Saturday, April 19, 2008 7:52 AM
codingsanity
The 6 dumbest ideas in Computer security
Marcus Ranum has an article titled The Six Dumbest Ideas in Computer Security. I strongly suggest that anyone interested in security read it, and his other articles too. It's quite an old article, but someone put it on proggit and it made me remember it. In fact, I'd say that this article was seminal in guiding my undertstanding of computer security. For those of you too lazy to click on links, a swift summary:
- Permitting things by default instead of denying things by default. Used to be very common in firewalls.
- Focusing on stopping bad things rather than only allowing known good things, a special case of #1, but still very common in anti-viruses and operating systems.
- Catch holes by fixing hacks as they become known rather than hardening the application.
- Hacking is cool.
- Educating users.
- Doing something is always better than not doing something. Think about it this way, do you really want to be running bleeding edge software for your firewall?
A point he makes about #3 and #5 is that if these worked they would have worked by now. IE would be the most secure browser on the planet and users wouldn't click on attachments anymore.
Do yourself a favour, go and read the original article. It's well worth it.
Filed under: Security