So true. I once lived in an apartment block where a lot of the other apartments on my floor were burgled one day.
The locks did.. nothing. The thieves simply kicked the doors until they splintered at the lock. In fact, one door even snapped clean in half, so it ended up looking like a stable door, with a lower bit no longer attached to the lock which was now opening freely.
I'd wager it took them a similar amount of time to do this as picking a lock would have taken for someone experienced, and with far less training.
It taught me a very practical lesson about security. You can spend a lot of energy engineering the perfect lock, but always be aware that there will likely be obvious (once they've happened at least), perhaps very course, hacks which make that brilliant lock totally redundant.
The parallels to software security are obvious. To loosely quote Richard Campbell, it doesn't matter how strong your password is, if a truly determined bad guy wants to get at your data, they'll just use a wrench ;-)
The locks did.. nothing. The thieves simply kicked the doors until they splintered at the lock. In fact, one door even snapped clean in half, so it ended up looking like a stable door, with a lower bit no longer attached to the lock which was now opening freely.
I'd wager it took them a similar amount of time to do this as picking a lock would have taken for someone experienced, and with far less training.
It taught me a very practical lesson about security. You can spend a lot of energy engineering the perfect lock, but always be aware that there will likely be obvious (once they've happened at least), perhaps very course, hacks which make that brilliant lock totally redundant.
The parallels to software security are obvious. To loosely quote Richard Campbell, it doesn't matter how strong your password is, if a truly determined bad guy wants to get at your data, they'll just use a wrench ;-)