
Why "Following the Science" in Cybersecurity Is Misguided
Why âFollowing the Scienceâ in Cybersecurity Is Misguided
The phrase âfollow the scienceâ has become a rallying cry in modern discussions, often used to invoke the authority of experts and dismiss alternative perspectives. While this approach may work in structured fields like medicine or physics, its application to cybersecurity is fundamentally flawed. Unlike static disciplines grounded in controlled experiments, cybersecurity thrives on adaptability, practical experience, and real-world problem-solving. This article explores why relying solely on âfollowing the scienceâ in cybersecurity often misses the mark and highlights the importance of embracing diverse paths to innovation.
The Ever-Evolving Nature of Cyber Threats
Cybersecurity operates in a domain where adversaries constantly adapt, exploit vulnerabilities, and outpace defensive measures. Take IP spoofing, first detailed in Phrack1. This tactic showcased how attackers could impersonate trusted systems by falsifying IP addresses. The technique quickly evolved as countermeasures emerged, rendering traditional academic timelines inadequate. Peer-reviewed studies often take years to publish, while new threats emerge in days. By the time academia validates a solution, the attack vector may already be obsolete.
Practical examples abound. Aleph Oneâs seminal work âSmashing The Stack For Fun And Profitâ in Phrack2 provided a groundbreaking explanation of buffer overflows. This wasnât the product of academic rigor but of hands-on experimentation and real-world insight. Such works, later adopted by academia, highlight the necessity of creativity, intuition, and immediacyâqualities that structured scientific methods struggle to cultivate.
Pragmatism in Cybersecurity Practices
The best cybersecurity practices often arise from lessons learned during real-world breaches and insights shared informally among practitioners. Consider âPass the Hashâ attacks: first documented by Paul Ashton in 19973, this method exploited NTLM authentication protocols without needing plaintext passwords. Later, Hernan Ochoa expanded the concept, creating tools that automated and refined the attack. These innovations forced organizations to rethink their security models and demonstrated how field-driven discoveries often outpace academic solutions.
Industry-led innovations also illustrate this dynamic. Frameworks like MITRE ATT&CK, a catalog of adversary tactics, emerged from the collective knowledge of analysts confronting real threats. Similarly, Check Point Software Technologies, a pioneer in firewalls, was born from Gil Shwedâs practical initiative, not academic research. These examples underline how immediate needs drive impactful solutions in cybersecurity.
The Role (and Limits) of Academia
Academia plays a foundational role in areas like cryptography, where rigorous principles underpin advancements. RSA encryption and the Digital Signature Algorithm (DSA), for instance, stem from academic research. However, their real-world application from SSL/TLS deployments by Netscape to Bitcoinâs use of SHA-256ârelied on practitioners addressing practical challenges like scalability and evolving threats.
Interestingly, academia has also drawn on industry-led innovations. For example, the early development of intrusion detection systems (IDS) by companies like Haystack Labs provided the groundwork for academic research into anomaly detection and behavioral analysis. Similarly, private-sector advancements in machine learning for malware detection have influenced numerous academic studies that formalized and expanded upon these methods.
The gap between academia and industry often hinders progress. Researchers lack access to live data due to legal constraints, limiting actionable insights. Meanwhile, practitioners innovate rapidly to address pressing challenges. For instance, Googleâs Project Zero proactively uncovers vulnerabilities before attackers exploit them4, exemplifying how industry drives real-world security improvements.
Lessons from Other Disciplines
In other fields, such as medicine, practitioners often adapt on the fly when immediate solutions are needed. During the COVID-19 pandemic, doctors employed untested treatments like convalescent plasma therapy based on preliminary evidence. Similarly, cybersecurity professionals rely on frameworks like the NIST Cybersecurity Framework and battle-tested playbooks to counteract ransomware attacks. These scenarios highlight the importance of intuition, experience, and adaptability in high-stakes situations.
Moving Beyond âFollow the Scienceâ
The mantra âfollow the scienceâ often veers into dogma, elevating select expert opinions while stifling alternative ideas. Humanityâs greatest advancements frequently arise outside structured scientific systems. The Wright brothersâ first flight and the development of modern firewalls exemplify breakthroughs driven by necessity and ingenuity rather than academic rigor.
Positive examples of balanced approaches abound. The Cyber Threat Alliance (CTA) facilitates real-time threat intelligence sharing among industry leaders. Collaborative efforts between private firms and government agencies like the Cybersecurity and Infrastructure Security Agency (CISA) address critical vulnerabilities. Such initiatives underscore how diverse paths to innovationâfrom practitioner-led research to interdisciplinary collaborationâenhance cybersecurity.
Final Thoughts: A Pragmatic Path Forward
Cybersecurity is a battlefield, not a laboratory. The phrase âfollow the scienceâ, often wielded with almost religious fervor, oversimplifies complex realities. Real progress comes from embracing a diversity of approachesâintuition, practical problem-solving, and theoretical insights alike. By valuing real-world application over academic idealism, we can better secure the systems that underpin our modern lives. Letâs move beyond empty slogans and foster a culture that values ingenuity and adaptability in the face of ever-changing threats.
Footnotes
-
Phrack (Issue 48, âIP Spoofing Demystifiedâ, available at https://phrack.org/issues/48/14) [Accessed: 19.12.2024]. âŠ
-
Phrack (Issue 49, âSmashing The Stack For Fun And Profitâ, available at https://phrack.org/issues/49/14) [Accessed: 19.12.2024]. âŠ
-
Archived vulners article of Bugtraq available at https://vulners.com/exploitpack/EXPLOITPACK:6627273D3BFEC2A58E0A43C7D7DE2B75 [Accessed: 19.12.2024]. âŠ
-
Google Project Zero, available at https://googleprojectzero.blogspot.com [Accessed: 19.12.2024]. âŠ
You Might Also Like
Discover more articles related to your interests

Gmail AI Assistant: Convenient But Potentially Compromised
Exploring security vulnerabilities in Gmail AI features including indirect prompt injection and link trap risks, and the stance of Google on these issues

Challenges in Cyber Risk Management
Cybersecurity risk management is not easyâit is about managing assets, evolving threats, and building a culture of security.

The Door Wedge Is A Lesson in Cybersecurity
The common door wedge is a great analogy for cybersecurity: Learn more about balancing security and convenience, and how well-intentioned shortcuts can lead to unintended consequences.

Putting Numbers on Fuzzy Risks: The FAIR Approach
How to transform vague security risk assessments into quantifiable values you can use for business decisions using Factor Analysis of Information Risk (FAIR)