January 17, 2008

Security by design

Tao security published, some day ago, an article about Defensible Network Architecture 2.0.
The main idea of the article is to start monitoring, getting a deeper understanding of a network or a complex system and then proceed to securing it. While I think the article itself is very insightful, there's something I must note: there is no Design. That's something happening more and more in the real world: the absence of design. Networks start small, they grow bigger and bigger as months pass and no one got a clue of what's happening. I'm not speaking about single hosts, firewall configurations or so on: I'm speaking about the role of IT in the organization.

If you want to claim the infrastructure, one can say, you have to understand how it works. I disagree. You need the why before the how.
If you want a real governance - and security demands such a governance - you don't have to monitor what's already there and then start thinking about security. You have to think: what kind of services does my business need? What's really important, and what's not? Only when you have such a knowledge of the purpose of IT in your organization, you can start monitoring, inventoring and controlling.Designing!

We need to get back design: complex infrastructures are simply getting out of control without proper guidance, and there's no such thing as a "quick solution".