Proceedings – Annual Computer Security Applications Conference, ACSAC

About Proceedings – Annual Computer Security Applications Conference, ACSAC

Profile type: Conference proceedings series — the annual published record of the Annual Computer Security Applications Conference (ACSAC), not a journal. No journal impact factor and no article processing charge (APC) apply to this title, and none is claimed here. DEPTH-BATCH253

Overview

The Proceedings of the Annual Computer Security Applications Conference are the peer-reviewed proceedings of ACSAC, one of the longest-running conferences in computer security. ACSAC's defining idea, present from its beginnings in the 1980s and repeated in its calls for papers ever since, is applications: it is a forum where researchers, developers and practitioners meet specifically to exchange practical ideas and experience about protecting real information systems — corporate and government infrastructures, operational networks, deployed software. Where some security venues prize theory above all and others are trade shows, ACSAC has deliberately occupied the applied middle ground for four decades: refereed technical papers with a clear practical impact, alongside case studies, panels, courses, posters, works in progress and workshops drawn from operational security work.

That character is written into the conference's standing invitation to authors: if you are developing, researching or implementing practical solutions for protecting the information infrastructures of users, enterprises or countries, ACSAC asks you to share the experience. Its calls for papers state a preference for work on the application of security technology, the implementation of systems, and lessons learned. The proceedings therefore read differently from a purely academic venue. Alongside new techniques you will find deployment reports, measurement studies of real systems, analyses of failures, and experience papers whose value lies precisely in having been done at operational scale and written up honestly.

The series matters historically as well as technically. ACSAC began in 1985 — before the web, before the modern internet security industry existed — and its volumes form a continuous annual record of applied security practice from the era of trusted-systems evaluation and the "Orange Book" through the internet and e-commerce era, the malware and intrusion-detection years, and into cloud, mobile, machine-learning and supply-chain security. Few security conferences can offer that unbroken a view. This profile explains what the proceedings are, who sponsors and publishes them, how the conference is organised, how papers are submitted and reviewed, where the proceedings are indexed, and how the series has developed — and it is explicit about the points on which ACSAC does not publish a fixed public figure.

About the Conference and the Series

ACSAC's sponsor gives the clearest account of its origins. Applied Computer Security Associates (ACSA) had its genesis in the first Aerospace Computer Security Applications Conference in 1985. That first conference succeeded, and the meeting evolved into the Annual Computer Security Applications Conference; the word "Aerospace" was later dropped from the name to encourage a wider range of government and commercial applications. ACSA was incorporated in 1987 as a non-profit association of computer security professionals sharing the goal of improving the understanding, theory and practice of computer security, and it remains the conference's primary sponsor. The 2025 edition was the conference's 41st year — a milestone its sponsor's message that year noted very few cybersecurity conferences have reached.

The conference is held annually, traditionally in December, at venues in the United States. The published record shows the pattern: the 20th edition in Tucson, Arizona (December 2004); the 21st, also Tucson (2005); the 25th in Honolulu, Hawaii (December 2009); the 38th in Austin, Texas (December 2022); the 2024 edition in Honolulu (December 2024); the 41st edition in Honolulu in December 2025, at Waikiki; and a 2026 edition announced for Los Angeles in December 2026. Two editions in the sequence — in the COVID period — were delivered virtually, after which the conference returned to predominantly in-person delivery with some remote presentation accommodated. Readers should confirm the current edition's dates and venue on the official ACSAC site, since the standing pattern is a guide, not a booking.

Structurally, a modern ACSAC week combines several elements around the refereed paper programme: invited and keynote talks; panels; professional-development courses and tutorials; poster sessions; works-in-progress sessions; case-study presentations; and a set of co-located workshops. Named long-running workshops include the Learning from Authoritative Security Experiment Results workshop (LASER, co-founded by ACSA in 2012) and the Industrial Control System Security workshop (ICSS, added in 2015), alongside newer workshops on topics such as resilient and trustworthy machine learning and blockchain security. Workshop proceedings are published together with the main proceedings through the same channel, described below.

Publication Details

Publication history in brief. The series ISSN 1063-9527 is visible in bibliographic records going back decades — for example, the published record of the 14th conference (1998) lists the volume under Proceedings of the Annual Computer Security Applications Conference, ISSN 1063-9527, published by IEEE Computer Society Press, with ACSA and ACM's security special interest group among the contributing organisations of that era. Later volumes, catalogued by DBLP, likewise show IEEE Computer Society as publisher — the 20th (2004) and 21st (2005) editions among them, each with its own ISBN. In recent years ACSA's sponsor message confirms the current arrangement explicitly: ACSAC and its workshop proceedings are published through IEEE Computer Society's Conference Publishing Services, appearing in both the IEEE Computer Society Digital Library and IEEE Xplore. Authors should cite the specific volume and paper details — year, pages, DOI where assigned — from the copy they consulted, since production arrangements have evolved over forty years even though the series identity has remained continuous.

