full-disclosure - Re: The Death of Defence in Depth ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Oct 2007 19:29:00 +0100
From: imipak <imipak@...il.com>
To: "Thierry Zoller" <Thierry@...ler.lu>, 
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: The Death of Defence in Depth ? -
	Aninvitation to Hack.lu

Hi Thierry,

wandering off-topic, but this is FD, where There Is No Topic...:

> What currently is being done in the industry is to ADD more layers of
> defence to protect against one failing, this is being done by adding
> one parsing engine after the other. Again nobody said Defence in Depth
> is wrong in itself, it's just the way the Software Industry has led
> companies to implement it. _This_ is the point.
>

The problem - well, *a* problem, anyway -  is that there are two
contradictory axioms in infosec that are regularly cited to support or
attack a particular strategy.

"Defence in depth"

   vs.

"A chain is only as strong as it's weakest link".

Expressing these in terms of formal logic and resolving the conflict
is left as an exercise for the reader. (I don't know how to do it...)

/i

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/