1 / 5

Dan Simon is wrong

Dan Simon is wrong. July 8, 1998. “What is Security?”. “Security is about implementing people’s preferences for privacy, trust and information sharing (i.e., their `Security Policies’)” Wrong (or incomplete) Security is also about eliminating unforeseen consequences

garima
Download Presentation

Dan Simon is wrong

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Dan Simon is wrong July 8, 1998

  2. “What is Security?” • “Security is about implementing people’s preferences for privacy, trust and information sharing (i.e., their `Security Policies’)” • Wrong (or incomplete) • Security is also about eliminating unforeseen consequences • Constructing the policy is the hard part

  3. You can’t handle the truth • Who should be able to open the front door on my house? • Me, my family, our guests • Police, firefighters, paramedics • But they should be logged and audited • Locksmiths? • It’s hard to construct the right lists • Physical metaphors may not help

  4. Social constructs • Security policies are based on experience • Less experience on computers than in real world • Unforeseen consequences may be far more numerous • Predicting consequences is computationally complex • Analogies may not maintain consequences

  5. Desiderata • I need an administrator • I’m not alone • My policy might simply parameterize the administrator’s policy • I need auditing • I need undo • I need someone to explain my policy to me

More Related