  Research in cybersecurity may seem reactive, specific, ephemeral, and indeed
ineffective. Despite decades of innovation in defense, even the most critical
software systems turn out to be vulnerable to attacks. Time and again. Offense
and defense forever on repeat. Even provable security, meant to provide an
indubitable guarantee of security, does not stop attackers from finding
security flaws. As we reflect on our achievements, we are left wondering: Can
security be solved once and for all?
  In this paper, we take a philosophical perspective and develop the first
theory of cybersecurity that explains what *fundamentally* prevents us from
making reliable statements about the security of a software system. We
substantiate each argument by demonstrating how the corresponding challenge is
routinely exploited to attack a system despite credible assurances about the
absence of security flaws. To make meaningful progress in the presence of these
challenges, we introduce a philosophy of cybersecurity.
