Search

The article discusses the evolution of enterprise security in parallel with household security, emphasizing the transition from perimeter defenses to comprehensive access controls amid the internet's ubiquity. It explores the challenges of maintaining security as businesses expose more applications externally and advocates for segmented access based on roles and responsibilities to prevent breaches. Finally, it underscores the importance of pervasive authority checks within systems to minimize vulnerabilities and ensure robust security.

The article discusses various aspects of the U.S. Cyber Safety Review Board's "Review of the December 2021 Log4j Event" report, and it mentions how a vulnerability in Apache Software Foundation computer software systems can impact the information technology (IT) safety of companies, governments, and organizations across the world. A recommendation about investing in free and open source software security is assessed, as well as computer software design decisions.

The article discusses the ethics of U.S. government employees concerning the collection of computer software bugs and ransomware vulnerabilities. It discusses the U.S. National Security Agency (NSA), public policy education concerning stockpiling, and balanced policies about what are referred to as zero-day actions versus threats to the public.

The article discusses the software security concept of fuzz testing, also known as fuzzing, and its significance in discovering computer security vulnerabilities. It also examines static program analyzers and manual code inspection.

The author discusses what business executives need to know about software. He mentions the importance of software to any company, topics such as how software development is incremental, the need to maintain computer security including software, and the need for software developers and operators to work together.

Learn from the past to prepare for the next battle. [ABSTRACT FROM AUTHOR]

The article discusses the use of formally verified software to protect an autonomous helicopter against cyber attacks. Topics include the testing of vehicles by the U.S. Defense Advanced Research Projects Agency (DARPA) through its High-Assurance Cyber Military Systems (HACMS) program, the role of a trusted computing base (TCB) in computer architecture for security, and the componentization of systems.

Can we hide secrets in software? Can we obfuscate programs-- that is, make programs unintelligible while preserving their functionality? What exactly do we mean by "unintelligible"? Why would we even want to do this? In this article, we describe some rigorous cryptographic answers to these quasi-philosophical questions. We also discuss our recent "candidate indistinguishability obfuscation" scheme and its implications. [ABSTRACT FROM AUTHOR]

The article discusses the role of engineering and assurance in designing secure computer systems. Topics include the notion of trust in relation to assumptions as system vulnerabilities, the role of proof checking based on axiomatic trust in system security, the role of program rewriters in synthetic trust for system security.

The article discusses improving user security practices and behavior for cybersecurity. Topics discussed include the flaws in the traditional approach to managing software vulnerabilities and cybersecurity risk, proposal for an adaptation of software producer offerings involving patching rights of users and for users to be charged for the right to control patching of their individual copies of software.

The article examines two proposals intended to reduce the number of software security flaws, the first of which calls for the U.S. government to corner the vulnerability market and the second which calls for holding companies liable for faulty software. Topics include software bug bounty programs run by large software companies that reward private individuals for uncovering security flaws; a discussion of the incentivization of both programs; and the way current licensing laws shield software companies from damages arising from faults in their products.

Several letters to the editor are presented in response to articles on previous issues including "The Legal Protection of Computer Software," by Robert L. Graham in the May 1984 issue, "ACM News," August issue, and the article which contains the interview with Andries van Dam in the July 1984 issue.

The article offers an answer to a question about writing security processes for a software project, noting the document RFC (Requests for Comments) 2119.

A letter to the editor is presented in response to the article "Toward More Secure Software" by Dorothy E. Denning from the April 2015 issue.

The author offers a technical perspective on the breakthrough in software obfuscation. He discusses the rise of cryptographic concepts and applications including public key cryptography, secure function evaluation, and zero knowledge proofs. He comments on the feasibility of the natural notion of virtual black box obfuscation with reference to a research paper in which cryptographic multilinear maps were constructed.

A letter to the editor is presented in which the author responds to a reader's letter regarding her article "Toward More Secure Software" from the April 2015 issue.

The article discusses computing techniques which are used to increase the security and reliability of software including automatic memory management, type-checking, and dynamic checks. The author argues that these properties can detect programming errors and prevent security attacks. The article argues that an article by Yang and Hawblitzel, published in the issue, which uses Typed Assembly Language (TAL) and to create a software stack with end-to-end safety, is an important development.