As our Nation increasingly depends on computers and networks for national defense and for running its critical infrastructures, such as the Power Grid and the financial networks, adversaries have become interested in attacking our systems in order to achieve financial gain, to cause major disruption to services or to extract sensitive information. To cope with these serious threats, there has been much activity to improve the security or our Nation?s systems, much of it initiated in the research community but motivated by real and current security problems.
Because of the pressing need for solutions to immediate threats, the security research community has not focused enough on evolving security into a science. As a result, many of the solutions are ad hoc, address only particular threats, and, most important, are not amenable to evaluation. The comment complaint is that there is no theory (or experimental methodology or infrastructure) that supports the security evaluation of systems.
The purpose of this workshop is to explore approaches to create a science of security that will address the lack of principles that can help engineer secure systems and can lead to their evaluation. Such principles can relate to models of attacks and of attackers, the ability to reason about the resilience of a system, the ability to compare the security of systems, the ability to compose systems with known security characteristics to produce a system also with known security characteristics.
A workshop to engage the research community towards a science of security is proposed. A two-day workshop is planned, to be organized by an ad hoc committee composed of security experts from academia, experts from other fields where there is an established science in the expectation that the security community can learn from such successes, experts from research institutions, important industry leaders, and Government PMs.
