Revenue Assurance to Assurance: The Importance of Measurement in Computer Security, Ten Years On

In 1995, Netscape rolled out SSL, a protocol that's crucially dependent for its security on certificates created by third-party CAs, but for the first 1
1/2 decades of its existence no-one had ever tried to measure how effectively these were being handled. When a volunteer-run project by the EFF did finally examine the situation, they found a chaotic mess that still hasn't been fully untangled. This talk looks at various failures of measurement both in and outside the field of computer security where it's more widely encountered as revenue assurance, and applies lessons from that field to computer security mechanisms.

Presenter - Peter Gutmann

Peter Gutmann is a researcher in the Department of Computer Science at the University of Auckland working on design and analysis of cryptographic security architectures, security usability, and embedded systems security. He helped write the popular PGP encryption package, has authored a number of papers and RFC's on security and encryption including serving as the final editor of the world's longest-running security RFC, RFC 8894, and is the author of the open source cryptlib security toolkit, "Cryptographic Security
Architecture: Design and Verification" (Springer, 2003), and an upcoming book "Engineering Security". In his spare time he pokes holes in whatever security systems and mechanisms catch his attention and grumbles about the lack of consideration of human factors in designing security systems.