Practicing a Science of Security

Our goal is to refocus the question about cybersecurity research from ‘is this process scienti c’ to ‘why is this scienti c process producing unsatisfactory results’. We focus on ve common complaints that claim cybersecurity is not or cannot be scienti c. Many of these complaints presume views associated with the philosophical school known as Logical Empiricism that more recent scholarship has largely modi ed or rejected. Modern philosophy of science, supported by mathematical modeling methods, provides constructive resources to mitigate all purported challenges to a science of security. Therefore, we argue the community currently practices a science of cybersecurity. A philosophy of science perspective suggests the following form of practice: structured observation to seek intelligible explanations of phenomena, evaluating explanations in many ways, with specialized elds (including engineering and forensics) constraining explanations within their own expertise, intertranslating where necessary. A natural question to pursue in future work is how collecting, evaluating, and analyzing evidence for such explanations is di erent in security than other sciences.