University of Calgary
UofC Navigation

The Unfalsifiability of Security Claims, and what we can do about it

Date & Time:
October 8, 2015 | 2:00 pm
Biological Sciences, Room 587
Cormac Herley


There is an inherent asymmetry in computer security: things can be declared insecure by observation, but not the reverse; there is no test that allows us to declare an arbitrary system or technique secure. We show that this implies that claims of necessary conditions for security (and sufficient conditions for insecurity) are unfalsifiable (or untestable). This in turn implies an asymmetry in self-correction: while the claim that countermeasures are sufficient can always be refuted, the claim that they are necessary cannot.

If Science is self-correcting, then to do things scientifically we must be able to identify errors. We argue that progress has been slow in security precisely  because of a failure to identify mistakes. Bad ideas that have received no corroboration persist indefinitely and the resources they consume crowds out sensible measures to reduce harm. Many things that deliver no observed benefit are declared necessary for security, either because they have defined to be so, or have been reached through logically muddled arguments. We argue that a scientific approach to security is closer than we think, but it requires abandoning many long cherished beliefs.


Cormac Herley's main current interests are data analysis problems, authentication and the economics of information security. He has published widely in signal and image  processing, information theory, multimedia, networking and security.  He is the inventor on over 70 US patents, and has shipped technologies used by hundreds of millions of users. His research has been widely covered in outlets such as the Economist, NY Times, Washington Post, Wall St Journal, BBC, the Guardian, Wired and the Atlantic. He received the PhD degree from Columbia University, the MSEE from Georgia Tech, and the BE(Elect) from the National University of Ireland.

View Poster

View Fall 2015 Lecture Series Poster

View Photos