Toward Fail Safety for Security Decisions
IEEE Security & Privacy · 2021
I was thinking about what I wanted to write about for my first editorial in IEEE Security & Privacy, when I came across this statement in the 2019 Application Security Risk Report by Micro Focus1 (free, but it requires registration): “Because people are prone to error, manual security tasks that can otherwise be automated are at risk of being done incorrectly.” While this is not a surprising statement in and of itself, it reminded me of the many ad hoc decisions being made by people in various roles in computing systems—from programmers to administrators to end users—that we require to be correct for a system to achieve security goals.