Group:
security
Topic:
commitment
Topic:
database security
Topic:
distributed system security
Topic:
ethics
Topic:
responsibility
Topic:
rules
Topic:
security of remotely executed code
| |
Summary
Trust is holding that others will act in certain ways. This allows us to predict events and perform actions of our own. Trust is what makes action possible. Without it, there is no basis for prediction and any action can be disastrous.
Trust is difficult to obtain in computerized systems. One problem is that source code can not be trusted because the translation from source to executable can change the semantics of the code arbitrarily. Verification does not produce trustworthy systems because it only tests the consistent between various aspects of the system description. Verification does not catch oversights nor identify all cases. Verification is still important, but it most be backed by extensive testing and sound principles of software design and development. (cbb 5/94)
Subtopic: trust in knowledge 
| Quote: some truths are known only by trust; e.g., Rome is a big city, or this person is my mother
|
Subtopic: trust users
| Quote: security is a lot easier if you assume trusted and intelligent users; for the most part, insiders are your allies [»schnB_2000]
|
Subtopic: trust in banking
| Quote: in electronic banking, valid transactions depend on an agreement between bank and the depositor [»hewiC4_1985]
|
Subtopic: trust of servers
| Quote: domain and organization clearinghouses share information freely; trust is assumed among servers [»oppeDC10_1981]
| | Quote: for Clearinghouse servers, trust is an equivalence relation (commutative and transitive); simplifies access control [»oppeDC10_1981]
|
Subtopic: trusted intermediary
| Quote: use a trustworthy intermediary for secure information flow; e.g., a low-level host places a file in a secure store for reading by a high-level host [»rushJ7_1983]
| | Quote: a secure OS needs a trusted path to trusted software that cannot be impersonated; is a login screen valid?
|
Subtopic: trusted documents
| Quote: trusted authorities could certify quality numbers for certain classes of documents [»dennPJ3_1982]
| | Quote: a covenant is a contract involving trust; it was the will of him that was trusted, to perform as expected
|
Subtopic: trust seals
| Quote: if the porter only admits people with invitations, we trust that admitted people have an invitation [»lost entries]
| | Quote: with seals, users don't have to trust the computer system and its administrators, and can freely distribute; good for distributed systems [»giffDK4_1982]
|
Subtopic: trust and doubt
| Quote: we can always imagine a doubt; e.g., of someone who believes an abyss may open up, but the doubt is not held by most [»wittL_1958a]
|
Subtopic: trust in code
| Quote: the proper product of programming is arguments that a program is a trustworthy solution [»dijkEW_1982]
| | Quote: a verified program is provably corrected but not reliable and trustworthy; no information about limits [»demiRA5_1979]
| | Quote: correct code by using sound principles during design, verification by analysis, and exhaustive testing of small cases [»bentJ10_1983]
| | Quote: with Java, new code starts untrusted, becomes verified, then transformed into machine code by a trusted compiler [»allmE7_2004]
|
Subtopic: problems with trusting code
| Quote: you can only trust code that you create; source-level verification or scrutiny can not catch unsecure code [»thomK8_1984]
| | Quote: if you treat machines as people, then may end up treating people like machines; devalues emotions, creativity, individuality, trust [»shneB1_1993]
|
Subtopic: trust no one
| Quote: constantly question security; question your assumptions; question your decisions; trust no one, especially yourself [»schnB_2000]
| | Quote: be vigilant; for detection and response to be effective, it must work always; be prepared for an attack [»schnB_2000]
| Quote: for good security, watch the watchers; e.g., banks and casinos
[»schnB_2000]
|
Related Topics
Group: security (23 topics, 874 quotes)
Topic: commitment (31 items)
Topic: database security (12 items)
Topic: distributed system security (17 items)
Topic: ethics (46 items)
Topic: responsibility (12 items)
Topic: rules (43 items)
Topic: security of remotely executed code
(24 items)
|
