Calls for an NTSB?
[no description provided]In September, Steve Bellovin and I asked "Why Don’t We Have an Incident Repository?."
I'm continuing to do research on the topic, and I'm interested in putting together a list of such things. I'd like to ask you for two favors.
First, if you remember such things, can you tell me about it? I recall "Computers at Risk," the National Cyber Leap Year report, and the Bellovin & Neumann editorial in IEEE S&P. Oh, and "The New School of Information Security." But I'm sure there have been others.
In particular, what I'm looking for are calls like this one in Computers at Risk (National Academies Press, 1991):
3a. Build a repository of incident data. The committee recommends that a repository of incident information be established for use in research, to increase public awareness of successful penetrations and existing vulnerabilities, and to assist security practitioners, who often have difficulty persuading managers to invest in security. This database should categorize, report, and track pertinent instances of system security-related threats, risks, and failures. [...] One possible model for data collection is the incident reporting system administered by the National Transportation Safety Board... (chapter 3)
Second, I am trying to do searches such as "cites "Computers at Risk" and contains 'NTSB'." I have tried without luck to do this on Google Scholar, Microsoft Academic and Semantic Scholar. Only Google seems to be reliably identifying that report. Is there a good way to perform such a search?