BY PETER G. NEUMANN
REFLECTIONS ON
COMPUTER-RELATED RISKS
Tracing the history of exposing and elucidating the wide variety of
system problems and associated social implications of uses and misuses
of computing technology.
Computer-related technologies have changed enormously over the years, with huge advances in
processor power and storage capacity, high-speed networking, and highly distributed systems.
Client-server and virtual-machine architectures seem to be simplifying implementation. Internet browsers have significantly raised the level of abstraction for attaining almost universal interoperability. Strong cryptography has become more widely available, and is becoming easier to use.
Improvements in static-analysis tools and formal methods are having visible results. Many ACM
members have been instrumental in some wonderful advances, and have been involved in important technological and social activities. For example, Parnas, Dijkstra, Hoare, Wirth, and many
others contributed to system architectures and programming practice. We have also experienced
significant advances in networking, graphics, and many other crucial areas.
Conversely, trustworthiness of operating systems and application software is generally
poor, particularly with respect to critical
requirements such as security, reliability, survivability, evolvability, maintainability, interoperability, and predictable upgradability. Common flaws
keep recurring—buffer overflows, faulty bounds
checks, and so on. Denial-of-service attacks are easily
created and deployed, but largely lacking adequate
defenses. Strong cryptography is difficult to embed
securely in systems and applications. Software engineering is still more of an ideal concept rather than a
disciplined practice; its principled precepts seem to be
widely ignored. The Internet has amplified the risks,
and seems to encourage various spams, scams, and
spoofs. Trustworthiness and particularly security are