Computer security differences for accidental and intentionally caused losses

Research papers generally treat the problem of computer security as an intentional act to be solved by intellectually challenging methods such as encryption, descriptor-based systems, and program proving. Accidental and intentional acts are almost always referred to simultaneously; however, the safeguards are designed strictly to prevent intentional acts. It is generally thought that the same safeguards and strategies will be effective against both accidental and intentional acts. This is not necessarily true. In a paper on security assessment by Glaseman, Tum and Gaines ,1 accidental and intentional differences are not stated but are made subservient to the question of exploitation of vulnerabilities. As with most research papers on security, important research issues are discussed but they are oriented principally to intentional acts. This is evident in use of terms such as "intruder," "attacks," and "exploit," but no discussion penetrates research needs for errors, omissions and other accidents. In contrast, Courtney states in a paper on risk assessment: 2