Morning keynote address by Ron Ritchey
Ronald W. Ritchey · Annual Information Security Symposium · 2009
Transcribed and edited by Jacques Thomas. The speaker was introduced by Joel Rasmus. Dr. Ron Ritchey and Booz Allen Hamilton (BAH), the company he works for, have had a relationship with CERIAS for the last couple of years now. This has been a very good relationship; one that has continued to grow. BAH does contracting for the government and for the IATAC, which does IA consulting and testing for governmental agencies and vendors. His work is of interest to a lot of us, with the unique perspective of working inside the government. Dr Ritchey, in addition to his duties with BAH and as chief scientist for the IATAC, also occasionally teaches at George Mason University in Fairfax, Virginia. We want to thank Dr. Ritchey for readily accepting our invitation to speak at the Symposium on his first visit to Purdue. As many of you know, one of Dr. Ritchey's colleagues, Admiral Mike McConnell, was supposed to participate in yesterday's fireside chat. Unfortunately, he could not attend it. Dr. Ritchey kindly substituted for him. We thank Dr. Ritchey for going above and beyond his commitments in helping this symposium be a success. Today's talk is a talk that Dr. Ritchey had in the works and proposed to finalize for the Symposium. When we asked him if he would like to come give a talk, we did not have to prompt him. He said he had this talk that he had been working on, and that would be good for me to go ahead and finish this talk. The gist of the talk clearly showed that it matched CERIAS's interest in security. We are sure that this talk will raise some eyebrows in the audience. Teaching as an adjunct faculty member, even at George Mason is a labor of love: the pay is not great, but the job definitely has rewards. One of these rewards is to see how bad a job we are doing as an industry in teaching people about security awareness. I teach a course on how to develop secure software. In my opinion, this is a 101 level course. At George Mason, it is listed as 600. The quality of the code at the beginning of each semester is interesting. Some code is very well structured and most of the code is not that bad, but the security awareness is not there. When you teach security awareness to the students, the quality of the code improves. Especially when you give them the techniques on what to watch for, and the methods and the mechanisms that can be used to avoid those challenges. This is not what this talk is about. This talk is about the end result, and what happens after you do that [give them the tools and techniques], even when we spend this time, a full semester, 15 weeks of concentrated effort.