Reply to thread

Message

<blockquote data-quote="ForgottenSeer 95367" data-source="post: 1010036">Then why are the most secure systems the ones that are static? Why do Microsoft, Google, Apple, the government agencies, DoD, banks and so on secure the most valuable systems with static deny-by-default? Why is it that dynamic protection where the user has to make allow-deny decisions are amongst the least secure?What a bizarre statement. DEFCON is not about proving any particular protection model is superior. That was never its intent. It has always been about discovering vulnerabilities and then exploiting them. That is the whole reason DEFCON was created.Did you even know that Microsoft supports DEFCON because it receives in-return the implementation guidance of security teams and researchers that back DEFCON hacking? Microsoft implements the security models promoted by those individuals. Why do they promote locked-down systems? Just like Schneier has said many times at DEFCON: &quot;Security is not software, it is a process.&quot; In that process it is user knowledge and behavior that are the defining characteristics of highly effective security.</blockquote>

[QUOTE="ForgottenSeer 95367, post: 1010036"] Then why are the most secure systems the ones that are static? Why do Microsoft, Google, Apple, the government agencies, DoD, banks and so on secure the most valuable systems with static deny-by-default? Why is it that dynamic protection where the user has to make allow-deny decisions are amongst the least secure? What a bizarre statement. DEFCON is not about proving any particular protection model is superior. That was never its intent. It has always been about discovering vulnerabilities and then exploiting them. That is the whole reason DEFCON was created. Did you even know that Microsoft supports DEFCON because it receives in-return the implementation guidance of security teams and researchers that back DEFCON hacking? Microsoft implements the security models promoted by those individuals. Why do they promote locked-down systems? Just like Schneier has said many times at DEFCON: "Security is not software, it is a process." In that process it is user knowledge and behavior that are the defining characteristics of highly effective security. [/QUOTE]

Verification