Trustworthiness: The degree to which an information system (including the information technology components that are used to build the system) can be expected to preserve the confidentiality, integrity, and availability of the information being processed, stored, or transmitted by the system across the full range of threats. A Trustworthy Information System is a system that is believed to be capable of operating within defined levels of risk despite the environmental disruptions, human errors, structural failures, and purposeful attacks that are expected to occur in its environment of operation.
—National Institute of Science and Technology, Computer Security Resource Center, “trustworthiness”
To increase users’ trust in the systems they use, there is a need to develop Trustworthy Systems. These systems must meet the needs of the system’s stakeholders with respect to security, privacy, reliability, and business integrity. The first major step in achieving trustworthiness is to properly and faithfully capture the stakeholders requirements. A requirement is something that the system must satisfy or a quality that the system must possess. A requirement is normally elicited from the system stakeholders, including its users, developers, and owners. Requirements should be specified before attempting to construct the system. If the correct requirements are not captured properly and faithfully, the correct system cannot be built.
—Encyclopedia of Information Science and Technology, “Modeling Security Requirements for Trustworthy Systems”
Engineering Trustworthy Systems contains 223 principles organized into 25 chapters. This article will address 10 of the most fundamental principles that span several important categories and will offer rationale and some guidance on application of those principles to design.
—CACM, “Engineering Trustworthy Systems: A Principled Approach to Cybersecurity“
The E.U. is an early mover in the race to regulate AI, and with the draft E.U. AI Act, it has adopted an assurance-based regulatory environment using yet-to-be-defined AI assurance standards.
Trust, Regulation, and Human-in-the-Loop AI: within the European region Read More
Human civilization does not tend to agree among issues such as fairness, equality, safety, security, privacy, and self-determination (for example). With COVID-19, economical well-being, health care, climate change, and other issues (some of which are considered here), if we cannot agree on the basic goals, we will never reach whatever they might have been—especially if the goals appear to compete with each other.
A Holistic View of Future Risks Read More
Students of cybersecurity must be students of cyberattacks and adversarial behavior.
Engineering Trustworthy Systems: A Principled Approach to Cybersecurity Read More
Communications of the ACM, November 2018
By Steven M. Bellovin, Peter G. Neumann
“Cryptography is an enormously useful concept for achieving trustworthy systems and networks; unfortunately, its effectiveness can be severely limited if it is not implemented in systems with sufficient trustworthiness.
It is time to get serious about the dearth of trustworthy systems and the lack of deeper understanding of the risks that result from continuing on a business-as-usual course.”
The Big Picture Read More