Another important difference is computer systems themselves are inherently general purpose [0], unlike a physical machine - An airplane cannot be subverted to c

Another important difference is computer systems themselves are inherently general purpose [0], unlike a physical machine - An airplane cannot be subverted to calculate the GDP of the United States, but all Turing machines are created equal. Another difference is computer systems are generally open to unpredictable external inputs [0], unlike a physical machine - An airplane is not needed to be designed under the assumption that an adversary would use weather modification to destroy it. [0] Unless specialized designs are used explicitly in hardware and software, similar to those which are found in embedded industrial control systems, which removes these uncertainties to a large extent. But they are rarely used in practice because of its difficulties and cost. As Bruce Schneier written in Cryptography Engineering, One of the biggest differences between security systems and almost any other type of engineering is the adversarial setting. Most engineers have to contend with problems like storms, heat, and wear and tear. All of these factors affect designs, but their effect is fairly predictable to an experienced engineer. Not so in security systems. Our opponents are intelligent, clever, malicious, and devious; they’ll do things nobody had ever thought of before. They don’t play by the rules, and they are completely unpredictable. That is a much harder environment to work in. Many of us remember the film in which the Tacoma Narrows suspension bridge wobbles and twists in a steady wind until it breaks and falls into the water [1]. It is a famous piece of film, and the collapse taught bridge engineers a valuable lesson. Slender suspension bridges can have a resonance mode in which a steady wind can cause the whole structure to oscillate, and finally break. How do they prevent the same thing from happening with newer bridges? Making the bridge significantly stronger to resist the oscillations would be too expensive. The most common technique used is to change the aerodynamics of the bridge. The deck is made thicker, which makes it much harder for the wind to push up and down on the deck. Sometimes railings are used as spoilers to make the bridge deck behave less like a wing that lifts up in the wind. This works because wind is fairly predictable, and does not change its behavior in an active attempt to destroy the bridge. A security engineer has to take a malicious wind into account. What if the wind blows up and down instead of just from the side, and what if it changes directions at the right frequency for the bridge to resonate? Bridge engineers will dismiss this kind of talk out of hand: ‘‘Don’t be silly, the wind doesn’t blow that way.’’ That certainly makes the bridge engineers’ jobs much easier. Cryptographers don’t have that luxury. Security systems are attacked by clever and malicious attackers. We have to consider all types of attack. [1] https://upload.wikimedia.org/wikipedia/commons/transcoded/f/f2/Tacoma_Narrows_Bridge_destruction.ogv/Tacoma_Narrows_Bridge_destruction.ogv.480p.webm https://upload.wikimedia.org/wikipedia/commons/transcoded/f/...