Copyright © 2010 What The Hell? Security
Do intractable security problems exist? Give me a break.
In applicability to business I mean. Think you found one? Tells me you don’t grok the problem you’re trying to solve. Tells me your business requirements — you do have business requirements, right? — just ain’t crisp enough.
Got any intractable availability problems? We’ve all experienced those “We need 100% availability” projects. Technologically, the closest we’ve ever come to anything near that is dial tone, in the days before 4P4C-to-ISP converters. “100% availability” is inevitably the comeback to your observation, “You forgot to specify your availability requirement.” Hell, that’s what I’d order if it was on the menu. Supersize me on security while you’re at it.
Got any intractable performance problems? Got any intractable quality problems? Got any intractable reliability problems? Ok, you got me on some of those.
Bottom line, when faced with any of these problems, somebody involved doesn’t know what they are doing. Possibly you.
Business goals lead to business requirements lead to technical design lead to technical specifications lead to starting the work. Did you get that?
- Business goals
- Business requirements
- Technical design
- Technical specifications
- Starting the work
Encountering an intractable problem — security or otherwise — at any one stage means something went haywire before it. And if you encounter it at the first stage…run like hell.
Filed under: security, security sense
Good point. A common way of looking at these kind of issues is that there are Explicit Requirements (which people are OK at defining – this is what the user wants) and Implicit requirements (which people are lousy at defining and they expect without having to ask for it).
A good example I read the other day but can’t find the reference is that no-one orders a Big Mac “Hot”. We expect hot and are dissatisfied if it doesn’t arrive that way. Security features can and probably should be treated in the same way, so long as they don’t significantly impact on Explicit requirements.