1 Raindrop

Mission Critical Security Planner

Eric Greenberg, author of the excellent, pragmatic book "Mission Critical Security Planner", released the worksheets from the book for a free download. Like the book, the worksheets target a series of vertical slices like authentication, encryption, and intrusion detection. Each slice has a worksheet that tracks progress and issues from a business, technology stack, and lifecycle standpoint. The perspectives on communicated the value of the security mechanisms to different levels in the oragnization are very useful as well, since th C level, director level and hands on level each have different concerns and viewpoints.

Kim Cameron's Laws Of Identity

With all the hype and misunderstanding that surrounds Identity Management and Identity Services, Kim Cameron's Laws of Identity is a must read. This piece describes the dynamics of identity and whether you and your stakeholders agree with all of the points or not, it is the basis for a very focused and productive discussion around identity. Kim's blog is a hot house for debate on identity. There is confusion on numerous issues in IT, but since Identity Management and Services projects are actually getting funding and people are actually building things in this space it is even more imperative to pay attention.

Concurrency = Security Nightmares?

Peter Bernstein said that diversification is as close as an investor can get to a free lunch. Programmers and software architects have been enjoying a free lunch since the early days courtesy of ever-increasing CPU cycles. This soon to be published article describes the potential fallout and implications to software design once processor manufacturers hit the wall.

Concurrency can have a destabilizing effect on software that is not designed with it in mind. The effects on security and privacy assumptions stemming from concurrency and replication of data are profound. For example, does concurrency enable a whole new generation of asymmetric attacks?

The author states that complexity, efficiency, and optimization, three of security's traditional arch nemeses, are ascendant. Where does this leave software security? Of the currently implemented security mechanisms which ones still apply in this paradigm?

CPU Utilization

A SETI@Home community...those Dutch are clever, first they build towns below sea level, then they turn a town into a supercomputer.

handbook of software architecture

Grady Booch has begun a large scale project to catalog and codify software architecture in the form of an
online handbook.

This project has huge potential to facilitate communication in the software architecture world.

From a software security standpoint, hopefully Saltzer and Schroeder's design principles on security mechanisms are added to the above mix. Matt Bishop's overview of the eight principles..