Error processing SSI file
Error processing SSI file

12/27/00- Updated 09:55 PM ET
Error processing SSI file

Eugene Spafford: Security visionary

By M.J. Zuckerman, USA TODAY

In the world of computer security, where there is a new product or pitchman around every corner, Eugene Spafford is one of the few unbiased voices, an academic with the rare ability to reduce complex matters to simple, human terms. Advocacy groups, the FBI, corporate CEOs — even the president of the United States — have turned to him for the unvarnished truth.

READ MORE (below)

Related stories

Getting personal with Pamela Samuelson
Sounding the cyber-rights alarm
Ray Dolby: Audio innovator
Mika Salmi: Net entertainment entrepreneur


People to watch in 2001


So when Spafford, 44, says he has an idea, people listen.

In 2001, Spafford launches a first-of-its-kind master's degree program at Purdue University, where he has taught for 14 years. It combines computer science with the liberal arts, propelling students into the high-tech world knowing ethics as well as electronics, psychology in addition to science.

The curriculum includes computer and electrical engineering, computer science and systems technology, plus communications, education, English literature, management, political science, psychology and philosophy.

Why burden graduate students with philosophy when they're already staggering under the increasing demands of technology? "If we try to impose technological solutions as the only control on people, it will fail," he says. "When I speak to my colleagues in other disciplines, I see new solutions to problems."

Spafford says the "security landscape," with viruses, malicious hackers and insecure system designs, "is going to get worse before it gets better." The problem? "Simple human nature, not shortfalls in technology.

"If you work with computer and network security long enough, you realize that the biggest problem is people. The people who design the software, the people who deploy it, the people who use the systems, the people who abuse the systems, and sometimes the people who guard the systems."

He points to organizations and individuals who spend fortunes on virus scanners to protect their networks, but then fail to update those scanning mechanisms with the most recent programs to protect against current viruses.

Since Purdue announced its plans to establish the interdisciplinary master's program about a year ago, at least two other universities — Johns Hopkins in Baltimore and Georgetown in Washington — have followed suit.

The home for the master's program is Purdue's respected Center for Education and Research in Information Assurance and Security , which Spafford directs.

The center was established in 1998 as an undergraduate program and now has 65 students.