Beefy Boxes and Bandwidth Generously Provided by pair Networks
Just another Perl shrine
 
PerlMonks  

Re: Secrets & Lies & Perl

by clemburg (Curate)
on Sep 04, 2001 at 18:47 UTC ( #110046=note: print w/ replies, xml ) Need Help??


in reply to Secrets & Lies & Perl

What else should I be watching out for? And as a general practice, how much bullet-proofing do programmers put into code before they say that enough is enough. I mean, theoretically I could check every variable all the time to make sure it is about what I expect it to be like, I could wrap almost everything in evals to trap errors, I could go on. But how do you draw the line?

A rational way to "draw the line" would be to do a risk assessment and cost/benefit analysis on your code. A good introductory discussion is provided in Chapter 2 "Policies and Guidelines" of Practical Unix and Internet Security by Simon Garfinkel and Gene Spafford.

Also, if I recall correctly, Mr Schneier himself presents an approach to threat modeling and risk assessment in the book you mention.

To actually "draw the line", you will have to think and decide for yourself. No magic bullets here. And it will probably not be a really "rational" decision, either.

Christian Lemburg
Brainbench MVP for Perl
http://www.brainbench.com


Comment on Re: Secrets & Lies & Perl
(redmist) Re: Re: Secrets & Lies & Perl
by redmist (Deacon) on Sep 04, 2001 at 21:55 UTC
    A rational way to "draw the line" would be to do a risk assessment and cost/benefit analysis on your code.

    This is really the only sane way to manage security. Even though there is no such thing as real, absolute security, there is such thing as more secure. This increase in security has a neccessary increase in time and manpower related to it. You just have to look at what kind of data you are handling, the sensitivity of the data, how much you care, how much time and money you have, and countless other factors, and then make a security model for yourself.

    The cost of superior security is eternal vigilance.

    redmist
    Purple Monkey Dishwasher

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://110046]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others imbibing at the Monastery: (3)
As of 2014-09-18 00:31 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    How do you remember the number of days in each month?











    Results (101 votes), past polls