Schneier on Security

Anonymous • May 5, 2008 8:03 PM

In my intro to engineering class (some years back now), I learned something about engineering:

“Engineering is the art of applying mathematics to the solution of real world problems.”

Our class, like others before and after us, went over that definition in some depth. It’s a compact description –perhaps even elegant– and there’s enough packed into it to make a good hour-long lecture.

I’m sorry, but I don’t think security “engineering” is an engineering discipline yet. It may be an art, with a recognized body of knowledge common among practitioners, but it’s still too much black art and too little mathematics.

Imho.

Anonymous • May 6, 2008 9:02 AM

“I’ve always thought of engineering being the application of (repeatable) science to the solution of real world problems.”

@anon,

I don’t think we’re disagreeing in substance. There might be a slight difference in superfical style or emphasis.

The word “mathematics” is the one I do remember from my introductory lecture–but perhaps that word choice is part of the reason the compact description takes some commentary to unfold.

In my comment above, I almost used the phrase “mathematical models”. Implicit in the idea of “applying mathematics” is the idea that there is an acceptable model of a real-world phenomen.

Those mathematical models must originate from repeatable science.

It’s precisely the lack of modelling that I’m criticizing in security “engineering”.

When Bruce criticizes the TSA, for instance, as he does often enough here on this blog, he doesn’t usually make what I would consider “engineering” criticisms. That is, he doesn’t say “here is a validated model for air transport security” and “here is the result of my calculations based on that model”. No one does that. Because, in all honesty, we don’t know how yet. The underlying security science isn’t there yet to be turned into engineering art.