Computer Security is the Wild West

Theatrical poster for the film Vertigo
(detail), from Wikipedia.

Greetings from the Australian National University in Canberra, where I am attending a reading group on cyber security. One of the attendees from "a government agency" asked a senior academic why some of the research at international conferences is so poor: the answer was "Computer Security is the Wild West".

It has been an interesting morning. I attended a seminar  on "Vertigo: Fake news/real theory" by the ANU College of Law. Appropriately for the government established university, there was discussion of  David Foster Wallace's unfinished novel The Pale King. This relates the horrors of being a tax inspector. There was also discussion of the difficulties of countering fake news.

The ANU cyber reading group primarily reviews papers on fuzzing.  With this random data is presented to a program to test its security. Millions of random variations can be input to see if the program does something it is not supposed to. This technique is now in routine use to the point where one of our resident experts commented we had reached "peak fuzzing".

There is evidence for "peak fuzzing". The steady increase ion the number of scholarly publications found with a Google web search for "fuzzing, security testing" seems to have leveled off in 2018.

2018	1060
2017	1070
2016	841
2015	805
2014	750
2013	696

It occurs to me fuzzing might be used to test how the political system copes with fake news. This would be done by generating social media posts which are in grammatically correct language, but contain random words. The program would then look to see which posts were liked, passed on and positively rated. There are perhaps for-profit, and state based actors already doing this to attract clicks, or spread confusion.

Also, I suggest looking at the ethics and legal issues with detecting bugs. What systems should you test, and when you find a vulnerability what can (and should) you do with that information? With a quick search I found a recent paper on the Pentagon's Vulnerability Reward Program (Chatfield & Reddick, 2017).

Reference

Chatfield, A. T., & Reddick, C. G. (2017, June). Cybersecurity Innovation in Government: A Case Study of US Pentagon's Vulnerability Reward Program. In Proceedings of the 18th Annual International Conference on Digital Government Research (pp. 64-73). ACM. URL https://doi.org/10.1145/3085228.3085233

Reference

Chatfield, A. T., & Reddick, C. G. (2017, June). Cybersecurity Innovation in Government: A Case Study of US Pentagon's Vulnerability Reward Program. In Proceedings of the 18th Annual International Conference on Digital Government Research (pp. 64-73). ACM. URL https://doi.org/10.1145/3085228.3085233

ANU Cyber Reading Group

An "ANU Cyber Reading Group" organized by Dr Shane Magrath at the Australian national University's College of Engineering & Computer Science held its first meeting 31 May 2017. The first paper discussed was on Fuzzing,  a form of automated testing. Lockheed-Martin's Cyber Kill Chain was also discussed.

"Fuzzing is an approach to software testing where the system being tested is bombarded with test cases generated by another program. The system is then monitored for any flaws exposed by the processing of this input. While the fundamental principles of fuzzing have not changed since the term was first coined, the complexity of the mechanisms used to drive the fuzzing process have undergone significant evolutionary advances. This paper is a survey of the history of fuzzing, which attempts to identify significant features of fuzzers
and recent advances in their development, in order to discern the current state of the art in fuzzing technologies, and to extrapolate them into the future." From McNally, Yiu,  Grove & Gerhardy, 2012.

Last year I presented the ANU computer science students with a students with a Hypothetical on Cyberwar Over the South China Sea. ANU also offers courses in Cyber-intelligence and Security, Cyber Warfare Law, &  Cyber-security and Cybercrime.

References

McNally, Richard, Yiu, Ken,  Grove, Duncan, &
Gerhardy,  Damien (2012, February). Fuzzing: The State of the Art. Command, Control, Communications and Intelligence Division, Defence Science and Technology Organisation. DSTO–TN–1043 Retrieved from http://www.dtic.mil/dtic/tr/fulltext/u2/a558209.pdf