Security is a process

An interesting comment on my article http://www.codeproject.com/useritems/HackingMd5.asp from Erik Westermann {dispatches}

What follows is a free translation of the comment (the original can be read here:http://www.codeproject.com/useritems/HackingMd5.asp#xx1231841xx

I think the intent is to demonstrate a very specific type of attack that exploits the inherent trust in the MD5 hash. It is a kind of semi-social engineering attack.

The attack shown in the article illustrates how the distributor-author-etc can distribute a “good” application and then start distributing a harmful application by exploiting the trust placed in the MD5 hash of the “good” application. Still, this is a very specific scenario, and it uses predefined vectors; nevertheless it helps reinforce a fundamental truth about security.

Bruce Schneier states that security is a process, not a product¹. This article demonstrates a specific attack that exploits the product-based view of security…“This file is safe because the MD5 hash I just calculated matches the published (and well-known) MD5 hash. The article highlights the importance of establishing a process that assumes products have flaws, manages the exposure to attacks and deals effectively with breaches.

I couldn’t say it better. Erik Westermann has brought out the aim of this article better than I did, and along the way we have reinforced an old lesson: security is a process.