Security in Ten Years

Conversation between Schneier and Marcus Ranum. 

http://www.schneier.com/blog/archives/2007/12/security_in_ten.html

Marcus Ranum: I think you're right; at a meta-level, the problems are going to stay the same. What's shocking and disappointing to me is that our responses to those problems also remain the same, in spite of the obvious fact that they aren't effective. It's 2007 and we haven't seemed to accept that:

• You can't turn shovelware into reliable software by patching it a whole lot.
• You shouldn't mix production systems with non-production systems.
• You actually have to know what's going on in your networks.
• If you run your computers with an open execution runtime model you'll always get viruses, spyware and Trojan horses.
• You can pass laws about locking barn doors after horses have left, but it won't put the horses back in the barn.
• Security has to be designed in, as part of a system plan for reliability, rather than bolted on afterward.

The list could go on for several pages, but it would be too depressing. It would be "Marcus' list of obvious stuff that everybody knows but nobody accepts."