Purpose -This paper aims to report on the results of an analysis of the computer security problem space, to suggest the areas with highest potential for making progress in the attacker-defender game, and to propose questions for future research. Design/methodology/approach -The decomposition of the attacker-defender game into technological, human, and social factors enables one to analyze the concentration of public research efforts by defenders. First, representative activities are selected, then each activity is mapped into the technological, human and social (THS) basis. Afterwards, citation databases are used to estimate the relative volume of publications on each selected activity in the science and engineering communities. Finally, drawing on a number of relevant theories in organizational theory, sociology, and political science, avenues for exploring the social dimension by the defenders are discussed. Findings -The analysis suggests that over 94 percent of the public research in computer security has been concentrated on technological advances. Yet attackers seem to employ more and more human and social factors in their attacks. The social organization of the attackers allows them to achieve the results not possible otherwise, shifting the balance in their favour. It is suggested that the scope of research should be broadened, to involve organizational behavior and structure as well as social capital aspects that are currently not high on computer security research agenda. Research limitations/implications -The queries limit the search to public content written in the English language only. Since the authors are concerned with the relative (rather than absolute) volume of each activity, it is an open question whether this limitation biases the results. Practical implications -As the arms race in computer security progresses, social factors may become or already are increasingly important. The side that capitalizes on them sooner may gain the competitive advantage. Originality/value -A simple method for gauging the focus of research efforts in the computer security community and for considering computer security problem space through the lens of social sciences is developed. Paper type Viewpoint The current issue and full text archive of this journal is available at www.emeraldinsight.com/0968-5227.htm The authors would like to thank anonymous reviewers for their constructive and helpful comments, Lee Iverson for feedback on an earlier version of this paper, and Craig Wilson for improving the readability of this paper. This paper reports on the results of our analysis of the computer security problem space and suggests the areas with highest potential for making progress in the attacker-defender game. To analyze the problem space, we qualitatively decomposed the major activities in computer security on the basis of technological, human, and social (THS) factors, then estimated the proportions of these activities in research on science and engineering world-wide as well as the attention to them paid by the press. We use the term "activity" instead of "area" or "functionality" (or similar terms) to highlight our focus on offensive (e.g. social engineering, phishing) and defensive (e.g. cryptography, intrusion detection, information assurance, access control) practices, as well as those aspects of computer security that can be employed by either side (e.g. economics and politics of security). Our simple, but hopefully symptomatic, estimation of world-wide research activities related to several major areas of computer security indicates that over 94 percent of these activities have so far concentrated on the technological dimension (e.g. cryptography, access control, intrusion detection, malware). Activities focused on the human and social aspects of the security problem account for less than 6 percent in total. Although the way we estimated the volumes is unlikely to sustain any criticism from statisticians, we do believe the results are representative. These results, for one, underscore the popular notion that in the last 40 years, progress in computer security has been mostly due to technological advances. The results of our queries on Google News Archives -which indicate that "public" opinion rates social and human dimensions of security significantly higher than the share of the corresponding public research -point at least to the mismatch between the public concerns and the focus of the researchers. Drawing on recent results from other disciplines, we believe that as the computer security arms race progresses, social factors may become increasingly important. In fact, the next big spiral in this arms race may very well be due to advances in the social dimension. Arguably, potential advantages of the social dimension have already been exploited by attackers, as demonstrated by numerous cases of social engineering (Mitnick et al., 2002; Gordon, 1995). It is not clear who, attackers or defenders, will take the lead. The other side will have to catch up. The rest of the paper is organized as follows. Section 2 describes our analysis of the computer security problem space and discusses the expected consequences of the identified imbalance. Section 3 discusses social dimensions of computer security and considers the application of some methods and results from social sciences to it. Section 4 discusses avenues for future research. Section 5 concludes the paper.
Recently, this focus on technical factors was confirmed via a literature survey comparing the relative amounts of IT security research focused on each of technological, human, and social factors REF .
On the imbalance of the security problem space and its expected consequences
Inf. Manag. Comput. Security
Inf. Manag. Comput. Security
Computer Science