Professional Microsoft IIS 8

What Is Security?

Security can be defined as a state of freedom from attack or danger. Current security orthodoxy teaches us that the only totally secure computer is one that is switched off, encased in concrete, and dumped at the bottom of the ocean. And this should tally with any system administrator's experience. There are very few, if any, nontrivial software products that have shipped to date that haven't contained some kind of security vulnerability. Even if the software itself is completely bug-free, it may be compromised because of the way in which it interacts with other systems, or because of poor operational practices (for example, the use of easily guessable passwords).

Even the type of totally secure system mentioned above (encased in concrete at the bottom of the ocean) might not be classified as a secure system. A secure system will deny access to those who are unauthorized, yet allow access to those who are authorized. In other words, it's usable by those permitted to use it and no one else. The machine at the bottom of the ocean fails this usability test. In fact, this need to distinguish between legitimate users and those who should be denied access is one of the things that makes security difficult. It's easy to write a system that gives access to everyone, or conversely denies access to everyone, but much more difficult to write a system that allows the good guys in but keeps the bad guys out.

What security researchers and books try to focus on is educating ...