No Silver Bullet : Inherent Limitations of Computer Security Technologies

Awareness of the need for secure systems has grown rapidly as computers have become increasingly pervasive in our society. Numerous computer security technologies have been proposed and implemented, but all of them fall short of providing the level of security most organizations and endusers expect. No current technology, whether used in isolation or used together with other measures, fully addresses the problems associated with insecure computing platforms. Further, it is not likely that any technologies in the near future will be developed that, by themselves, will fix these problems. By examining the inherent problems in securing computers, this paper shows why it is unlikely that any silver bullet will be found that will fully address the problem in the foreseeable future. This paper also discusses some current technologies and shows why they do not adequately address these issues. It concludes with an assessment of evolutionary change and proposes approaches that may produce incremental improvements.