Never a better introduction.

Typically, disciplines mature by being “arts” first, “crafts” second, and “sciences” last. An art is considered to be the domain of people with innate abilities and singular talents. Only someone born with a talent can be an artist. A craft is teachable and so requires standardized terminology, proven techniques and an established curriculum. To become a science, a discipline needs quantifiable measures, reproducible experiments, and established laws that make meaningful predictions.

Despite tremendous effort in improving computer security over the past 40 years, and significant progress in our ability to address particular types of vulnerabilities, computer security is, at best, a craft. Although we have developed many good engineering solutions, there is a paucity of scientifi c understanding of the underlying principles for developing secure systems. Unlike the medieval alchemists, we lack well defined goals, quantifi able ways of measuring security properties of a system, and established and repeatable experimental methods