How viable is a PhD in software security research?

Question

I am planning to do a Ph.D in software security. My school is giving a full scholarship for "Detecting security vulnerabilities from source code and binary code" project.

Is is worth taking it? I feel software security is a bit saturated field, I mean there are already lots of software vulnerability detection tools available in the market.

Is this still a viable research field? Is software security a solved problem?

Answer 1

All research fields are saturated. The trick with a Ph.D. is to find your own unique niche within the domain.

Heck, think about people in other fields. There are Ph.D. students writing dissertations on Shakespeare and on Ancient Rome and both are quite saturated.

The description you provided is very general and sounds like a general grant. Almost all research in security on the static analysis side (Rather than networking) is under this title. It's a very active field with lots of research.

The main question is whether you want a PhD.

Answer 2

Software security is important and isn't going to get less so, I imagine that knowledge of that area would interest a lot of employers; it sounds like a useful area of research to me.

The most important questions to ask yourself when you are thinking of taking a PhD are (IMO)

1. Does the project genuinely interest me?
2. Does my supervisor have a good track record?
3. Does the research area fit with my long-term career goals?
4. Is the institution a good place to be studying this subject?

If you personally aren't that excited by the project it is going to be a slog. If your supervisor is bad (and a lot of them are) you are only making life hard for yourself; speak to your potential supervisor's previous students and find out about their experience, most PhD students in my experience are fairly honest about this sort of thing. You need a game plan for what you do after. You need to know that other institutions, or potential employers will respect your qualification.

Answer 3

Software security is not a solved problem, therefore there is need for more reseach into the subject.

IT systems are becoming critical to normal daily life, therefore the securing of those systems is becoming more important.

If you are interested in the field go for it.

Answer 4

I'm always a fan of doing what interests you and figuring that you'll find something new or a next good step for yourself along the way - so my return question is "does this interest you?"

You're right that the field is pretty well covered - there's several good products out there for static source code analysis and I think there are likely others for binaries. I'm not sure that the analysis products cover all scenarios that are documented by OWASP, though. In particular, I'm vaguely remembering some good security practices that are exceedingly hard to verify with the currently available techniques. And I don't know how much has been done on some of the harder to link cases - like JEE with dependancy injection.

I think there's a lot of work going on in software security, but I wouldn't call it "saturated". I think the surface area of the software security arena is growing by leaps and bounds as software and mobile code have been permeating our lives in the last 10 years. So while the number of people working in this feild is growing exponetially, the number of problems to solve in this field is growing faster.

That said, the other return question I have is "what do you want to do next?" PhD's are not a win in every development company - lots of people in the world of security came up through on the job experience, and don't have a lot of respect for academia. If you were looking for the degree to shotput you into a senior position in a major company, you may want to browse around the job space and see what you find.