Darren New wrote:

> Well, here's a question for you. Other than very generic advice like 
> "don't use predictable secrets" and "don't execute code from untrusted 
> users" (which really covers a lot more than you may think), what would 
> you teach?

How about

   Rule #1: You will NOT "add security later". It doesn't workt that way.

If more people understood that, things would be *so* much better! Too 
many people think "security" is just something you can buy in a box and 
install as a seperate item. It isn't.

Of similar signifigance,

   Rule #2: People WILL try to circumvent security if it inconviniences 
them too much.

After that we get into smaller details, such as

   Rule #3: Any user-supplied data should be thoroughly checked before 
use. [For reliability as much as security.]

   Rule #4: Treat network data with suspicion unless you are absolutely 
sure where it came from.

and so forth.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message