The “Immutable Laws” revisited
Once upon a time, somebody at Microsoft wrote an article on the “10 Immutable Laws of Security.” (I can’t recall how long ago: it’s now listed as “Archived content.” And I like the disclaimer that “No warranty is made as to technical accuracy.”) Now these “laws” are all true, and they are helpful reminders. But I’m not sure they deserve the iconic status they have achieved.
In terms of significance to security, you have to remember that security depends on situation. As it is frequently put, one (security) size does not fit all. Therefore, these laws (which lean heavily towards malware) may not be the most important for all users (or companies).
In terms of coverage, there is little or nothing about management, risk management, classification, continuity, secure development, architecture, telecom and networking, personnel, incidents, or a whole host of other topics.
As a quick recap, the laws are:
Law #1: If a bad guy can persuade you to run his program on your computer, it’s not your computer anymore
Law #2: If a bad guy can alter the operating system on your computer, it’s not your computer anymore
(Avoid malware, same as #1.)
Law #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore
(Quite true, and often ignored. As I tell my students, I don’t care what technical protections you put on your systems, if I have physical access, I’ve got you.)
Law #4: If you allow a bad guy to upload programs to your website, it’s not your website any more
(Sort of a mix of access control and avoiding malware, same as #1.)
Law #5: Weak passwords trump strong security
(You’d think this relates to access control, like #4, but the more important point is that you need to view security holistically. Security is like a bridge, not a road. A road halfway is still partly useful. A bridge half-built is a joke. In security, any shortcoming can void the whole system.)
Law #6: A computer is only as secure as the administrator is trustworthy
(OK, there’s a little bit about people. But it’s not just administrators. Security is a people problem: never forget that.)
Law #7: Encrypted data is only as secure as the decryption key
(This is known as “Kerckhoffs’ Law.” It’s been known for 130 years. More significantly, it is a special case of the fact that security-by-obscurity [SBO] does not work.)
Law #8: An out of date virus scanner is only marginally better than no virus scanner at all
(I’m not sure that I’d even go along with “marginally.” As a malware expert, I frequently run without a virus scanner: a lot of scanners [including MSE] impede my work. But, if I were worried, I’d never rely on an out-of-date scanner, or one that I considered questionable in terms of accuracy [and there are lots of those around].)
Law #9: Absolute anonymity isn’t practical, in real life or on the Web
(True. But risk management is a little more complex than that.)
Law #10: Technology is not a panacea
(Or, as (ISC)2 says, security transcends technology. And, as #5 implies, management is the basic foundation of security, not any specific technology.)