The Source for Java Technology Collaboration
User: Password:



Philip Brittan

Philip Brittan's Blog

Security Strategies

Posted by pbrittan on December 15, 2003 at 09:30 AM | Comments (4)

The IT security outlook just seems to be getting worse. Maybe it's time to change the rules.

We are being bombarded these days about the increasing threat of security. Microsoft has long been a target in this area, as have Java, and Flash, but now Linux is also coming under attack. The attacks are coming with greater frequency and with greater destructive power, and they are coming in the form of malicious code, or "malware".

In order to make significant headway in the struggle against malware, we need to fundamentally change the rules of the game. In a recent article for CNET News.com, "Inherent Insecurity", I argue that fat-client architectures are inherently vulnerable to attack, and that by switching to a thin-client model we can cut down on the amount of raw material that malware has to attack. In another article, "Fencing In" for ZDNet, I argue that we need to change our basic security posture and actively contain threats rather than huddle in our bunkers. I cite early examples of fence in strategies being used against viruses, hackers, and spam. Interestingly, I just came across another application of the fence in approach being suggested for flu vaccinations.


Bookmark blog post: del.icio.us del.icio.us Digg Digg DZone DZone Furl Furl Reddit Reddit
Comments
Comments are listed in date ascending order (oldest first) | Post Comment

  • unsigned JWS - a better alternative Today, large enterprise applications are being deployed using the secure unsigned Java Web Start container. These applications are free from viruses and spyware. Most importantly, you do not have to trust the software provider; you only have to trust the container (JWS/JRE). It's all about trust. Internet applications and services can be written in such a way so the server can't decrypt the data passing between clients. In such a scenario you only have to trust JWS/JRE, the receiver of your data, and the laws of physics/mathematics. Check out ScheduleWorld for an example of a client-server system that has been doing exactly this for over a year.

    Posted by: markswanson on December 16, 2003 at 11:04 AM

  • Security State

    I blogged my reply, Security State.

    Posted by: johnm on December 16, 2003 at 09:20 PM





Powered by
Movable Type 3.01D
 Feed java.net RSS Feeds