Sunday, January 7. 2007
Security Week in Review (2006-12-31)
Trackbacks
Trackback specific URI for this entry
No Trackbacks
Comments
Display comments as
(Linear | Threaded)
What's this "either secure or not secure" thing?
Are you talking about emotional security?
;-/
While I totally disagree with those who argued that MSW95 was secure enough because most of the people who knew how to find the open shares over the internet were too busy to bother with ordinary users (and other such conceits), the truth is that security is not absolute. Computers or otherwise, there is no absolute security in the real world. The only thing we can do is raise our security levels high enough to discourage the potential attackers. That and not leave bait lying around.
The only binary level of security achievable is that provided by MSWindows. One reason that is so low is that Microsoft has depended far too long on good will, leaving far too much bait around. Even if they could fix their dev process for real, the momentum would leave them as the prime target for years.
The prime target effect is real, it just is not the primary reason for Microsoft's present high leakage rate.
That notwithstanding, the mistake in claiming that Microsoft's problems are due to their prominent position in the market is (while also being a reversal of cause and effect), that the assertion assumes a future time when Microsoft will have actually fixed things, and assumes the future is now. (As long as they talk about Trusted Computing or whatever the name of the hour is, we know they haven't fixed the real problems.)
And the real problem in talking about levels of security is that the lack of absolute is too often used as an excuse for failing to secure one's systems sufficiently.
Are you talking about emotional security?
;-/
While I totally disagree with those who argued that MSW95 was secure enough because most of the people who knew how to find the open shares over the internet were too busy to bother with ordinary users (and other such conceits), the truth is that security is not absolute. Computers or otherwise, there is no absolute security in the real world. The only thing we can do is raise our security levels high enough to discourage the potential attackers. That and not leave bait lying around.
The only binary level of security achievable is that provided by MSWindows. One reason that is so low is that Microsoft has depended far too long on good will, leaving far too much bait around. Even if they could fix their dev process for real, the momentum would leave them as the prime target for years.
The prime target effect is real, it just is not the primary reason for Microsoft's present high leakage rate.
That notwithstanding, the mistake in claiming that Microsoft's problems are due to their prominent position in the market is (while also being a reversal of cause and effect), that the assertion assumes a future time when Microsoft will have actually fixed things, and assumes the future is now. (As long as they talk about Trusted Computing or whatever the name of the hour is, we know they haven't fixed the real problems.)
And the real problem in talking about levels of security is that the lack of absolute is too often used as an excuse for failing to secure one's systems sufficiently.
Calendar
|
January '09 | |||||
| Sun | Mon | Tue | Wed | Thu | Fri | Sat |
| 1 | 2 | 3 | ||||
| 4 | 5 | 6 | 7 | 8 | 9 | 10 |
| 11 | 12 | 13 | 14 | 15 | 16 | 17 |
| 18 | 19 | 20 | 21 | 22 | 23 | 24 |
| 25 | 26 | 27 | 28 | 29 | 30 | 31 |
Quicksearch
Categories
Syndicate This Blog
Blog Administration
Powered by
