The Six Dumbest Ideas in Computer Security - 0 views
-
boyan yuan on 20 Jan 12computer security is definitely still a "hot topic." But why are we spending all this time and money and still having problems? . Systems based on "Default Permit" are the computer security equivalent of empty calories: tasty, yet fattening.The most recognizable form in which the "Default Permit" dumb idea manifests itself is in firewall rules.Another place where "Default Permit" crops up is in how we typically approach code execution on our systems. 2.Why is "Enumerating Badness" a dumb idea? It's a dumb idea because sometime around 1992 the amount of Badness in the Internet began to vastly outweigh the amount of Goodness. "Enumerating Badness" is the idea behind a huge number of security products and systems, from anti-virus to intrusion detection, intrusion prevention, application security, and "deep packet inspection" firewalls. 3."Penetrate and Patch" crops up all over the place, and is the primary dumb idea behind the current fad (which has been going on for about 10 years) of vulnerability disclosure and patch updates. 4.Hidden in Parker's observation is the awareness that hacking is a social problem. It's not a technology problem, at all. "Timid people could become criminals." The Internet has given a whole new form of elbow-room to the badly socialized borderline personality.If you're a security practitioner, teaching yourself how to hack is also part of the "Hacking is Cool" dumb idea. 5."Penetrate and Patch" can be applied to human beings, as well as software, in the form of user education.Dealing with things like attachments and phishing is another case of "Default Permit" 6.There's an important corollary to the "Action is Better Than Inaction" dumb idea, and it's that: "It is often easier to not do something dumb than it is to do something smart."