Search

Computer and network development is difficult. Translation of needs into specifications is an art, as is verifying that a technical design fulfills the specifications. Unfortunately, while these seemingly intractable problems are necessary for verifying system security, they are not sufficient. This article presents the difficulty of security verification. The first topic we consider is the economics of the commercial off-the-shelf market. Unfortunately, economics, more so than technical issues, is the driving force behind the prevalence of vulnerabilities. The second topic we examine is that security architectures typically are defined within a limited scope. We discuss the Secure Sockets Layer and Transport Layer Security technology that is the basis of e-commerce. A large number of vulnerabilities were disclosed recently that negate its security guarantees. Finally, we discuss side-channel attacks. Once again, security is circumvented without the need to directly attack the protocols. Small amounts of information leakage can be used over time to circumvent well-designed security systems. [ABSTRACT FROM AUTHOR]