Is More Security Better?

Over this semester, we have talked about a lot of the problems that have been created and made worse by modern computers and internet technologies. Problems like fraud, phishing, hacking, etc. And hopefully I have convinced you that cybersecurity — our attempts to stop or reduce the damage from these problems — is important.

I always find it interesting to read well thought out opinions that run contrary to my own. So for the final reading of the semester, please read this recent paper by Andrew Odlyzko titled “Cybersecurity is not very important”. Dr. Odlyzko has been a cybersecurity researcher and expert for decades, and is also well known as a contrarian who likes to argue against popular opinions when he thinks they are wrong. I find his paper very interesting to think about.

http://www.dtc.umn.edu/~odlyzko/doc/cyberinsecurity.pdf

Also, please read this short paper by Cormac Herley about some fundamental limits of security. (or, alternatively, watch this hour and a half talk by Dr. Herley on the same ideas.)

---

Finally, for this week’s quiz, I want you to do two somewhat different things. These should be fairly easy I hope.

First, think about the final paper. The final paper asks you to write a chapter much like the ones in Dr. Wolff’s book that we read at the beginning of the semester. It should describe some real cybersecurity incident that happened, and then use some social science concept from class to better analyze it and hopefully make suggestions for how to prevent it in the future. For the first question, I want you to write a very brief (1 paragraph) proposal for the final paper. Describe what incident you intent to write about, and also describe the social science concept you think applies and will help you understand the incident and/or come up with suggestions for designs or policies. This proposal isn’t binding — you can always write about something different. But I will provide some feedback on your thinking that will hopefully help you as you work on your final paper.

Second, I want you to reflect back over the semester. Cybersecurity is a complex topic, and there is a lot happening in the world around it. If I did my job well, then you know a lot more about cybersecurity than you did at the beginning of the semester, and you have ways to think about and understand cybersecurity things happening in the world. If I did my job well, then you also probably feel confused and uncertain and like these problems are difficult to fix — because they are difficult problems with no good solutions. Think back over what we’ve talked about and read about, and what you’ve learned this semester. What do you think was the most interesting or important thing you got out of this class?