论文标题
开源安全测试方法手册的空缺
The Vacuity of the Open Source Security Testing Methodology Manual
论文作者
论文摘要
开源安全测试方法手册（OSSTMM）提供了一种“科学方法论，用于准确表征操作安全性” [HER10，p.13]。它在针对安全测试专业人士（例如教科书，标准和学术论文）的著作中广泛引用。在这项工作中，我们提供了对OSSTMM的基本批评，并认为它无法兑现其对实际安全的承诺。我们的贡献是三倍，并以对这种方法的文本批评为基础。首先，OSSTMM的中心原则是，可以将安全性理解为一个或多或少具有的数量。我们展示了为什么这是错误的以及OSSTMM的统一安全分数RAV是一个空的抽象。其次，OSSTMM通过将风险替换为信任度量标准来忽略风险，该指标将多个信任定义混淆，因此产生了毫无意义的分数。最后，奥斯特姆（Osstmm）因关注人类安全而受到赞誉。然而，它将所有人类代理都是一种安全威胁，需要不断受到监控和控制。因此，我们认为OSSTMM既不适合目的，也不能挽救它，因此应由安全专业人员放弃。
The Open Source Security Testing Methodology Manual (OSSTMM) provides a "scientific methodology for the accurate characterization of operational security" [Her10, p.13]. It is extensively referenced in writings aimed at security testing professionals such as textbooks, standards and academic papers. In this work we offer a fundamental critique of OSSTMM and argue that it fails to deliver on its promise of actual security. Our contribution is threefold and builds on a textual critique of this methodology. First, OSSTMM's central principle is that security can be understood as a quantity of which an entity has more or less. We show why this is wrong and how OSSTMM's unified security score, the rav, is an empty abstraction. Second, OSSTMM disregards risk by replacing it with a trust metric which confuses multiple definitions of trust and, as a result, produces a meaningless score. Finally, OSSTMM has been hailed for its attention to human security. Yet it understands all human agency as a security threat that needs to be constantly monitored and controlled. Thus, we argue that OSSTMM is neither fit for purpose nor can it be salvaged, and it should be abandoned by security professionals.
