Unfalsifiability of security claims

Abstract

There is an inherent asymmetry in computer security: Things can be declared insecure by observation, but not the reverse. There is no observation that allows us to declare an arbitrary system or technique secure. We show that this implies that claims of necessary conditions for security (and sufficient conditions for insecurity) are unfalsifiable. This in turn implies an asymmetry in self-correction: Whereas the claim that countermeasures are sufficient is always subject to correction, the claim that they are necessary is not. Thus, the response to new information can only be to ratchet upward: Newly observed or speculated attack capabilities can argue a countermeasure in, but no possible observation argues one out. Further, when justifications are unfalsifiable, deciding the relative importance of defensive measures reduces to a subjective comparison of assumptions. Relying on such claims is the source of two problems: once we go wrong we stay wrong and errors accumulate, and we have no systematic way to rank or prioritize measures.A theory which is not refutable by any conceivable event is nonscientific. Irrefutability is not a virtue of a theory (as people often think) but a vice. (1) K. Popper, Conjectures and Refutations

OASIS: Weakening User Obligations for Security-critical Systems

“…Research in the eld of usable security has argued that the deviation of user behaviour is o en justi ed because many of these instructions are arbitrary (e.g., mixing of character types in passwords), unrealistic (e.g., requiring di erent passwords for each account [2]), ine ective (e.g., users having to change passwords every 90 days leads to weaker passwords [3]), or cumbersome (e.g., requiring users to con rm before every critical action). Security mechanisms can therefore cause friction in the way users want to interact with systems, and their usability is therefore critical for their acceptance by users (and ultimately their e ectiveness).…”

On Security Singularities

“…We may be able to speculate about their likelihood, but that's about it. Like many other claims in the security domain, claims on possible singularities are inherently counterfactual [18,19], making it hard to refute such claims on scientific grounds.…”

The man-machine integration era

“…Without taking this argument too far (right at the line is Herley's epistemological unfalsifiability of security claims [25]), our main point is that there are foundational scientific challenges that need to be resolved first before any results can be translated to the operational arena.…”