Complexity Can Improve Security
Just over a year ago I discussed whether complexity is the enemy of security. I believed complexity is a significant threat to security. Like so many things in life, there is no simple black and white distinction here.
The best evidence for this is Jesper Johansson's Revisiting the 10 Immutable Laws of Security, Part 1. He argues that old rules, like "If a bad guy can persuade you to run his program on your computer, it's not your computer anymore." and " If a bad guy can alter the OS on your computer, it's not your computer anymore" are not necessarily true anymore.
The reason is that as systems get more complex there are more opportunities to block and recover. Think of humans. We're surrounded by bacteria, viruses (the biological kind) and other kinds of pathogens yet we survive quite well. The reason: resiliency born from biological complexity. Our IT systems of course are no where near that level of complexity but the principal is the same.
More on this later today. Johansson is on to something important and the paper is well worth reading.
UPDATE: The follow-up post I mention above is here.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
