Invited Talk What *is* Information Security? Gene Spafford Purdue University spaf@cerias.purdue.edu Abstract Recent events have increasingly focused public attention on issues of information privacy, computer and network security, cybercrime and cyber terrorism. Yet despite all of this attention, there is some confusion about what is actually encompassed by those terms. There are some obvious components, such as cryptography and access control. However, the list of undisputed topics is not long or well-developed, and many questions arise as to whether a typical computer science department can offer all of the topics involved. That there are only a few universities that teach a comprehensive curriculum in these topics serves to illustrate the imprecise nature of the field. Many professionals have taken to describing it as œinformation security  or œinformation assurance  to distinguish that the focus is not on computers and networks, but on the information they hold and process. This talk will present a more comprehensive view of the area than simply within the confines of CS/CE. The speaker has been teaching information security for nearly 20 years and has developed a view that spans many traditional disciplines. The talk will present some of the reasons for that breadth of view, illustrated with examples taken from the recent CRA Grand Challenges Conference on Information Security. One conclusion from this talk is that getting good information security education widely implemented may not be simple, given current constraints and traditions within academia. Bio Eugene H. Spafford is a professor of Computer Sciences at Purdue University, a professor of Philosophy (courtesy appointment), a professor of Communication (courtesy), a professor of Electrical and Computer Engineering (courtesy), and is Executive Director of the Center for Education and Research in Information Assurance and Security. CERIAS is a campus-wide multi-disciplinary Center, with a broadly-focused mission to explore issues related to protecting information and information resources. Spaf has written extensively about information security, cybercrime, software engineering, and professional ethics. Dr. Spafford is a Fellow of the ACM, Fellow of the AAAS, Fellow of the IEEE, and is a charter recipient of the Computer Society ™s Golden Core award. In 2000, he was named as a CISSP, honoris causa. He was the year 2000 recipient of the NIST/NCSC National Computer Systems Security Award, generally regarded as the field ™s most significant honor in information security research. In 2001, he was named as one of the recipients of the œCharles B. Murphy  awards and named as a Fellow of the Purdue Teaching Academy, and in 2003 was named to the œBook of Great Teachers  -- thus receiving all three of the University ™s highest awards for outstanding teaching. In 2001, he was elected to the ISSA Hall of Fame, and he was awarded the William Hugh Murray medal of the NCISSE for his contributions to research and education in infosec. He is a 2003 recipient of the Air Force medal for Meritorious Civilian Service. Among his many activities, Spaf is co-chair of the ACM ™s U.S. Public Policy Committee, is a member of the Board of Directors of the Computing Research Association, and is a member of the President ™s Information Technology Advisory Council (PITAC). More information may be found at . In his spare time, Spaf wonders why he has no spare time. Copyright is held by the author/owner(s). SIGCSE ™04, March 3 “7, 2004, Norfolk, Virginia, USA. ACM 1-58113-798-2/04/0003.

/lp/association-for-computing-machinery/what-is-information-security-u09hqoU4lp