Unfalsifiability of security claims
Unfalsifiability of security claims
复制标题
安全声明的不可证伪性
DOI：
10.1073/pnas.1517797113
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Cormac Herley
中科院分区：
文献类型：
--
作者：
Cormac Herley
在计算机安全方面的重要性涉及防御措施：告诉人们如何选择和维护密码，管理他们的计算机等等。声称“如果您不这样做，则不是安全的。”衡量足够的攻击将证明这一事实，但是如果我们对必要的观察不可能，则可以揭示出必要的索赔是计算机安全中的一种不对称性：可以通过观察声明事物不安全，但没有允许我们声明任意系统或技术的观察。安全。它们不是必需的，对新信息的响应只能是向上棘轮：新观察或推测的攻击能力可以说对策，但是当理由是不可分割的，确定防御措施的相对重要性会减少对象的假设的相对重要性。错误和错误会累积，我们没有系统的方法来排名或确定措施的优先级。
Significance Much in computer security involves recommending defensive measures: telling people how they should choose and maintain passwords, manage their computers, and so on. We show that claims that any measure is necessary for security are empirically unfalsifiable. That is, no possible observation contradicts a claim of the form “if you don’t do X you are not secure.” This means that self-correction operates only in one direction. If we are wrong about a measure being sufficient, a successful attack will demonstrate that fact, but if we are wrong about necessity, no possible observation reveals the error. The fact that claims of necessity are easy to make, but impossible to refute, makes waste inevitable and cumulative. There is an inherent asymmetry in computer security: Things can be declared insecure by observation, but not the reverse. There is no observation that allows us to declare an arbitrary system or technique secure. We show that this implies that claims of necessary conditions for security (and sufficient conditions for insecurity) are unfalsifiable. This in turn implies an asymmetry in self-correction: Whereas the claim that countermeasures are sufficient is always subject to correction, the claim that they are necessary is not. Thus, the response to new information can only be to ratchet upward: Newly observed or speculated attack capabilities can argue a countermeasure in, but no possible observation argues one out. Further, when justifications are unfalsifiable, deciding the relative importance of defensive measures reduces to a subjective comparison of assumptions. Relying on such claims is the source of two problems: once we go wrong we stay wrong and errors accumulate, and we have no systematic way to rank or prioritize measures.