Main Menu

Daily using/supporting

Get Firefox browser!
Get Thunderbird!
Get Opera browser!
Get The Gimp!
Get Inkscape!
Get LibreOffice!
Get Videolan!
Get Linux!
Get Mandriva!
Get Joomla!
Hacker Emblem

Popular Tags

Archives

Which topics would you like us to cover more?

Latest comments

Latest tweets

about 2 days ago Using REDIPS.drag to add drag and drop to your .Net webapplication #li #dib0 http://t.co/n8zY3s7d
about 8 days ago http://t.co/cknQcDbo #Kindle
about 16 days ago Freedom isn't the ability to choose what to do or say, but the ability to choose what not to do or say #freedom
21 Apr 2012 http://t.co/61KTQknI #Kindle
12 Apr 2012 Force the use of a networking adapter using C# #li #dib0 http://t.co/ZTJOPzOz
9 Apr 2012 http://t.co/k9yliR2t #Kindle
9 Apr 2012 Mandriva 2010.2 and USB devices in Virtualbox http://t.co/fwq9gbHB
9 Apr 2012 Execute a http request to you own site with PHP http://t.co/DIvWPrpd
Twitter
Prev Next
Home Architecture, security and coding Security rule #7: Dont't let the ends outweigh the means
Security rule #7: Dont't let the ends outweigh the means
Written by Division by Zero   
Wednesday, 27 January 2010 12:48

I've talked about how to be secure and how to be secure enough to cover the risk involved with our data. If we build an application, a tool which supports our user/client in achieving a specific goal, we need to balance between functionality, user friendliness and security. This is, in my opinion, the hard part of software development. This balance is represented in the following image.

Balance between functionality, security and user friendliness.



The dilemma is simple: if we add more functionality to our application, we are less secure and less user friendly. If we make are application easier to use we are less secure (nobody wants to enter an user-name and password, you just want to use this application!) and we have to leave out some functionality (more functionality is more complication and more confusion). If we are really secure, we are less user friendly and we have to have less functionality (with every functionality we increase our attack surface and the vulnerability of our application). The balance between these three will be different for every application and every situation. It depends on the risk involved, the business processes and the type of user you're dealing with. We have to find this balance for every application, for every change, every day. In searching and finding this balance a good developer will distinguish herself/himself from the rest.

Ok... the final rule, number 7, isn't so much about security, but it shows an underlying principle. Security is a quality aspect of your software. It is part of a general mindset, which is to create valuable, trustworthy and usable tools.

 

Tags:

Related Articles
 

Add comment


Security code
Refresh

I love deadlines. I like the whooshing sound they make as they fly by. - Douglas Adams


© 2009 - 2012, Division by Zero

Template based on the empire template by joomlashack 

Valid XHTML 1.0 Strict  Valid CSS!  Creative Commons License
This work by Division by Zero is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Netherlands License.