Computer Security in the Real World

Butler Lampson

Citation: IEEE Computer 37, 6 (June 2004), pp 37-46. For an earlier, expanded version, see [64].

Links: Abstract, Acrobat, Acrobat as published, Web page, Word. Slides for a talk are here.

Email: blampson@microsoft.com. This paper is at http://research.microsoft.com.

Abstract:

After thirty years of work on computer security, why are almost all the systems in service today extremely vulnerable to attack? The main reason is that security is expensive to set up and a nuisance to run, so people judge from experience how little of it they can get away with. Since there’s been little damage, people decide that they don’t need much security. In addition, setting it up is so complicated that it’s hardly ever done right. While we await a catastrophe, simpler setup is the most important step toward better security.

In a distributed system with no central management like the Internet, security requires a clear story about who is trusted for each step in establishing it, and why. The basic tool for telling this story is the “speaks for” relation between principals that describes how authority is delegated, that is, who trusts whom. The idea is simple, and it explains what’s going on in any system I know. The many different ways of encoding this relation often make it hard to see the underlying order.