Absolutely No Excuse!

We work in a field populated by brilliant people.  But, like any field, it is also populated by charlatans.  I’m not trying to name call, but when I see a flagrant Security Development Lifecycle violation such as information disclosure of Personally Identifiable Information over a machine and trust boundary, I get upset.  At first I get mad and then I get sad.  It makes us all look bad.  It makes us all look like we don’t know what we are doing.  It huts the people whose information is disclosed, it hurts companies, it hurts livelihoods, it hurts the entire eco-system in which we all live.

I will make it simple …

If you are designing, architecting, developing or delivering software and you do not use Threat Modeling to understand what the security risks in your application are, you are committing malpractice. If you are not using Penetration Testing , you are committing malpractice.

There are so many resources out there, so many tools out there that there is absolutely no excuse other than ignorance or incompetence.  It would have been so simple to model that information disclosure threat.  Even the most simple model will expose it …

That’s as simple as they get.  A mobile device requests some data from a service across machine and trust boundaries.  The FREE TOOL (well you need Visio) will tell you all about information disclosure …

As well as all the other threat types associated with each and every element in your model, like Spoofing.   It will also let you plan out impacts and solutions.  It will even generate reports on what threats are still outstanding to be addressed.

You don’t have to be a security expert, but security is everyone’s responsibility from designer to developer to architect to tester.  Remember that.  Don’t be a charlatan.  Take your craft seriously.  Please.  If you don’t, you make us all look bad.

Comments

• Anonymous
  June 09, 2010
  :)

• Anonymous
  June 11, 2010
  Great post.

• Anonymous
  June 16, 2010
  The comment has been removed

• Anonymous
  June 16, 2010
  Rant ... post ... there's a difference? :)  Just trying to spread a little knowledge about some of the resources that are available out there!  But there's no doubt, this type of thing does upset me.