{"id":55431,"date":"2024-02-25T16:09:12","date_gmt":"2024-02-25T16:09:12","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/security-is-hard-because-it-has-to-be-right-all-the-time-yeah-like-everything-else\/"},"modified":"2024-02-25T16:09:12","modified_gmt":"2024-02-25T16:09:12","slug":"security-is-hard-because-it-has-to-be-right-all-the-time-yeah-like-everything-else","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/security-is-hard-because-it-has-to-be-right-all-the-time-yeah-like-everything-else\/","title":{"rendered":"Security is hard because it has to be right all the time? Yeah, like everything else"},"content":{"rendered":"

Systems Approach<\/span> One refrain you often hear is that security must be built in from the ground floor; that retrofitting security to an existing system is the source of design complications, or worse, outright flawed designs.<\/p>\n

While it is the case that the early internet was largely silent on the question of security, I suspect \u201cretrofitting\u201d is often used pejoratively. Certainly there have been convoluted and short-sighted attempts to improve security, but the internet has also evolved to include a sound architecture for securing end-to-end communication. Focusing on stopgap mechanisms is never a good recipe for understanding the underlying principles, no matter what aspect of a system one is talking about.<\/p>\n

In a similar vein, it is worth remembering that the early internet came up significantly short on other requirements. On scalability, for example, it was originally assumed that all host-to-address bindings could be managed using a centralized hosts.txt file that every system admin had to download once a week, and EGP<\/a> assumed a simple, loop-free \u201ccatenet\u201d model of inter-network routes.<\/p>\n

These, and similar limitations, were corrected over time, for example, with DNS and BGP, respectively. And today it is straightforward to explain the system design techniques \u2014 eg, aggregation and hierarchy \u2014 that were then applied.<\/p>\n

The question to ask is: What are the analogs for security?<\/p>\n