Geeks With Blogs

Scott Kuhl Warning: I may have no idea what I am talking about!

Let me introduce you to the six dumbest ideas in computer security. What are they? They're the anti-good ideas. They're the braindamage that makes your $100,000 ASIC-based turbo-stateful packet-mulching firewall transparent to hackers. Where do anti-good ideas come from? They come from misguided attempts to do the impossible - which is another way of saying "trying to ignore reality." Frequently those misguided attempts are sincere efforts by well-meaning people or companies who just don't fully understand the situation, but other times it's just a bunch of savvy entrepreneurs with a well-marketed piece of junk they're selling to make a fast buck. In either case, these dumb ideas are the fundamental reason(s) why all that money you spend on information security is going to be wasted, unless you somehow manage to avoid them.

  1. Default Permit
  2. Enumerating Badness
  3. Penetrate and Patch
  4. Hacking is Cool
  5. Educating Users
  6. Action is Better Than Inaction

Almost made the list:

  • We're Not a Target
  • Everyone would be secure if they all just ran <security-flavor-of-the-month>
  • We don't need a firewall, we have good host security
  • We don't need host security, we have a good firewall
  • Let's go production with it now and we can secure it later
  • We can't stop the occasional problem
Posted on Monday, September 12, 2005 7:32 AM Security | Back to top

Comments on this post: The Six Dumbest Ideas in Computer Security

No comments posted yet.
Your comment:
 (will show your gravatar)

Copyright © Scott Kuhl | Powered by: