The six dumbest ideas in computer security (News)

Overview

In this episode of The Changelog, Adam Stacoviak and Jerod Santo revisit Marcus J. Ranum's 2005 post on the six dumbest ideas in computer security. They explore how these ideas remain relevant today, highlighting the industry's tendency to prioritize flashy solutions over common sense. Adam notes that security practitioners should challenge conventional wisdom, as the current rate of system compromises suggests that traditional approaches are failing 1.

Your job as a security practitioner is to question, if not outright challenge, the conventional wisdom and the status quo.

--- Adam Stacoviak

The hosts outline the six ideas, including default permit, enumerating badness, penetrate and patch, hacking is cool, educating users, and action is better than inaction 1.

   

Analysis

The episode delves deeper into the absurdity of these ideas, particularly focusing on "default permit" and "penetrate and patch." Jerod criticizes the "default permit" approach, which involves granting permissions and seeking forgiveness later, as a flawed security strategy. Adam adds that "penetrate and patch," where new code is used to fix old vulnerabilities, is a never-ending cycle that fails to address root causes 1.

Dumb idea number one, default permit, which is giving permission and asking for forgiveness.

--- Jerod Santo

These practices, they argue, reflect a broader issue in computer security where quick fixes are favored over sustainable solutions 1.