Realizing scientific methods for cyber security
Thomas E. Carroll, David O. Manz, Thomas W. Edgar, Frank L. Greitzer · 2012
There is little doubt among cyber security researchers about the lack of rigor underlying much of the scientific literature. The issues are manifold and are well documented. Much of the problem lies with insufficient scientific methods. Cyber security exists at the frontier between the operations of machines and the behaviors and actions of users. While we inherit the challenges of computer and social sciences, we also must face a variety of new issues that are unique to cyber security. In this paper we discuss the challenges created by the need for rigorous cyber security science. We review the methods used by other sciences and discuss how they relate to cyber security. This paper is by no means comprehensive: its purpose is to foster discussion in the community on how we can improve rigor in cyber security science.