Procedure is Key to Good Security
eLABorations: It's important to have a plan in place because products focus on performance, not on foiling attacksWhile I agree in theory with the recent eWeek editorial, "Its Time to Abandon Insecure Languages," I think IT managers will have to do something about insecure Web sites, applications and network infrastructure before ISVs and code jockeys finally decide to produce applications and devices that are designed with security in mind. My recommendation, based on a number of conversations with mainly front-line IT specialists, along with reading a large number of security-oriented product pitches and books, is to focus on procedure. In the just released book, "Hacking Exposed, Web Application Security Secrets and Solutions," by Joel Scambray and Mike Shema ($49.99 in paperback, from McGraw-Hill/Osborne, the authors begin by discussing reconnaissance, in the now-classic approach of anti-hacking books. In much the same way that every book Ive read about TCP/IP starts out talking about the seven layers of an IP protocol stack, this book starts out with a basic discussion of how Web applications are architected and how they work. (You can read my complete book review here.)
My point is that IT managers actually need to focus on putting a basic security plan in place because products, in general, have been written first of all with performance in mind. And with almost no outside regulation (meaning laws and rules that set standards for performance), software and hardware makers have developed some very risky behaviors. They get away with these risky behaviors because productivity gains from using their products outstrip losses due to faults or leaky security.