On Wed, 10 Oct 2007, Thierry Zoller wrote: > What currently is being done in the industry is to ADD more layers of > defence to protect against one failing, this is being done by adding > one parsing engine after the other. Again nobody said Defence in Depth > is wrong in itself, it's just the way the Software Industry has led > companies to implement it. _This_ is the point.
Defense in depth is nothing without the venerable principle of least privilege. The right way to implement it is to split--to compartmentalize--existing system into mutually untrusting components with the minimal set of privileges needed for their task. A sandwich made of existing bloated systems and additional pieces of bloated so-called "security software", all of them running with as many privileges as possible, is not defense in depth. It is vulnerability in depth. Unfortunately, the right way provides too few (if any) opportunities to sell new shiny boxes so it is very unappealing for the "security industry". --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ] "Resistance is futile. Open your source code and prepare for assimilation." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
