The main difference I see is that security no longer is a state of mind, as it was back then. These days, security is an off-the-shelf product that you slap on to your system, or downloadable vendor patches. It's not even up to the sysadmins to decide on security changes -- it's done the corporate way, with security as a product, only to be obtained from a vendor.
The average 2004 sysadmin is blissfully ignorant about how his or her systems really work, and won't examine or fix security problems, as that's as likely to get him fired as anything.
Where this becomes a big problem is with in-house software, which has a MUCH lower quality level today than in 1994, when it often was coded by the admin who ran the system, or at least was examined and tested by someone who understood the environment and security.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/272/28846#28846