syssec_red_book

2.5. Horizontal Research Directions• The Cloud. An increasing amount of data and computing operationsis currently off-loaded to large-scale remote servers, collectively called“the cloud.” These servers, which provide reliable, easily-accessiblelong-term storage and high-capacity computing capabilities, are beingused both by individuals and by organizations to store their data andget some extra computing, if needed. Since cloud servers are a sharedresource outside the end user’s direct influence, they can easily be amajor security/privacy concern.2.5 Horizontal Research DirectionsAlthough each topic (including attacks, vulnerabilities, assets and domains) includesunderlying active research directions, there also exist horizontal researchdirections that can apply to most, if not all, of them. Such horizontal directionsmay include:• Usable security. In order to be adopted, any security solution has to beeasy to use, if not completely transparent, to the end user.• Authentication and Authorization. An integral part in providing securitysolutions is the ability to authenticate the user (or even both ends) ofa communication or transaction. If one of the end points can be spoofed,most security solutions will provide no protection at all.• Measuring security. It has been said that security is more of an Artrather than an exact Science. This is partly due to the fact that Securitycan not be accurately measured. Imagine, for example, what would itmean for a system to be 99% secure? How about 99.9% secure? Wouldthat be good? Would that be enough? Defining and measuring (evenaspects of) Security is going to be a challenging, but an important area.2.6 What If?To make sure that we introduce some “disruptive thinking”to this process, we formulated and asked long-term“what if?” questions. Such questions aim to introduceprovocative long-term investigations that will lead tofundamentally new thinking with respect to securityand privacy. Thus, instead of focusing on small evolutionaryimprovements in traditional areas of research,we open the door to disruptive revolutionary advancethat will create a agenda not for the next two, nor forthe next five, but for the next ten to twenty years.To give an example of such questions from various realms of science andengineering one would ask: “What if we run out of oil? How will we be able to15