Eugene H. Spafford (born 1956) (known colloquially as "Spaf") is a professor of computer science at Purdue University and a leading computer security expert. A historically significant Internet figure, he is renowned for first analyzing the Morris Worm, one of the earliest computer worms, and his participation in the Usenet backbone cabal. Spafford is a member of the President's Information Technology Advisory Committee (PITAC), has been an advisor to the National Science Foundation (NSF), and serves as an advisor to over a dozen other government agencies and major corporations. 1956 (MCMLVI) was a leap year starting on Sunday of the Gregorian calendar. ... Computer science - Wikipedia, the free encyclopedia /**/ @import /skins-1. ... Purdue University is a public land-grant university system within the state of Indiana. ... Computer security is a field of computer science concerned with the control of risks related to computer use. ... The Morris worm or Internet worm was one of the first computer worms distributed via the Internet; it is considered the first worm and was certainly the first to gain significant mainstream media attention. ... A computer worm is a self-replicating computer program, similar to a computer virus. ... Usenet is a distributed Internet discussion system that evolved from a general purpose UUCP network of the same name. ... The backbone cabal was a group (or cabal) of large-site administrators who pushed through the Great Renaming and reined in the chaos of Usenet during most of the 1980s. ... The National Science Foundation (NSF) is an independent United States government agency responsible for supporting basic science research mainly by providing research funding. ...

Spafford received his B.A. with a double major in mathematics and computer science from the State University of New York at Brockport. He then attended the School of Information and Computer Sciences (now the College of Computing) at the Georgia Institute of Technology. He received his M.S. in 1981, and Ph.D. in 1986 for his design and implementation of the original Clouds distributed operating system kernel. A Bachelor of Arts (B.A. or A.B.) is an undergraduate academic degree awarded for a course or program in the arts and/or sciences. ... The State University of New York at Brockport, also known as SUNY Brockport, Brockport State University or the State University of New York College at Brockport, is a four-year liberal arts college located in Brockport, Monroe County, New York, near Rochester. ... Georgia Institute of Technology The Georgia Institute of Technology, or Georgia Tech, is located in Atlanta, Georgia, U.S.A. With over 16,000 students, Georgia Tech is one of four public research universities in the University System of Georgia. ... A masters degree is an academic degree usually awarded for completion of a postgraduate course of one or two years in duration. ... Doctor of Philosophy (Ph. ... In computing, an operating system (OS) is the system software responsible for the direct control and management of hardware and basic system operations. ...

During the early formative years of the Internet, Spafford made significant contributions to establishing semi-formal processes to organize and manage Usenet, then the primary channel of communcation between users, as well as being influential in defining the standards of behavior governing its use.

At Purdue, Spafford has a joint appointment as a professor of computer science and as professor of electrical and computer engineering, where he has served on the faculty since 1987. He is also a professor of philosophy (courtesy), and a professor of communication (courtesy). He is also Executive Director of the Purdue CERIAS (Center for Education and Research in Information Assurance and Security) and was the founder and director of COAST Laboratory, which preceded CERIAS.

He is involved in a number of professional societies and activities outside Purdue including serving on the Board of Directors of the Computing Research Association and as co-chair of the ACM's US Public Policy Committee. He serves on a number of advisory and editorial boards and is internationally known for his writing, research, and speaking on issues of security and ethics. Spafford has authored or co-authored four books on computer and computer security, including Practical Unix and Internet Security for O'Reilly, as well as over a hundred research papers, chapters and monographs. The Association for Computing Machinery, or ACM, was founded in 1947 as the worlds first scientific and educational computing society. ... OReilly Media (formerly OReilly & Associates) is an American media company established by Tim OReilly that publishes books and web sites and produces conferences on computer technology topics. ...

Spafford has stated that his research interests have focused on "the prevention, detection, and remediation of information system failures and misuse, with an emphasis on applied information security. This has included research in fault tolerance, software testing and debugging, intrusion detection, software forensics, and security policies."

