way back when ... it was about designing & implementing systems/infrastructure to prevent bad things happening.
some slight (nearly 40yr old) drift:
http://www.nsa.gov/selinux/list-archive/0409/8362.cfm
now we have a lot of systems/infrastructures where it is all about attempting to recognize when bad things have happened ... and the basic systems/infrastructures are effectively recognized as extremely vulnerable ... and solutions are effectively done in terms of bailing wire and chewing gum.
(one might be tempted to say that things have severely regressed and there is little lore left anymore about prevention)
recent reference:
http://www.garlic.com/~lynn/aadsm27.htm#48 If your CSO lacks an MBA, fire one of you
old buffer overrun post
http://www.garlic.com/~lynn/2005d.html#55 Buffer overruns
with these references
Microsoft Researchers Target Worms, Buffer Overruns
http://www.neowin.net/comments.php?id=27321&category=main
Microsoft researchers target worms, buffer overruns
http://www.infoworld.com/article/05/03/03HNmicrosoftworms_1.html
Microsoft Researchers Target Worms, Buffer Overruns
http://www.pcworld.com/news/article/0,aid,119891,00.asp
or this old post:
http://www.garlic.com/~lynn/2000.html#25 Computer of the century
with reference to discussion of how to deal with some number of C-language related coding problems .... 90% of which wouldn't happen in various other programming languages.
passing reference at a assurance panel in 2001 to comment about m'soft holding up windows 2000
http://www.garlic.com/~lynn/aadsm5.htm#asrn4
I remember in the early 80s ... where state-of-the-art had progressed to the point where work was going on ... not with regard to outsider attacks or straight-forward insider attacks (supposedly still responsible for up to 70percent of the fraud) ... but the state-of-the-art was "collusion" countermeasures .... i.e. organized groups of insiders attempting to bypass provisions preventing insiders from subverting the systems.
misc. past posts mentioning that early 80s security state-of-the-art focusing on insider collusion (i.e. having procedures in place for outsider attacks and the simple, straight-forward insider attacks)
http://www.garlic.com/~lynn/aadsm3.htm#kiss10 KISS for PKIX. (authentication/authorization seperation)
http://www.garlic.com/~lynn/aadsm7.htm#auth Who or what to authenticate?
http://www.garlic.com/~lynn/aadsm9.htm#pkcs12d A PKI Question: PKCS11-> PKCS12
http://www.garlic.com/~lynn/aadsm11.htm#10 Federated Identity Management: Sorting out the possibilities
http://www.garlic.com/~lynn/aadsm12.htm#33 two questions about spki
http://www.garlic.com/~lynn/aadsm18.htm#17 should you trust CAs? (Re: dual-use digital signature vulnerability)
http://www.garlic.com/~lynn/aadsm23.htm#10 PGP "master keys"
http://www.garlic.com/~lynn/aadsm24.htm#36 Interesting bit of a quote
http://www.garlic.com/~lynn/aadsm24.htm#40 Interesting bit of a quote
http://www.garlic.com/~lynn/2004j.html#15 US fiscal policy (Was: Bob Bemer, Computer Pioneer,Father of ASCII,Invento
http://www.garlic.com/~lynn/2005g.html#37 MVS secure configuration standard
http://www.garlic.com/~lynn/2005g.html#38 MVS secure configuration standard
http://www.garlic.com/~lynn/2005k.html#1 More on garbage
http://www.garlic.com/~lynn/2005v.html#2 ABN Tape - Found
http://www.garlic.com/~lynn/2006d.html#30 Caller ID "spoofing"
http://www.garlic.com/~lynn/2006k.html#16 Value of an old IBM PS/2 CL57 SX Laptop
http://www.garlic.com/~lynn/2006k.html#33 Password Complexity
http://www.garlic.com/~lynn/2006n.html#32 The System/360 Model 20 Wasn't As Bad As All That
http://www.garlic.com/~lynn/2007f.html#39 Silly beginner questions