professor Ruslan Smelianskiy

2. On Information Security, Karl Popper and a peasant Information Security: What Are We Dealing With? professor Ruslan Smelianskiy

3. Outline • Information Security - is it a science or is it an art? • If it is a science, is it a natural one or is it a social science? • If it is not an art, then even if it is engineering or applied science then should it be treated as a science? • What does it mean “to be treated as a science”? • What is the state of the art in Information security as some sort of the science? • What we have to do to treat the Information security as a science? • What lessons from this? professor Ruslan Smelianskiy

4. Basic classification “Art is the product or process of deliberately arranging items (often with symbolic significance) in a way that influences and affects one or more of the senses, emotions, and intellect.” “Science (from the Latin scientia, meaning "knowledge") is an enterprise that builds and organizes knowledge in the form of testable explanations and testable predictions about the world.” professor Ruslan Smelianskiy

5. Basic classification professor Ruslan Smelianskiy

6. Scientific method • Observationis quantitative or qualitative descriptions/measurement of facts and phenomenon. The abstractions have to be used in such sort descriptions. • Analysis of observations is systematic differentiation of significant ones against minor ones. • Synthesisis generalization of analysis results as theory or hypothesis. • Prediction is consequences deriving from a proposed theory or hypothesis by deduction, induction or by some other logical methods. • Falsifying the predictions by experiment. All data and the results should be treated critically on every level of consideration. professor Ruslan Smelianskiy

7. Certainty vs Science • The science differs from other kind of knowledge making activities (certainty) is necessity to prove, to justify every theoretical consequence by experimental, empirical data. • Karl Popper writes that scientific knowledge "consists in the search for truth", but it "is not the search for certainty“... • Popper proposed falsifiability (the ability of theories to come in conflict with observation) as the landmark of empirical theories, and falsification (the search for observations that conflict with the theory) as the empirical method to replace verifiability and induction by purely deductive notions. • “Belief in the omnipotence of science and the certainty about the continuity of the process of accumulation of scientific knowledge, the unknown remains so only temporarily, is a continuous stimulus to productive activity constantly updated scientific society.” (F.Karpa) professor Ruslan Smelianskiy

8. Security Kernel DevelopCriteria AndMake Available Commercial Evaluations TCB for System Composition Formal Model for Access Polices Internet Explosion 70 90 80 Information Security – Art or Science? • IS = Social Science + IT (Computer Science) • Art ( K.Mitnik “The Art of Deception”) • Information Security in that part of it which relate to the Computer and Network Security • This area of knowledge includes more than 40 years of development (Multix project, F.Corbato, MIT 1963) professor Ruslan Smelianskiy

9. Some statistics on Attack and Malware datasets Datasets citation rates according to Google Scholar professor Ruslan Smelianskiy

10. Monitoring with Intrusion Detection Systems • State of the art in network security monitoring • Over 200 research projects in intrusion detection since 1980 • Major hardware vendors have IDS solutions – Cisco, IBM, Intel, etc • Over 30 specialized vendors like SourceFire, Arbor, Narus, etc. • http://www-rnks.informatik.tu-cottbus.de/en/node/209 • No common methods for IDS evaluation and comparison • Commercial testing available like NSS Labs: http://www.nsslabs.com/research/network-security/network-ips/ professor Ruslan Smelianskiy

11. Monitoring standardization • No currently available standarts • NIST recommendations on intrusion detection give too general answers to those questions - where IDS should be placed? How do we choose appropriate type of IDS according to our needs? How do we tune it to gain optimal efficiency?http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf • How can we trust the results of monitoring network security with such tools in the situation like we have now? Two elephants professor Ruslan Smelianskiy

12. Moore’s law vs Gilder’s law professor Ruslan Smelianskiy

13. Target and Scope of Damage Seconds GlobalInfrastructureImpact RegionalNetworks MultipleNetworks IndividualNetworks IndividualComputer • Next Gen • Infrastructure hacking • Flash threats • Massive worm driven DDoS • Damaging payload worms Minutes • 3rd Gen • Network DoS • Blended threat (worm + virus+ trojan) • Turbo worms • Widespread system hacking Days Weeks • 2nd Gen • Macro viruses • Email • DoS • Limited hacking • 1st Gen • Boot viruses 1980s 1990s Today Future professor Ruslan Smelianskiy

14. High Packet forging/ spoofing Stealth diagnostics Sophistication of hacker tools Back doors Scanners Sniffers Exploiting known vulnerabilities Hijacking sessions Disabling audits Self-replicating code Password cracking Password guessing 2000 Low 1980 1990 professor Ruslan Smelianskiy

15. Resume It seems reasonable for information security community and national governments to support developing open and public collections of up-to-date malware along with results of it’s preliminary analysis. And what seems to be most important – it is necessary to recover the practice of publishing raw experimental data, on which the research results rely. The overall experience of the information security field and other natural sciences demonstrates that publicity of this kind always greatly encourage both quality and quantity of research projects. professor Ruslan Smelianskiy

16. A parable Once there was a peasant, who had a horse that was considered a rich man in his village. He was envied. But when his horse went into the forest and never came back, his neighbours ceased to be jealous of him, and some even felt sorry for him. When his horse returned and brought with it one more horse, some again became jealous of him. And then his son fell from the horse and broke his leg. Many have ceased to envy him. But here's the war began, all the young guys drafted into the army and were killed in the war, and his lame son was not taken, and some again became jealous of him. Only the peasant never grieved, and never was joyous about that. He could not do it because he could not foresee the future and did not see any good in sadness and joy. professor Ruslan Smelianskiy

17. Conclusion In our reality, the lack of pictures of the future can lead to irreversible consequences. professor Ruslan Smelianskiy