Among notable software designed and/or supervised by Spafford include the freeware Tripwire tool coded by his student Gene Kim (Spafford was later the chief external technical advisor to the Tripwire company during their first few years), and the freeware COPS tool coded by his student Dan Farmer. He initiated the Phage List as a response to the Morris Worm. Some of his research also helped inspire the creation of the MITRE CVE service and the NIST ICAT database. Research by other graduate students of his has resulted in tools for software testing and debugging, distributed processing, cyber forensics, firewalls, intrusion detection, auditing, and network traceback. Tripwire is a company based in Portland, Oregon which produces change auditing software. ... Dan Farmer is a computer security researcher. ... The Morris worm or Internet worm was one of the first computer worms distributed via the Internet; it is considered the first worm and was certainly the first to gain significant mainstream media attention. ... MITRE is a US not-for-profit corporation that manages three federally-funded research and development centers whose main activities are applying computer-based automation to large and complex tasks. ... As a non-regulatory agency of the United States Department of Commerce’s Technology Administration, the National Institute of Standards (NIST) develops and promotes measurement, standards, and technology to enhance productivity, facilitate trade, and improve the quality of life. ...

Quotations

Spafford is well-known for his aphorisms regarding the Internet: (Generally, the word "Usenet" may be replaced by the word "Internet" or the phrase "World Wide Web" and these axioms will remain as true as the original statements.)

• Axiom #1: "The Usenet is not the real world. The Usenet usually does not even resemble the real world."
  • Corollary #1: "Attempts to change the real world by altering the structure of the Usenet is an attempt to work sympathetic magic -- electronic voodoo."
  • Corollary #2: "Arguing about the significance of newsgroup names and their relation to the way people really think is equivalent to arguing whether it is better to read tea leaves or chicken entrails to divine the future."

• Axiom #2: "Ability to type on a computer terminal is no guarantee of sanity, intelligence, or common sense."
  • Corollary #3: "An infinite number of monkeys at an infinite number of keyboards could produce something like Usenet."
  • Corollary #4: "They could do a better job of it."

• Axiom #3: "Sturgeon's Law (90% of everything is crap) applies to Usenet."
  • Corollary #5: "In an unmoderated newsgroup, no one can agree on what constitutes the 10%."
  • Corollary #6: "Nothing guarantees that the 10% isn't crap, too."

• "Usenet is like a herd of performing elephants with diarrhea -- massive, difficult to redirect, awe-inspiring, entertaining, and a source of mind-boggling amounts of excrement when you least expect it."

• "The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts."

Sturgeons Law is an adage derived from a quote by science fiction author Theodore Sturgeon: Nothing is always absolutely so. ...

External links

• Gene Spafford's home page at Purdue
• Greplaw interview
• PKI Forum interview (introduction) (very long)
  • Part 1: Gene Spafford on security threats, PKI, interoperability, privacy, wireless security and key management
  • Part 2: Gene Spafford on key escrow, backup and recovery, security education, digital certificate revocation, identity fraud, security trends and predictions
• CERIAS website
• Spafford's analysis of the Morris worm
• Pratical Unix and Internet Security

Selected honors and awards

• 1992 Inducted in Sigma Xi, research scientists' honor society.
• 1992 Inducted in Upsilon Pi Epsilon, the Computer Sciences honor society.
• 1996 Awarded charter membership in the IEEE Computer Society's Golden Core for distinguished service to the Computer Society during its first 50 years.
• 1996 Award of Distinguished Technical Communication (highest award) and Award of Merit by the Society for Technical Communication for Practical Unix and Internet Security.
• 1997 Inducted as a Fellow of the Association for Computing Machinery.
• 1999 Inducted as a Fellow of the American Association for the Advancement of Science.
• 2000 NIST/NCSC National Computer Systems Security Award.
• 2000 Proclaimed a CISSP, honoris causa by (ISC)²
• 2000 Inducted as a Fellow of the Institute of Electrical and Electronics Engineers.
• 2001 Named to the ISSA (Information Systems Security Association) Hall of Fame.
• 2003 Awarded U.S. Air Force medal for Meritorious Civilian Service.
• 2005 Honorary D.Sc. from the State University of New York (SUNY)