Privacy issues in an insecure world

• Main Author: Strayer, W.T.
• Format: Conference Proceeding
• Language: English
• Subjects: Authentication; Authorization; Computer networks; Computerized monitoring; Condition monitoring; Current measurement; Intrusion detection; Privacy; Protection; Watches
• DOI: 10.1109/NCA.2003.1201151

We all have a notion of privacy and understand that we trade some of it away in order to have normal social interactions and communal security. Networked computer systems are no different. The notion of privacy is running squarely against the need for security in an increasingly networked world. Is it possible to have secure systems that honor privacy? There are two basic ways to secure a network: prevent bad things from happening, and watch closely for bad things and prosecute those who commit them. Since our current preventative measures like authentication and authorization seem to be failing to adequately protect the network, we have turned more toward auditing and monitoring-first as a complement, and now increasingly as a substitute-for prevention. I discuss the impact security concerns is having on privacy, and suggest that today's trend of solving security by detecting intrusions through monitoring is a reaction to institutional paranoia as well as woefully inadequate software development processes. I argue that monitoring alone can't provide sufficient protection, and that in fact the trend of relying increasingly on intrusion detection systems tells us that we are really losing ground-not gaining-on providing computer security.