Providing security with insecure systems

Andrew Odlyzko
School of Mathematics, University of Minnesota
Wednesday, April 13, 2011

Co-sponsored by ISTS and the Computer Science Department

Abstract

Andrew Odlyzko University of Minnesota

Network security is terrible, and we are constantly threatened with the prospect of imminent doom. Yet such warnings have been common for the last two decades. In spite of that, the situation has not gotten any better. On the other hand, there have not been any great disasters either. To understand this paradox, we need to consider not just the technology, but also the economics, sociology, and psychology of security. Any technology that requires care from millions of people, most very unsophisticated in technical issues, will be limited in its effectiveness by what those people are willing and able to do.

This suggests that one can provide adequate security using contrarian approaches that violate traditional security and system engineering precepts (such as encouraging "spaghetti code").

Bio

Andrew Odlyzko has had a long career in research and research management at Bell Labs, AT&T Labs, and most recently at the University of Minnesota, where he built an interdisciplinary research center, and is now a Professor in the School of Mathematics. He has written over 150 technical papers in computational complexity, cryptography, number theory, combinatorics, coding theory, analysis, probability theory, and related fields. In recent years he has also been working in electronic commerce, economics of data networks, and economic history, especially on diffusion of technological innovation.

More information, including papers and presentation decks, is available on his web site, http://www.dtc.umn.edu/~odlyzko/.

• Presentation slides