Schneier: Beware security products

TalkBack 2 of 8:

Next »

« Previous

• Thread View
• Flat View

RE:: "the brain is just barely functioning in the security community"

And the blame resides equally with "vendors" as with "customers."

Too many vendors "blowe smoke" (aka over sell a product's true capabilities, largely by selling "features" as if they automatically represent a vetted architecture) and hide vital information (some times in the face of direct questions) about what their latest-and-greatest does not manage to accomplish... as if disclosing the truth amounts to some kind of "confessional."

Both failures are not to be excused.

Customers have to be faulted for being pre-disposed to seek out SnakeOil/SilverBullet/EasyButton "solutions" to complicated InfoSec problems.

The brain *is* *barely* functioning.

People are not thinking strategically and pro-actively. They are mostly reacting and they are conditioned to spending out their quarterly budgets according to a deadline.

That's why so much garbage gets sold and bought in the name of Security.

Security is hard and the hardest parts are very easy to get wrong.

Real, root problems have to be sussed out, then their causes have to be guessed at and analyzed and confirmed, before we can begin to know what really needs to be done. Only then can we begin to piece together the parts that might solve the problem.

It's also a much bigger problem than, "these products/technologies are good," and, "those
are bad." That is the most simplistic sift that *always* has to be made; but even the "good" products can only be sanely utilized within the scope of their own strengths and weaknesses.

We abhor and ignore complexity.

An EasyButton is fine for photocopiers and buying office supplies.

There is just no such thing in RealWord InfoSec.

Posted by: wti   Posted on: 10/24/07 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Open Standards Technologies Provide the Ingredients for Delivering Security Across the Papa Gino's Enterprise Dell Papa Gino's Holdings Corporation founded by the entrepreneur operates one ... Download Now
• Email Security and Archiving - Clearer in the Cloud Google The time is NOW for businesses and organizations of all sizes to implement ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now