Security is both a process and a product, where the product is unfinished because the process is still evolving with many branches pointing to as many tentative solutions. The desire for clearly spelled out answers is understandable, but are clearly spelled out answers that are not right desirable? Let's make sure we evolve a few "right" answers, before we even think of standardizing anything.

Anyway, I am not too happy with my comments because I am too vague, and I know it: the problem with vagueness is that we can go round and round the apple tree without being able to resolve anything. Aside from that, vagueness is simply not actionable.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/207/24444#24444