Archives

The always interesting Jon Katz has recently posted a number of thought-provoking articles on the state of computer-security research and some problems therein. (See here and the follow-up here.) I have my own thoughts on the general issue (which I will post about later) but wanted to quickly reply to one particular suggestion from the comments: that we don't need journals, or at least we don't need paper journals.

In reply, I would like to state as clearly and as emphatically as I can: we need paper journals. Why? Because we are not the end of history.

Between my trip to CCS last month and my employer's internal security-focused reading-group, I've been exposed to quite a bit of recent research in the area of computer security recently. Much of it has been highly technical, of course, but after a while it has sparked some very general observations about the field. Over the next few posts, I'd like to review some of the more accessible papers and use them to motivate some of those observations. In this post: why I am so frustrated by the field of academic cryptography.

For ten days at the beginning of 2009, a team of computer-security researchers managed to take control of a live, real-world, criminal botnet. Over those days, they observed (and recorded) the botnet harvest over 70GB of stolen data (password, bank-account number, etc.) from almost two hundred thousand subverted machines. Why did they do this? Simple curiosity, probably. But that's not nearly as interesting as how they did it, what they found, and what this means about the field of computer security.

I have no idea how this paper came about, but I'm glad it did. The first author is a computer-science professor at Cambridge University specializing in privacy and systems security. The second author is a professional scam artist and stage magician who demonstrates real-world scams on unsuspecting victims as part of a BBC television show. Together, they fight crime!

I would ordinarily regard this as a rather obscure piece of esoterica, too technical to blog about (and merely a technical report, besides) but:

1. My beloved readers seem to like topics more technical that I would have thought, and (more importantly)
2. It's my piece of obscure esoterica.

So, tech report or no, it gets a blog post.

While researching something unrelated, I stumbled across an interesting feature of CiteSeerX: "estimated venue impact factors." That is, it attempts to rank CS-related conferences and journals in terms of their 'impact.' However, something seems to be wrong with their algorithm-- there is no way that a single sub-specialty (security) can contain eight of the top 25 conferences.

If you are thinking of going to the IEEE Computer Security Foundations Symposium (CSF) this year, please be aware that you must register by TODAY if you want to have a print proceedings at the event itself. For various reasons (worthy of a blog-post in their own right) this year will not be like previous years. In previous years, you could register at any time and automatically receive a copy of the proceedings when you showed up. This year, on the other hand, is more complicated:

• If you register by June 10, 2010, and order a copy of the proceedings during registration, then you will get your copy when you show up at CSF.
• If you register after June 10, or register before then but don't order the proceedings, then you will have a chance to order a copy of the proceedings at CSF itself. It will be printed by a print-on-demand operation and shipped to any address you specify. Total cost: it depends, but probably on the order of $15 plus shipping. But you won't get it until after CSF ends.
• If you do not register for CSF, or do not order your copy at CSF itself, you can still order a copy from the IEEE. It will again be printed by a print-on-demand operation, and likely to be of very high quality. And it better be, for what they charge: ordering the 2009 CSF Proceedings this way will cost you about $100.

So, if you were thinking about attending CSF, let this give you the impetus to do so. It's a great conference, it's going to be co-located with a bunch of other great conferences (included in the registration-price) and it's in Edinburgh, Scotland. What more do you need?

My employer's incredible need for computer security experts continues unabated. Some new job-postings for you:

• Formal Methods Researcher
• Scientific Intellegence Analyst
• Malicious Code Analysis Researcher

Descriptions under the fold, and the full list of open jobs can be found here:

https://www.ll.apply2jobs.com/ProfExt/index.cfm?fuseaction=mExternal.showSearchInterface

Just select Group 06-68 (Cyber Systems and Technology) from the 'Group' pull-down menu. And please notice that there are two screens of job postings.

This post is really a follow-up to my last post, in which I tried my damnedest to talk people out of going to graduate school. The rationale there was that grad school is a serious commitment with some very high hidden costs, and that while those costs may be worth it for some people, they would go to grad school no matter what I said. If I could possibly talk you out of grad school, therefore, you really shouldn't go.

When writing that post, I was planning to take the same position in this one: that if I could talk you out of being a professor, you shouldn't be one. But between then and now, I gave it more thought and realized two things:

• There is absolutely no way that I would be able to talk anybody at all out of taking a professorship.
• My feelings on professorships are more mixed than they were about graduate school.

So, I'm not going to try to talk people out of professorships after all. In fact, I'm not even going to try to answer the question in the title of this post. Instead, I'll just lay out my observations on the matter and let people decide for themselves.