This means that maintaining secure systems by ensuring software and processes have no security flaws is pretty much impossible.

A better strategy might be to have air-gapped systems, where you need to have a dedicated physical wire running to your computer if you want to connect to the system. As stuxnet shows, even this is not 100% secure, but it is considerably easier to maintain security if it is not connected to the internet.

What should actually be done is start from an adequate, but possibly impractical or ineffective solution and a process that properly manages the creation of that system then figure out how to make it practical without making it inadequate. If it is impossible to come up with an adequate, but impractical solution to start with, then it is highly unlikely that an adequate practical solution will show itself. This is far easier than starting with a practical, but inadequate solution and making it adequate without making it impractical since, as most engineers know, it is almost always easier to simplify a working design than to bolt things onto a non-working design until it works. If you can not simplify a working design, then it is highly unlikely that you will be able to create a better solution from scratch which is borne out by the continuous failure of pretty much everybody who has ever tried doing so in the cybersecurity industry.

In this particular example, if security is actually important, you should likely start the consideration with an air-gapped system and an adequate security process which assumes that primitive and then see if you can loosen that restriction. But, as I must stress, the key element is actually in having a process that can properly utilize, manage, and reason about the components in a way that can create secure systems. Secure primitives without a good security process can easily create an insecure system. However, a good security process with insecure primitives at least stands a chance (which even ignores the fact that a good security process should filter out insecure primitives that can not be usefully integrated). As for how you can determine if a security process is any good, you can do this by seeing if the process has consistently created systems that reach an adequate objective level of quality given different circumstances. In this case, air-gap based processes have seen material success in actually achieving an adequate level of security in certain circumstances, so it is probably good to start from there though there are actually other potential solutions.

If what was reported by Reuters is true, SolarWinds had huge holes in its security. None of the companies I've worked for on recent years would keep a FTP server containing critical data on a public network with a guessable password: "A security researcher told Reuters he warned the IT firm SolarWinds in 2019 that its “solarwinds123” password for its update server could be accessed by anyone." https://www.businessinsider.com.au/solarwinds-warned-weak-12...

In any event, I will concede that my analysis of SolarWinds is an educated guess on my part, but it is hardly relevant to my overall points in any event. Even if SolarWinds is the dumbest most incompetent organization ever it does not detract from my other point which is that even the "best" is abysmal, so even if they were doing the best that is practically achieved in a working environment it still would not result in a meaningful difference. So, the problem is not actually that SolarWinds was chosen, it is that nobody else would be able to solve it either which is a far bigger problem. It means you need to come up with a novel solution to an unsolved problem, not just use something already known.

[1] https://www.wired.com/story/macos-high-sierra-hack-root/

[2] https://arstechnica.com/information-technology/2017/05/the-h...

Still even with that in mind one should perhaps never assume that such things are less important.

This is the TL;DR to a lot of stuff in life.