• Akamai’s operations center can monitor attacks, but there is no definitive way of gauging how secure the network is.
  • Intelligent Machines

    Measuring Security

    There’s really no way to compare two computers running two different operating systems, Web browsers, or any other type of program and definitively say which one is more secure. That makes it hard for governments and businesses to decide how best to spend money on security–or even how much they should spend in the first place. It’s difficult to know whether a security product is effective or just has good marketing.

    Consider virus scanners. They automatically examine files for malicious software, but they can only detect malware that’s already been identified. So a scanner can’t say that a computer system has zero viruses–it can just say that a system doesn’t have any of the viruses the scanner was designed to catch. But unknown pieces of malicious code have been responsible for many of the most devastating attacks to date, including the much-publicized attack on Google earlier this year.

    This story is part of our July/August 2010 Issue
    See the rest of the issue
    Subscribe

    It used to be that there were surefire ways to know your system had been hacked. Files would be deleted; attackers would alter your website or make your system crash and ask for ransom. Today, however, the goal is to steal information or take control of a computer without tipping off users. Because many attacks go unnoticed, there are no truly reliable statistics about how many computers are compromised, let alone statistics that can measure the full economic impact of these intrusions.

    And yet people are trying. Research projects at the Idaho National Laboratory, the U.S. Department of Defense-sponsored Institute for Defense Analyses, and MIT Lincoln Laboratory are all attempts to develop ways of measuring security. If these projects can successfully create a set of standardized metrics, it will be easier for companies that create good products to reap a return on their investments in research and development, rather than competing on a level playing field with those who simply have a huge marketing budget and those who are selling snake oil. In the meantime, the attackers gain ground.

    Tech Obsessive?
    Become an Insider to get the story behind the story — and before anyone else.

    Subscribe today

    Uh oh–you've read all of your free articles for this month.

    Insider Premium
    $179.95/yr US PRICE

    More from Intelligent Machines

    Artificial intelligence and robots are transforming how we work and live.

    Want more award-winning journalism? Subscribe to Insider Premium.
    • Insider Premium {! insider.prices.premium !}*

      {! insider.display.menuOptionsLabel !}

      Our award winning magazine, unlimited access to our story archive, special discounts to MIT Technology Review Events, and exclusive content.

      See details+

      What's Included

      Bimonthly home delivery and unlimited 24/7 access to MIT Technology Review’s website.

      The Download. Our daily newsletter of what's important in technology and innovation.

      Access to the Magazine archive. Over 24,000 articles going back to 1899 at your fingertips.

      Special Discounts to select partner offerings

      Discount to MIT Technology Review events

      Ad-free web experience

      First Look. Exclusive early access to stories.

      Insider Conversations. Listen in as our editors talk to innovators from around the world.

    /
    You've read all of your free articles this month. This is your last free article this month. You've read of free articles this month. or  for unlimited online access.