Re: Security Policy methodologies

["Marcus J. Ranum" <mjr () nfr net>]

Aleph One wrote:
> I suggest you read John D. Howard's PhD dissertation, "An Analysis Of
> Security Incidents On The Internet 1989 - 1995".

the URL is:
http://www.cert.org/research/JHThesis/

it's a pretty big document and indeed might serve as a cure for
certain forms of insomnia. It's a bit heavy on the CERT(r)/CC
viewpoint, which is understandable, but seeing the (r) gets
visually tiresome. It DOES give incident and false alarm
report frequencies for CERT, which is cool. Things get interesting
around Chapt 7. The appendixes are interesting.

mjr.
--
Marcus J. Ranum, CEO, Network Flight Recorder, Inc.
work - http://www.nfr.net
home - http://www.clark.net/pub/mjr