Access. Recent proceedings are accessed principally through IEEE Xplore and the IEEE Computer Society Digital Library, where availability depends on institutional subscription or the paper's individual status. ACSAC also maintains its own website with programmes and, for many editions, links to papers and presentation materials; the conference has a long practitioner tradition of making its programme content findable for the community. Access terms for any specific paper should be checked on the platform holding it rather than assumed.

Scope and Topics

ACSAC's topic list is broad within applied security and has evolved with the threat landscape while keeping its applications core. The topics named in its recent calls for papers include: access control and anonymity; applied cryptography; assurance and audit; biometrics; security case studies; cloud security; cyber-physical systems security; denial of service; distributed systems security; embedded systems security; enterprise security management; digital forensics; identity management; incident response; insider threat protection; integrity; intrusion detection; intellectual property protection; machine-learning security; malware; mobile and wireless security; network security; operating-system security; privacy and data protection; privilege management; resilience; security and privacy of the Internet of Things; security engineering; software security; software-defined programmable security; supply-chain security; trust management; trustworthy computing; usability and human-centred aspects of security; virtualisation security; and web security. Recent editions have also designated a "hard topic" theme to draw concentrated submissions on a selected problem area.

The editorial centre of gravity, however, is what distinguishes ACSAC from a general topic list. The calls state the interest explicitly: submissions addressing the application of security technology, the implementation of systems, and lessons learned are especially welcome. A novel technique is in scope when its practical impact is clear — historically, ACSAC paper guidance asked that papers present techniques, applications or experience, or theory with a clear practical impact, and encouraged work demonstrated to be useful for improving real systems. Pure theory with no path to application, and product marketing with no technical content, both sit outside the venue's centre. Authors with deployment experience, measurements from production systems, or a candid account of what failed and why are, in this venue, first-class contributors rather than an afterthought.

Editorial and Organising Structure

ACSAC is owned, in effect, by its community: ACSA, the non-profit sponsor, provides continuity, while each edition is delivered by a volunteer organising committee drawn from the security research and practitioner community — a general chair, programme leadership and a programme committee that referees the technical papers, and chairs for the other tracks (case studies, panels, courses, posters, works in progress, workshops and student conferenceships). Committee membership changes annually and is published on each edition's pages of the official site; no standing editor-in-chief exists, because a conference proceedings is edited by its programme committee for that year, not by a permanent editorial office. That is also why this profile names no current office-holders: the authoritative list is the current edition's, on acsac.org.

Two longstanding institutions show the sponsor's hand in the programme. The Distinguished Lecture Series, begun by ACSA in 1989, invites an outstanding security professional each year to lecture on a topic of current interest. The Best Paper by a Student Award, begun in 1991, encourages student participation, with the winning student author receiving an honorarium and conference expenses. ACSAC also runs student conferenceships — support to help students attend, documented for recent editions with an application involving a CV, a short essay and a faculty letter. Since 2010 ACSA has maintained an In Memoriam record of community members. Taken together, these features describe a society-style conference run by a small non-profit rather than a commercial events business, and they are a large part of why the series has survived, unchanged in mission, since 1985.

Indexing, Abstracting and Discoverability

Recent ACSAC proceedings are indexed through their publication channel: papers appear in IEEE Xplore and the IEEE Computer Society Digital Library with standard IEEE bibliographic metadata and DOIs. The complete run of editions is catalogued by DBLP, which lists ACSAC volumes year by year with full paper-level contents, and papers are broadly discoverable through general scholarly search engines. The conference website's own programme pages provide an additional, openly browsable record of each edition's papers, speakers and workshops.

As with every proceedings series in this profile set, one boundary must be stated plainly: ACSAC has no Journal Impact Factor and no journal CiteScore, because it is not a journal. Third-party sites that rank conferences use their own methods and labels; those are not official metrics of this series and should not be quoted as such. The meaningful quality evidence for ACSAC is inspectable directly: forty-one annual editions, a refereed programme committee process, society co-sponsorship, and the citation and deployment record of its papers.

Submission and Author Guidance

ACSAC does not accept "speaking proposals" as such; it invites defined contribution types, and the sponsor's guidance maps ideas onto them: a full technical paper for completed research; a case study for practical experience; a panel proposal for a group of related speakers; a professional-development course proposal for a half- or full-day seminar; a poster or work-in-progress for a short write-up of unfinished work; and workshop papers for the co-located workshops. The main paper track runs on a mid-year cycle in recent editions — the 2022 call, for example, set paper submission at the end of June with notification in early September, and the 2023 cycle added abstract registration ahead of the full-paper deadline in May. Exact deadlines, page limits, anonymity rules and submission-system details are set in each year's call for papers on acsac.org and are not publicly disclosed as permanent figures; authors must work from the current call, because deadline aggregator sites have carried stale dates for this conference.

