Dorothy E. Denning

Denning has received over 20 awards for her innovations in computer security. Key contributions are described below.

"A Lattice Model of Secure Information Flow" presented in 1975[13] provided a method for controlling access to data which is still used today.

Detecting intruders is key to protecting computer systems. While at SRI International, Denning and Peter G. Neumann developed an intrusion detection system (IDS) model using statistics for anomaly detection that is still the basis for intrusion detection systems today. SRI's Intrusion Detection Expert System (IDES)[14] ran on Sun workstations and considered both user and network level data. It combined a rule-based Expert System to detect known types of intrusions with a statistical anomaly-detection component based on profiles of users, host systems, and target systems. (An artificial neural network was proposed as a third component; All three components would then report to a resolver). SRI followed IDES in 1993 with the Next-generation Intrusion Detection Expert System (NIDES).[15] The Multics Intrusion Detection and Alerting System (MIDAS), which protected the National Security Agency's Dockmaster System from 1998 to 2001, is an example of a fielded expert-system-based IDS.[16]

Denning improved data security via encryption technology. She introduced timestamps in key distribution protocols,[17] cryptographic checksums for multilevel database security,[18] and a method for improving the security of digital signatures with RSA and other public key crypto systems.[19] She considered key escrow systems,[20][21] Internet crime[22] and hacking.[23] Her book Cryptography and Data Security[24] became an ACM Classic, introducing cryptography to many.

In database security, Denning found ways to reduce inference threats in multilevel databases.[25] She reported on the problems of working with data across different classification levels.[26]

With L. Scott, Denning wrote two papers on using Global Positioning Systems for geo-encryption to enhance data security.[27][28]

Although she remained a technical expert, Denning's interests evolved to consider legal, ethical, and social issues. She addressed wiretapping,[29] the growth of the Internet,[30] cyber terrorism[31] and cyber warfare.[32] Her most recent papers focused on current cyber threats[33] and defenses.[34]

Denning interviewed hackers for her research on hacking and "hactivism".[35] She was criticized when she found positive things to say about their actions and wrote a 1995 postscript.

Denning was widely criticized for her role in NSA's controversial Clipper chip initiative to give the government authorized access to encrypted private communications through a key escrow system. At the government's request Denning privately reviewed the classified Skipjack block cipher, and testified in Congress that general publication of the algorithm would enable someone to build a hardware or software product that used SKIPJACK without escrowing keys.[36] In public forums, such as the Usenet forum comp.risks, she defended the Clipper chip and other approaches to key escrow that offered strong security while enabling law enforcement to decrypt without a warrant.[37] However, she did not advocate making key escrow mandatory. Eventually, Clipper was dropped and Skipjack was declassified and published.

Denning served as an expert witness in the 1990 trial of United States v. Riggs. Her testimony helped lead the government to drop charges against defendant Craig Neidorf,[38] who had taken an electronic 911 directory across state lines.

In 1992, Denning challenged the existing national standard for evaluating trusted systems (TCSEC), noting that "By the time a system is evaluated it is obsolete." She maintained that "trust is not a property but an assessment" by the real world market.[39] This was not the only criticism, and the TCSEC has since been replaced.

Lack of product liability for software is a contentious topic. When Denning proposed software vendors accept liability for errors in their products,[40] industry pushed back. Steve Lipner, charged with software security at Microsoft, argued that companies with deep pockets like Microsoft would be sued to death, even if they proved repeatedly that they followed the best secure software development practices.[41] A few large vendors, such as Volvo, have announced plans to accept both hardware and software liability in their future autonomous cars when national product liability standards are established.[42]

• In 1995 Denning was named an ACM Fellow by the Association for Computing Machinery.[43]
• The 1999 National Computer Systems Security Award recognized her "outstanding contributions to the field of computer security".
• Time magazine named her a security innovator in 2001.[44]
• The 2001 Augusta Ada Lovelace Award from the Association for Women in Computing acknowledged "her outstanding in computer security and cryptography as well as her extraordinary contributions to national policy debates on cyber terrorism and information warfare".
• The 2004 Harold F. Tipton Award recognized "Sustained excellence throughout [her] outstanding information security career".
• In 2008 ACM's special interest group on security, audit and control (ACM SIGSAC) bestowed their Outstanding Innovator Award upon Dr. Denning.
• She was named a fellow of the International Information Security Certification Consortium (ISC2).
• In 2010 she was named a distinguished fellow of the Information Systems Security Association (ISSA).
• In 2012 she was among the first inductees into the National Cyber Security Hall of Fame.

The New Jersey City University named its new security center the Dr. Dorothy E. Denning Center of Academic Excellence in Information Assurance Education.[45]