Re:The Six Dumbest Ideas in Computer Security (2005)
by msla on Wednesday January 25, 2023 @12:01AM
(#34514616)
Maybe I'm being too harsh, but my interpretation of that point is that they expect we'll eventually become perfect, which isn't going to happen in the software world as it hasn't happened in the airline world, even though the airline world has more incentives to be perfect in the form of more penalties when it isn't.
Re:The Six Dumbest Ideas in Computer Security (2005)
by riffraff on Wednesday January 25, 2023 @12:07AM
(#34514657)
My understanding is the author suggestion is to start with a security first approach, rather than wait-and-fix.
They don't expect the airline to be infallible, but they expect the airline to be proactively avoiding trouble.
Re:The Six Dumbest Ideas in Computer Security (2005)
by scotty79 on Wednesday January 25, 2023 @02:27AM
(#34515426)
The most secure plane is the one that stays on the ground.
It's always point of contention between people with security mindset and people that need to earn money to even hire people with security mindset.
Re:The Six Dumbest Ideas in Computer Security (2005)
by kortilla on Wednesday January 25, 2023 @04:08AM
(#34516130)
You’re not being too harsh, you’re missing the point. Defense in depth is not something you advocate for if you expect perfection.
Re:The Six Dumbest Ideas in Computer Security (2005)
by worthless-trash on Wednesday January 25, 2023 @12:07AM
(#34514653)
There is the flipside of that problem. If you say "We can never get hacked" then you will find that you breed a culture of denial if there is a problem.
They talk earlier about defense in depth, so it's obvious that they're not oblivious to the need for redundant safety measures:
> "We don't need a firewall, we have good host security" - no, you don't. If your network fabric is untrustworthy every single application that goes across the network is potentially a target. 3 words: Domain Naming System.
> "We don't need host security, we have a good firewall" - no, you don't. If your firewall lets traffic through to hosts behind it, then you need to worry about the host security of those systems.