Re: Security vs. Simplicity

Dear Avi,

(Managerial style answer)

First you will have to have a clear understanding of:
1) Business objective
2) Client requirements
3) Concerned Assets
4) Current business scenario
5) Present state of Assets and controls in place
6) Tradeoff (between Simplicity & Security) expected and accepted

And then you can derive your answer. That is "Design that system
according to the simplicity principal" or  "Design that system
according to the security principal"

If you ask me, I would definitely say: "Why not try and get best of
both the worlds....extract details from your client what he/she really
needs....add implicit+explicit quality parameters (whatever your
business permits....and deliver.... "    :)


Regards,

Meenal A. Mukadam




On Mon, May 18, 2009 at 9:02 PM, avi shvartz <yram@xxxxxxxxxxxxxxxx> wrote:

Hello list,



In a design process of a critical infrastructure system there is always a
tension between two tenets:

 The "simplicity tenet" - keep it simple as much as possible.

   And

 The "security tenet" - make it secure as much as possible.

I am perfectly aware of all risk evaluation and assessment, TCO calculations
etc, that suppose to

 help us all to reach a decision about "how much security" and "how much
simplicity".

But, we all know that gathering all relevant information and getting overall
agreement

 about them and about the calculations of the risk\tco calculations is not
"optimal" to say the least.

I am also aware to the statement : "simple design is also a secured design".

But, we all know that in real life the security folks wants to add "just
this extra layer (for security in depth)

 And\or "just this vlan (for yet another communication separation)" etc..

Don't get me wrong, I do understand that it's a valid concern,
 I just say that it's not always will be in line with the "simple" design
tenet.



Now, let's say that after all the technical discussions the two inflamed
opponents are in front of us
 (kind of real life situation.).



I would like to ask your opinion in the following way:

 Let say that you are the manager who have to say one statement (kind of a
bottom line):
  "Design that system according to the simplicity principal"
  or

  "Design that system according to the security principal"

 I would humbly ask for an answer in a "managerial style":
  first : what will be that bottom line.
  second: (kind of appendix.) any explanation that you wish to add.



Than you all for your kind attention,

Avi






------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Need to pass the CISSP? InfoSec Institute's CISSP Boot Camp in both Instructor-Led and Online formats is the most concentrated exam prep available. Comprehensive course materials and an expert instructor means you pass the exam. Gain a laser like insight into what is covered on the exam, with zero fluff!

http://www.infosecinstitute.com/courses/cissp_bootcamp_training.html
------------------------------------------------------------------------




--
Meenal A. Mukadam

-----------------------------------------------------------------
http://www.linkedin.com/in/meenalmukadam
-----------------------------------------------------------------
Far away there in the sunshine
are my highest aspirations.
I may/maynot reach them,
but I can look up and see their beauty,
believe in them and try to follow
where they lead
-------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Need to pass the CISSP? InfoSec Institute's CISSP Boot Camp in both Instructor-Led and Online formats is the most concentrated exam prep available. Comprehensive course materials and an expert instructor means you pass the exam. Gain a laser like insight into what is covered on the exam, with zero fluff!

http://www.infosecinstitute.com/courses/cissp_bootcamp_training.html
------------------------------------------------------------------------

Relevant Pages

  • Re: Security vs. Simplicity
    ... I am perfectly aware of all risk evaluation and assessment, TCO calculations ... I am also aware to the statement: "simple design is also a secured design". ... we all know that in real life the security folks wants to add "just ...   "Design that system according to the simplicity principal" ...
    (Security-Basics)
  • RE: Security vs. Simplicity
    ... If a process is overly complicated - it will not be secure. ... but without this there is no security. ... I am also aware to the statement: "simple design is also a secured ...   "Design that system according to the simplicity principal" ...
    (Security-Basics)
  • Re: Security vs. Simplicity
    ... I agree that the goals of network ops and network security seemingly ... defense in depth and secure design over all else. ...   "Design that system according to the simplicity principal" ...
    (Security-Basics)
  • Re: Security vs. Simplicity
    ... tension between two tenets: ... I am also aware to the statement: "simple design is also a secured design". ... we all know that in real life the security folks wants to add "just ...   "Design that system according to the simplicity principal" ...
    (Security-Basics)
  • Re: Security and EOL issues
    ... OS software resources are designed that reserved ram and disk space among other resources, to reflect what current hardware size is available. ... (There was a security patch a few years ago that could not be applied to NT4 as it required more resources then NT4 could provide. ... Installing air bags requires that the automobile manufacturer design, test, ... Computer Emergency Response Teams, and Digital Investigations. ...
    (Security-Basics)