full-disclosure - Re: The Death of Defence in Depth ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 13 Oct 2007 03:07:15 +0200 (CEST)
From: Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: The Death of Defence in Depth ? - An
 invitation to Hack.lu

On Wed, 10 Oct 2007, Thierry Zoller wrote:

> What currently is being done in the industry is to ADD more layers of
> defence to protect against one failing, this is being done by adding
> one parsing engine after the other. Again nobody said Defence in Depth
> is wrong in itself, it's just the way the Software Industry has led
> companies to implement it. _This_ is the point.

Defense in depth is nothing without the venerable principle of
least privilege. The right way to implement it is to split--to
compartmentalize--existing system into mutually untrusting components
with the minimal set of privileges needed for their task.

A sandwich made of existing bloated systems and additional pieces of
bloated so-called "security software", all of them running with as many
privileges as possible, is not defense in depth. It is vulnerability in
depth.

Unfortunately, the right way provides too few (if any) opportunities to
sell new shiny boxes so it is very unappealing for the "security 
industry".

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/