The science, engineering and business of cyber security

I will use the rare opportunity of this keynote talk to give my perspective on the general state and future prospects for cyber security, and the consequences of this perspective with respect to cyber security research and education. The ambiguous status of computer science in modern academia has persisted through the thirty plus years of my career. Does it belong in the College of Science or the College of Engineering? How about the College of Business? Is it worthy of a separate College of its own? I believe this ambiguity is a manifestation of the fundamental difference between computer science relative to traditional sciences and engineering disciplines. The forces of science, engineering and business come together and reconcile in a particularly unique way in computer science, and within computer science cyber security brings additional peculiarities to this reconciliation.

My outlook on cyber security is generally optimistic. I believe at the consumer level market and social forces will drive developed societies to a relatively low assurance of security and privacy analogous to the current state of internet security. The large-scale adoption of internet services across diverse global populations is one indicator that the average consumer is reasonably comfortable with the collateral risks. But nothing is automatic, so social organization will be required to compensate for the intrusions of big government and big business which may turn out to be the much bigger problem than big crime. At the same time I share the concern of many senior national security officials and thought leaders on the increasingly grave threat of cyberwar and cyberterrorism. The US Department of Defense has publicly recognized cyberspace as a man-made domain on par with land, sea, air and space within which wars will be conducted and facilitated. Many other nations and militaries are preparing offensive and defensive cyber capabilities.

My talk will elaborate on these notions and seek to glean some lessons for cyber security researchers.