November 25, 2003 2:17 PM PST

U.S. funds study of tech monocultures

Related Stories

A 20-year plague

November 25, 2003

Gartner echoes concerns on Microsoft reliance

October 8, 2003

Report: Microsoft dominance poses security risk

September 24, 2003
The National Science Foundation has granted $750,000 to two universities to study how diversifying information systems and software could help fend off future cyberattacks, the agency said Tuesday.

The study, proposed by Carnegie Mellon University and the University of New Mexico almost a year ago, will seek to identify commonalities in software that could be used as the


Get Up to Speed on...
Enterprise security
Get the latest headlines and
company-specific news in our
expanded GUTS section.


basis for attacks. Such common vulnerabilities would point to a computer "monoculture"--a population so homogeneous that a single threat could destroy it.

"We are looking at computers the way a physician would look at genetically related patients, each susceptible to the same disorder," Mike Reiter, a professor of electrical and computer engineering and computer science at Carnegie Mellon, said in a statement. "In a more diverse population, one member may fall victim to a pathogen or disorder while another might not have the same vulnerability."

Massive digital epidemics--such as the Code Red, Slammer and MSBlast worms--have infected hundreds of thousands of computer systems, leaving scientists to wonder if worse is in store for the Internet.

The focus on computer monocultures is not new. In fact, the project echoes themes addressed in a controversial paper submitted by seven well-known security researchers, who warned that Microsoft's dominance in software could make possible a cyberattack that would be catastrophic for corporations. The paper, published by a Microsoft opponent, had been dismissed by some of the software giant's supporters as partial and based on weak science.

However, the monoculture issue has many historical antecedents outside of the computer industry and has been studied in other software engineering projects, according to the National Science Foundation announcement.

Earlier attempts at using diversity to hamper the spread of Internet threats used multiple development teams for the same software project, assuming that different teams would make different mistakes. That was expensive, the Carnegie Mellon and University of New Mexico researchers noted.

The researchers intend to create an application that could generate diversity in key aspects of software programs, thus making the same vulnerability less effective as a means of attack against the population as a whole.

"Our automated approach has the potential to be more economical and could introduce more diversity into computer systems," Stephanie Forrest, professor of computer science at the University of New Mexico, said in a statement.

The research could be good for Microsoft. In the end, the techniques the academic researchers develop could help the software giant and other organizations break up their monocultures without losing market share.

 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.