We Need Assurance!

When will we be secure? Nobody knows for sure – but it cannot happen before commercial security products and services possess not only enough functionality to satisfy customers’ stated needs, but also sufficient assurance of quality, reliability, safety, and appropriateness for use. Such assurances are lacking in most of today’s commercial security products and services. I discuss paths to better assurance in Operating Systems, Applications, and Hardware through better development environments, requirements definition, systems engineering, quality certification, and legal/regulatory constraints. I also give some examples.

• Type: Conference
• Year: 2005
• Where: ACSAC
• Authors: Brian D. Snow
• Keywords: ACSAC 2005, Commercial Security Products, Security Privacy, Sufficient Assurance, Today’s Commercial Security