At this point only the combination with secure software and a secure software will do the trick and provide an acceptable level of overall security. The important thing is not to wait for the users to get more educated before you make your systems more
secure or the other aorund. This has to be a development that goes hand-in-hand.
I completely agree with you, even educating end-user's will not solve all security problems. It may, at best, help to mitigate security issues, but not solve them.
As soon as the newest security updates or software come out, I am one of the first people wanting to evalutate them. Although, as far as security patches go, it's pretty hard to get a straight answer out of Microsoft as to whether or not the updates will have
a negative effect on an Exchange Server!
I agree with you adwb, that we need to educate our end-users, but I also agree with Michael's stance towards his wife's email. Security needs to be in place by default and once the end-user has been educated and knows what the possible threats are, then
give them access to the extra's that are available within an application.
It's a shame that we have to address network and application security in terms of the least common denomitator. But my experience and that of others in the tech support community have proven out that it is the best course of action.
Very interesting presentation. I really like how he presents an example of how one group works together with another, the W2K03 group, to address issues preemptively.
I have always worked under the assumption that you don't browse from any server, much less a DC. But as Michael points out, you have to throw out all those assumptions and work in a "worst case scenario" frame of mind in order to build better and more secure
apps.
I definitely fall into the double-space category. Although after listening to Bill, I can see where things like this and underlining items definitely dates my typewriter training to my high school days.
I think now I will be more self-conscious of when I use formating tools like that.
Julie Larson-Green - Diving into the new Office 12
Sep 16, 2005 at 11:27 AMMichael Howard - What if we had an unattackable system?
Apr 08, 2004 at 10:05 AMI completely agree with you, even educating end-user's will not solve all security problems. It may, at best, help to mitigate security issues, but not solve them.
As soon as the newest security updates or software come out, I am one of the first people wanting to evalutate them. Although, as far as security patches go, it's pretty hard to get a straight answer out of Microsoft as to whether or not the updates will have a negative effect on an Exchange Server!
Michael Howard - What if we had an unattackable system?
Apr 07, 2004 at 4:57 PMIt's a shame that we have to address network and application security in terms of the least common denomitator. But my experience and that of others in the tech support community have proven out that it is the best course of action.
Michael Howard - When does threat modeling come into play?
Apr 07, 2004 at 4:50 PMI have always worked under the assumption that you don't browse from any server, much less a DC. But as Michael points out, you have to throw out all those assumptions and work in a "worst case scenario" frame of mind in order to build better and more secure apps.
Bill Hill - There is only one space after a period
Apr 06, 2004 at 4:44 PMI think now I will be more self-conscious of when I use formating tools like that.
Bill Hill - Windows is not the most important OS
Apr 06, 2004 at 4:38 PMVery nice job, but do small children count as beta versions or "1.x" rev's?