Re: Castles and Security (fwd)

[George Capehart <capegeo () opengroup org>]

(To avoid a growing CC: list, I'm just sending this to fw-wiz)

Bill_Royds () pch gc ca wrote:
>

<snip great discussion of what happens when one attempts to turn a
problem of multiple analog dimensions into one of one dimension that has
only two values.>

This has been a *great* thread.  It's threads like this that I wish
everyone who is concerned with security issues could have access.  I've
lurked on this list (and others) for just such an opportunity.  I take a
holistic approach to security so I need to understand what's going on in
as many different areas as I have time to devote.

Things got started when Lance Spitzner asked about how reasonable it is
to use a castle as an analogy for describing the issues with which one
deals in network security.  There was a good exchange around that along
with side trips into the European Theater of WWII and the attempt at
making a distinction between guerillas and terrorists.  (I think it
depends upon whether the speaker is the attacker or the attackee). ;-> 
There was also Marcus' subthread on the idea of legislating the
definition of good guy and bad guy.  (Prohibition comes to mind here . .
. as does the effect of the Harrison Narcotic Act of 1924.  Before that,
Cokes were *really* cokes . . . now they have to use caffeine . . .)

To me, the most interesting aspect of the thread has been the
acknowledgment (once again) that it is impossible to defend against
truly determined adversaries but that Defense in depth is a Good Thing
(TM) and is usually necessary.  Seems to me that we're back to the
economics of security . . . defenders rarely spend more to defend a
target than it is worth to them and attackers spend as much on an attack
as they're willing to pay.  So that leaves us, IMHO, in the position of
needing to know the enemy (cf. The Art of War, Sun Tzu) and then, given
that understanding, define the risk to be managed and the strategy and
tactics for managing it (cf. Secrets & Lies, Bruce Schneier).

My
$0.02.                                                                                                        
--
George W. Capehart                            phone:  +1 (704) 277-4561
                                              fax:    +1 (704) 853-2624

"I'd rather have a bottle in front of me than a frontal lobotomy."
Anonymous

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards