<story><title>Security Architecture Anti-Patterns</title><url>https://www.ncsc.gov.uk/whitepaper/security-architecture-anti-patterns</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>This is pretty unhelpful; the case I would make is that it&amp;#x27;s providing security largely by defining the problem away. For instance: it&amp;#x27;s usually unrealistic to require that all administration happen through clean-room systems that don&amp;#x27;t ever browse the web.&lt;p&gt;The real-world practice of security is in large part the deployment of risky systems with mitigations in place for the likely attacks that will target them. So, for instance, getting everyone to talk to the admin console on a purpose-built Chromebook with no Internet access is probably not a realistic option, but getting every system with admin console access MDM&amp;#x27;d and requiring access to admin consoles to route through an IdP like Okta to enforce 2FA is much more realistic, and thus likely to happen.&lt;p&gt;The patterns in here that aren&amp;#x27;t unrealistic are pretty banal. I don&amp;#x27;t doubt that UK NCSC sees systems designed to be unpatchable, but modern engineering norms (Docker, blue&amp;#x2F;green, staging&amp;#x2F;cert environments) --- norms that have really nothing to do with security and are common to pretty much every serious engineering shop --- address that directly anyways.&lt;p&gt;Other patterns don&amp;#x27;t really make sense; for instance: you should design to make your systems patchable (sure, that&amp;#x27;s again a basic engineering requirement anyways), but also make sure your dev and staging environments aren&amp;#x27;t continuously available. Why? Those are conflicting requirements.</text></comment>
<story><title>Security Architecture Anti-Patterns</title><url>https://www.ncsc.gov.uk/whitepaper/security-architecture-anti-patterns</url></story><parent_chain></parent_chain><comment><author>closeparen</author><text>This is &lt;i&gt;amazingly&lt;/i&gt; concrete and understandable from a technical perspective for a government security document. Where can I find more like this?&lt;p&gt;Everything I’ve seen in ISO security standards, for example, is written at an abstract theoretical level about the design of security bureaucracy rather than the design of actual systems.&lt;p&gt;One bone to pick: basically all tech companies expect you to be oncall for your services via your laptop. They’re not paying anybody to sit in the office overnight, and commuting in when you get paged with seriously delay mitigation. Is “browsing down” even possible under those circumstances?</text></comment>