Get it right the first time

摘要

Industry discussion regarding how to improve information security and secure products from malicious attacks has focused on post-installation solutions (such as patch management). Unfortunately, the exorbitant costs of such measures are rarely'considered. A better, more cost-effective approach should focus on the heart of security -developing secure coding. Opponents of this argument say we cannot have perfect code and therefore should not try for good code. But the software industry has not made a concerted effort to write better code so it is too early to surrender. It does not make sense to give up when we appear to have plenty of time to invent new technologies that do not solve meaningful problems.