In the large companies I've worked for, "only allow the good" is indeed taken to heart. The trouble is that the best and safest definition of "the good" for security personnel is "nothing at all". There is no protocol that is *provably* not usable by a cracker (people have tunneled Telnet over DNS, for example), and security people are not rewarded for stopping threats, they are only punished (often by being sacked) for failing to stop them.

As a result, the only portals that are opened (and there are a lot of them) are those that the suits with enough clout care enough about to get the definition of "the good" changed. These suits know nothing and care less about security, so we get the current mess, when useful technologies aren't available inside "the firewall" but fashionable ones are.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/334/34619#34619