SoK: Science, Security and the Elusive Goal of Security as a Scientific Pursuit

Cormac Herley, P. C. van Oorschot
2017 2017 IEEE Symposium on Security and Privacy (SP)  
The past ten years has seen increasing calls to make security research more "scientific". On the surface, most agree that this is desirable, given universal recognition of "science" as a positive force. However, we find that there is little clarity on what "scientific" means in the context of computer security research, or consensus on what a "Science of Security" should look like. We selectively review work in the history and philosophy of science and more recent work under the label "Science
more » ... f Security". We explore what has been done under the theme of relating science and security, put this in context with historical science, and offer observations and insights we hope may motivate further exploration and guidance. Among our findings are that practices on which the rest of science has reached consensus appear little used or recognized in security, and a pattern of methodological errors continues unaddressed. 1 Index Terms-computer security research; science of security; history of science; philosophy of science; connections between research and observable world.
doi:10.1109/sp.2017.38 dblp:conf/sp/HerleyO17 fatcat:tb34aq22vvh6ddpazd3g3azgzu