2 ms·
"Defense in Depth" is always important. The article I linked to above[2] about how it's incredibly stupid to try an enumerate badness (aka "default permit") has
by pdkl95 11y ago
"Defense in Depth" is always important. The article I linked to above[2] about how it's incredibly stupid to try an enumerate badness (aka "default permit") has in it's list other stupid excuses we hear all the time:
"We don't need a firewall, we have good host security"
"We don't need host security, we have a good firewall"
I bet the people that say that kind of nonsense have a lock on their server room door even after hiring a guard that watches the building's main entrance.
This kind of practical defense isn't the only thing we've been skipping. We need a lot more basic research into how to secure modern technology. We need a design culture that isn't building features that require insecurity.
It is limiting top think of this problem as a "cybesecurity" problem. These same technologies will create problems in all areas of life, so we need a lot more education about what capabilities exist how they can be used. We need to be teaching people - from a very young age - what happens to your {meta,}data in a world with permanent data storage and powerful machine learning analysis. We need this education "yesterday", as these problems are not theoretical anymore[5].
[5] http://www.nytimes.com/2012/02/19/magazine/shopping-habits.html?_r=1&pagewanted=all http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...
- bburshteyn 11y agoYou are right on. We're working on something in this vein -- https://www.trycryptomove.com https://www.trycryptomove.com -- our technology does security via continuous concealment. Actively defends against insider attacks and catastrophic breaches, because the attacker can't even identify the data. We've gotten two types of reactions: (1) we get it, layered security, defense in depth; (2) solution in search of a problem, we have good host security, we have a good firewall, legacy data-at-rest security is good enough. Thankfully far more of #1 than #2, but it's telling about an organization's approach to security.
- akshatpradhan 11y ago>our technology does security via continuous concealment. IMO, this isn't a castle approach. Its more like you've added a security control to help with Data Retention.
- akshatpradhan 11y agoWho is saying this? >We don't need a firewall, we have good host security >We don't need host security, we have a good firewall
- pdkl95 11y agoMost businesses from the beginning of the internet to a few years ago? (I'm not sure how common it is now). The "quote" (paraphrase of a very-common attitude) is from this link in my first post: http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d...