Security Considerations in Modern Distributed Computing Architecture/e-Businesss

by John Viega, Jeffrey Voas

Today's state-of-the-art in computer and software security is dismal. The main reason for this is that most companies do not have a deep enough understanding of the serious technical risks that exist to make intelligent decisions about reducing those risks. For the most part, companies simply do not have qualified personnel to aid them in making appropriate decisions. Because of this, organizations are more likely to deploy less-than-secure systems without realizing the danger until a security problem is discovered. Another factor is that companies get wrapped up in the fear, uncertainty, and doubt (FUD) spread by unscrupulous security vendors who are purely profit-driven. Companies not only buy inferior solutions from these vendors, they also "buy in" to the information the vendors provide. This combination of a lack of inhouse expertise and a reliance on vendor hype can be dangerous.