FW: Forrester Research foresees death of firewalls

[Harvey Nusz <Harvey_Nusz () administaff com>]

Is it wise to build a bridge on the "just strong enough" theory (and I know
we're talking money and time), when we do not know who or what will traverse
the bridge, or perhaps even how it will be used?  Granted, we can perhaps
add to the strength of the bridge, given the right architecture, and the
right metrics for feedback... but this appears to go back to the
requirements (and SLA), and are they affirmed at the right level....

This is a good discussion; just some more thoughts.

Thanks,

Harv

-----Original Message-----
From: Bennett Todd [mailto:bet () newritz mordor net] 
Sent: Monday, June 21, 1999 11:36 AM
To: Robert Graham
Cc: 'firewall-wizards () nfr net'
Subject: Re: Forrester Research foresees death of firewalls


1999-06-17-04:09:26 Robert Graham:
> This reminds me of a lecture I once attended about bridge building. The
> idea is that bridges are always overbuilt in a very conservative
> manner. 
>
> As time goes on, builders gain confidence (because none of the bridges
> are failing) and take more risks (fewer materials, longer spans, etc.)
> until POOF a bridge fails, then the go back into conservative mode.

This analogy in turn reminds me of one of my favourite engineering quotes
(wish I knew just where it came from): It's easy to build a bridge that
doesn't fall down; what takes skill is building a bridge that just _barely_
doesn't fall down.

I think it's relevant to the target of the analogy. It's easy to provide
good
tight security by erring on the cautious side, being more restrictive than
strictly necessary. The closer you want to get to the fine line of barely
enough protection, the more precise and careful you must be.

-Bennett