Retroactive Security

Butler Lampson
2013

Citation: I’ve given versions of this talk at the Computer Security Foundations Symposium in 2012, Fred Schneider’s 60^th birthday celebration in 2013, New England Database Day in 2014,

Links: Abstract, Acrobat, PowerPoint.

Email: blampson@microsoft.com. This paper is at http://www.research.microsoft.com.

Abstract:

It’s time to change the way we think about computer security: instead of trying to prevent security breaches, we should focus on dealing with them after they happen. Today computer security depends on access control, and it’s been a failure. Real world security, by contrast, is mainly retroactive: the reason burglars don’t break into my house is that they are afraid of going to jail, and the financial system is secure mainly because almost any transaction can be undone.

There are many ways to make security retroactive:

• Track down and punish offenders.

• Selectively undo data corruption caused by malware.

• Require applications and online services to respect people’s ownership of their personal data.

Access control is still needed, but it can be much more coarse-grained, and therefore both more reliable and less intrusive. Authentication and auditing are the most important features. Retroactive security will not be perfect, but perfect security is not to be had, and it will be much better than what we have now.