Abstract. The success and scale of the modern tech industry wouldn't be possible if computers didn't (mostly) operate securely and reliably. Computer Security deserves considerable credit for this success: in spite of the enormous energy and ingenuity of attackers, the carelessness of users, and a never-ending stream of bugs and zero-days things mostly work out. And yet, it's hard not to wonder whether we might do better. Not only do we lack the structure of the hard Sciences, but also many of the softer ones. We seem to revisit certain questions over and over without decision or progress. Security looks like a mess even compared to other CS disciplines such as Machine Learning. We argue that this is not inevitable, has nothing to do with the newness of the field, or factors unique to security. While we are unlikely to end up with anything resembling Physics, we argue that improvement is possible; there are well-established practices from other discplines that we can take to make the field less unscientific. Doing so involves exiting some comfort zones, recognizing that Science offers no path to certainty, and letting go of the idea that security is somehow exceptional or exempted from rules that apply everywhere else.

Bio. Cormac Herley is at Microsoft Research. His main current interests are statistics, and machine learning for combatting fraud and abuse. He has published widely in the areas of authentication, Usable Security, ML for security, the Economics of Computer Security, and Philosophy of Security. He is inventor of 70 or so US patents and regularly ships technologies protecting hundreds of millions of users. His recommendations on passwords (eg, no composition rules or forced 90-day rotation) were adopted by NIST and much of the industry. He received the PhD degree from Columbia University, the MSEE from Georgia Tech, and the BE(Elect) from the National University of Ireland.

Simon Koch (University of Innsbruck), Jannik Hartung (Technische Universität Braunschweig), Rainer Böhme (University of Innsbruck), David Klein (Max Planck Institute for Security and Privacy)

Nele Borgert (University of Bern), Tim Ulmann (University of Bern), Robin Merchel (Ruhr University Bochum)

Rachel Gonzalez Rodriguez (Paderborn Univerisity), Harshini Sri Ramulu (Paderborn University), Yasemin Acar (Paderborn University & George Washington University)

Tiago Heinrich (Max Planck Institute for Informatics), Sebastian Giessler (Universität Tübingen), David Klein (Max Planck Institute for Security and Privacy), Alexandra Dirksen (University of Twente)

Madhav Khanal (Rollins College), Jasser Jasser (Rollins College), Mina Basirat (University of Central Florida)

Jelena Mirkovic (USC-ISI), David Balenson (USC-ISI)

Gianluca Stringhini (Boston University), Jeremy Blackburn (Binghamton University)

Henry Hosseini (Institute for Internet Security, Westphalian University of Applied Sciences; Department of Information Systems, University of Münster), Christian Böttger (Institute for Internet Security, Westphalian University of Applied Sciences), Nurullah Demir (Stanford University), Tobias Urban (Institute for Internet Security, Westphalian University of Applied Sciences)

Ruta Binkyte (CISPA Helmholtz Center for Information Security), Sharif Abuadbba (Data61, CSIRO), Chamikara Mahawaga Arachchige (Data61, CSIRO), Ming Ding (Data61, CSIRO), Natasha Fernandes (Macquarie University), Mario Fritz (CISPA Helmholtz Center for Information Security)

Juliane Schmüser (CISPA Helmholtz Center for Information Security), Jan-Ulrich Holtgrave (CISPA Helmholtz Center for Information Security), Florian Schaub (University of Michigan), Sascha Fahl (CISPA Helmholtz Center for Information Security)

Mohammad Einaam Alim (University of Alabama in Huntsville), Tommy Morris (University of Alabama in Huntsville)

Marton Bognar (DistriNet, KU Leuven), Lieven Desmet (DistriNet, KU Leuven), Frank Piessens (DistriNet, KU Leuven)

Nele Borgert (University of Bern), Luisa Jansen (University of Bern), Lukas Jung (University of Bern), Theresa Halbritter (University of Bern), Malte Elson (University of Bern)