[SC-L] "Checklist Manifesto" applicability to software security

2010-01-07 Thread Jeremy Epstein
Greetings, I was listening yesterday to an interview [1] on NPR with Dr. Atul Gawande, author of "Checklist Manifesto" [2]. He describes the problem that medical procedures (e.g., surgery) tend to have lots of mistakes, mostly caused because of leaving out important steps. He claims that 2/3 of

Re: [SC-L] "Checklist Manifesto" applicability to software security

2010-01-07 Thread Brian Chess
I think it's a great analogy. If you'd like to read more without ordering the book, here's an article Gawande wrote for the New Yorker in 2007: http://www.newyorker.com/reporting/2007/12/10/071210fa_fact_gawande Brian On 1/7/10 7:11 AM, "Jeremy Epstein" wrote: > Greetings, > > I was listenin

Re: [SC-L] "Checklist Manifesto" applicability to software security

2010-01-07 Thread Benjamin Tomhave
I think there's lots of applicability. People - especially techies - cut corners. The pressure is usually to get things done in a certain amount of time, and then add on that people like to generally expend as little energy as possible, and viola! you see the problem. Of course, the flip side is t

Re: [SC-L] "Checklist Manifesto" applicability to software security

2010-01-07 Thread Andy Steingruebl
On Thu, Jan 7, 2010 at 7:11 AM, Jeremy Epstein wrote: > Greetings, > > So as I was listening, I was thinking that many of the same things > could be said about software developers and problems with software > security - every piece of software is unique, any non-trivial piece of > software is amaz

Re: [SC-L] "Checklist Manifesto" applicability to software security

2010-01-07 Thread Gary McGraw
hi sc-l, I am pretty sure that Brian Chess used to have this in his standard talk some many years ago. Then again I am getting old. Great analogy. Note that checklists DO NOT take the place of the intensive care staff! gem On 1/7/10 10:11 AM, "Jeremy Epstein" wrote: Greetings, I was lis