Tuesday, April 21, 2015 at 12:00 pm
There is no silver bullet for defending computer systems. Strengthening security means negotiating a balance among a variety of defenses that fall into several different categories and rely on the cooperation and support of many different actors, including technologists, managers, and policy-makers. Therefore, one crucial element of security involves understanding the multiplicity of defenses and the ways they can be combined and recombined to protect systems. Yet, there is no clear model of how different classes of computer system defense relate to classes of attack, or what defensive functions are best suited to technical, policy, or managerial interventions. Drawing on case studies of actual security incidents, as well as the past decade of security incident data at MIT, this talk will analyze security roles and defense design patterns for application designers, administrators, and policy-makers. It will also discuss the interplay between defenses designed to limit access to computer systems and those oriented towards limiting and mitigating the resulting damage.
About Josephine
Josephine is a PhD candidate in the Engineering Systems Division at MIT studying cybersecurity and Internet policy. Her dissertation research focuses on understanding combinations of different types of defenses for computer systems, including the interactions among technical, social, and policy mechanisms. She has interned with Microsoft's Technology Policy Group, the Center for Democracy & Technology, the White House Office of Science and Technology Policy, and the Department of Defense. She has also written on computer security topics for Slate, Scientific American, and Newsweek. She holds an AB in mathematics from Princeton University, and an SM in Technology & Policy from MIT.