ISIS Blogs

Given that we are a group of students that want to be actively engaged in “security research”, I often ponder: What does the term “security research” mean to you? Some of us are into reverse engineering, some of us are into language-level security, some of us are into network-level detection and prevention. When I speak to anyone working in any of these fields, they will usually light up and go off on how the problem they are working on is a major component in solving problem X and problem X is one of the top reasons why the state of security is as poor as it is. Success is no longer protecting C, I, and A, but making executables with randomized address spaces, but creating IPS that block anything suspicious, or virtual machines that sandbox as much as possible.

I guess what I am trying to say is people sometimes lose track of the larger picture while working on specific problems. While specifics are arguably most important in correcting problems, people should not loose track of the larger picture.

Comments?