Presumed security

Presumed security is a principle in security engineering that a system is safe from attack due to an attacker assuming, on the basis of probability, that it is secure. Presumed security is the opposite of security through obscurity. A system relying on security through obscurity may have actual security vulnerabilities, but its owners or designers deliberately make the system more complex in the hope that attackers are unable to find a flaw. Conversely a system relying on presumed security makes no attempt to address its security flaws, which may be publicly known, but instead relies upon potential attackers simply assuming that the target is not worth attacking. The reasons for an attacker to make this assumption may range from personal risk (the attacker believes the system owners can easily identify, capture and prosecute them) to technological knowledge (the attacker believes the system owners have sufficient knowledge of security techniques to ensure no flaws exist, rendering an attack moot).

Although this approach to security is implicitly understood by security professionals, it is rarely discussed or documented. The phrase "presumed security" appears to have been first coined by the security commentary website Zero Flaws.[1] The article uses the Royal Military Academy Sandhurst as an example, focusing on the apparent lack of entry security and contrasting it against the presumed security a military installation will have. The article also details the flaws inherent in a trust seal such as the Verisign Secure Site seal, and explains why this presumed security approach is actually detrimental to an overall security posture.

References & notes
  1. "Zero Flaws: Presumed Security". Archived from the original on October 16, 2012. Retrieved 2009-08-23.CS1 maint: BOT: original-url status unknown (link)
gollark: *Cool* batteries, i.e. lithium ion ones, are 3.7Vish or something.
gollark: The original intended use *was* just mice and keyboards and whatnot.
gollark: 12V might have been good. I'm not sure why they didn't use it.
gollark: USB-C with whatever power delivery stuff can do 12V, at least.
gollark: Running USB devices off alkaline batteries is kind of niche and was especially niche when the standard was made.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.