Substantively, successful ACSAC papers respect the venue's rules of evidence. Submissions must not substantially overlap with work published or simultaneously submitted elsewhere — a condition stated in classic ACSAC paper guidance and standard across the field. The paper must be intelligible on its own: appendices may support, but not carry, the argument. Reviewers for this programme are drawn from both research and practice, so a paper should explain its deployment context, threat model and evaluation in terms a competent practitioner outside the sub-speciality can follow, and should state limitations and lessons learned candidly — in this venue, that candour is scored as a strength. Selected ACSAC papers in recent editions have been invited to submit extended versions to a special issue of the ACM journal Digital Threats: Research and Practice (DTRAP); that invitation is a separate journal route for an extended work, and the proceedings paper remains the archival record of the conference version.

Notable Editions and Development of the Series

The 1985 first edition — an aerospace-focused security applications meeting — and ACSA's incorporation in 1987 mark the founding period, when applied security meant, largely, government and defence systems and the trusted-systems evaluation culture of the time. The 1989 Distinguished Lecture and 1991 student best-paper award institutionalised the conference's community role. Through the 1990s the published volumes show the field's centre moving to networks, internet technologies, electronic commerce, intrusion detection and applied cryptography — the 1998 volume's programme alone spans intrusion detection, security administration, e-commerce, digital signatures and assurance. The 2000s editions (Tucson 2004 and 2005 among them) reflect the malware, worm and enterprise-security era, and the programme's case-study and tutorial culture deepened. LASER (2012) and ICSS (2015) added standing workshops on experimental method and industrial-control-system security. The pandemic forced virtual editions in the early 2020s — the sponsor records two virtual years — followed by Austin and a return to Honolulu for the 40th (2024) and 41st (2025) editions, with Los Angeles announced for 2026. The through-line across all forty-one years is the founding bet: that applied, experience-based security knowledge needs its own refereed home. The proceedings are that home's complete written record.

How to Read and Use This Series

Practitioners will get the most from the ACSAC volumes by reading against their own problem list: the case studies, deployment reports and lessons-learned papers are indexed by the same topic scheme as the research papers, so a team working on, say, identity management or industrial control system security can pull a decade of reported operational experience in a single pass through the programmes. Researchers will find the volumes useful in the opposite direction — as a check on relevance. If a proposed technique cannot be connected to the kinds of systems, constraints and failure stories that fill these proceedings, it is probably aimed at the wrong venue. Students are a constituency the conference deliberately cultivates, through its best-student-paper award dating to 1991 and its conferenceships supporting attendance, and the proceedings reward student readers in particular: the tutorial and course tradition, the panels and the distinguished lectures that frame each edition define what the applied security community, at that moment, considered the questions that mattered. Read in that spirit — as the field's annual conversation with itself about what actually works — the series is more than the sum of its papers.

Frequently Asked Questions

Is ACSAC a journal?

No. It is an annual conference sponsored by the non-profit Applied Computer Security Associates, and this title is its proceedings series. Its papers are refereed, archival conference papers, but the series is not a journal.

Does ACSAC have an impact factor?

No. Journal Impact Factors apply to journals only. Judge ACSAC by its longevity, its refereed programme, its sponsoring bodies and the record of its papers.

What is the ISSN of the proceedings?

1063-9527, carried in the series' bibliographic records since at least the 1990s. Individual volumes also have their own ISBNs, and recent papers have DOIs via IEEE.

Who publishes the proceedings?

In recent years, the IEEE Computer Society through its Conference Publishing Services, with proceedings appearing in the IEEE Computer Society Digital Library and IEEE Xplore. ACSA is the conference sponsor, with IEEE Computer Society co-sponsorship including its Technical Community on Security and Privacy.

When did ACSAC begin?

In 1985, as the Aerospace Computer Security Applications Conference. ACSA incorporated as a non-profit in 1987, "Aerospace" was later dropped from the name, and the 2025 edition was the 41st.

What kinds of contributions does ACSAC take?

Refereed technical papers, case studies, panels, professional-development courses and tutorials, posters, works in progress, and workshop papers — all centred on applied computer security, implementation and lessons learned.

Is there an APC?

No journal-style APC is listed for this series. Presenting involves conference registration for that edition; fees are set per edition in the official call.

Can an ACSAC paper be extended into a journal article?

Selected papers in recent editions have been invited to submit extended versions to a special issue of ACM Digital Threats: Research and Practice. The proceedings paper itself remains a complete archival publication.

Sources consulted for this profile are listed in the accompanying source notes. Per-edition details — deadlines, fees, venues for future years and committee membership — change annually and are deliberately not stated here as permanent facts.