What We have here is a failure to integrate

Marinus van Aswegem has a new blog Telic Thoughts, the first post describes a useful way to think about breaking down risk

The diagram describes a way to think about relationships in the risk drivers and sheds light on where you can be more or less proactive in dealing with risk. A later post "Software Security is an Engineering Problem" also posits an opinion I strongly agree with:

How do you find all the holes? Do you know where to look? If the experts who are creating the next generation of crypto routines can't get it right, what hope does your developers have?
Not to mention all the interesting ways your code and applications can be abused in ways you never thought possible.

Throwing technology (Firewalls, SSL, VPN, DLP, Anti Virus, etc) at the software problem isn't going to solve it either. It's an engineering problem, you need to build security in!

No wonder some of the best security guys I know have an engineering background.

I will go one step further, we have two and only two working security mechanisms - a reference monitor and crypto. So while infosec gets wound around the axel obsessing about products and threats, or led around by the nose by analysts, what we really have here is an integration problem - pure and simple. You really have the following choices

1. Use a reference monitor

2. Use crypto

3. Use both

4. Use none

All the rest is noise. Once you make those choices the rest is engineering and integration.

Comments

[Dave Tauzell]

What is a "Reference Monitor"?

[Gunnar Peterson]

http://en.wikipedia.org/wiki/Reference_monitor