Search

The article discusses how the field of computer science and computer sciences can utilize technological innovations to improve the public's trust in the results of elections. It examines hacking, election forensics, and voting system testing mechanisms. The article also discusses the processes associated with election audits and recounts, oversight by the U.S. Cybersecurity and Infrastructure Agency (CISA), and cryptography.

The article discusses business risks when dealing with self-auditing systems. The risk of limited objectivity and lack of oversight with internal audits is described, security vulnerabilities allegedly associated with Transport Layer Security systems are analyzed, and information is offered on the computer security implications of the recall of vehicles from the Volkswagen auto company. Electronic voting is also discussed.

Costs related to computer security are often difficult to assess, in part because accurate metrics have been inherently unrealistic. Of those costs that can be measured, the largest in terms of monetary value typically involve theft of proprietary information or financial fraud. Others that are more difficult to quantify but have resulted in severe loss of use or productivity include viruses and malware, Web server denial-of-service attacks, abuse of access privileges and equipment vandalism or outright theft. Results of surveys of organizations providing estimates as to breach incidents, security expenditures, malicious code and so on, with numbers continuing to reflect dramatic growth each year. However, lacking any way to translate such statistics into expenditures and losses per organization, per computer, or per user, the true impact of these figures remains uncertain. Industry traditionally has seemed willing to write off some level of computation service down-time and loss of access to data and equipment as a "matter of course," but as such services and information have become increasingly critical to business and everyday operations, this casual attitude may soon be unacceptable.

The current auditing crisis of big business can provide useful lessons and suggestions for improving similar practices within the computer industry. Audit trails, whether computer-based or manually produced, typically form a significant part of the front-line defense for fraud detection and prevention within systems. Many of the security practices revolve around the generation and preservation of authenticated data streams that are to be perused routinely or periodically, as well as in the event of system attack, failure, or other investigations. But these audit trail systems are not necessarily robust, since components can be subverted or ignored. Furthermore, it is the surrounding controls or overriding design-and-use philosophies, that are often discovered to be inadequate or circumvented. Audit trails, whether computer-based or manually produced, typically form a significant part of the front-line defense for fraud detection and prevention within systems. It is incumbent upon us to examine our own auditing practices for their intrinsic vulnerabilities.

Consider a computer product specification with data input, tabulation, reporting, and audit capabilities. The read error must not exceed one in a million, although the input device is allowed to […]

A letter to the editor is presented in response to the article "The Risks of Self-Auditing Systems," by Rebecca T. Mercuri and Peter G. Neumann is presented, which was presented in the June 2016 issue.

Presents a letter to the editor concerning the article "The Business of Software," by Phillip G. Armours, published in the March 2004 issue of the journal "Communications of the ACM."

Presents a response from the author to a letter to the editor concerning his article "Security Watch," published in the March 2004 issue of the journal "Communications of the ACM."