do not trust
© 2014 Dennis Leeuw dleeuw at made-it dot com
License: GPLv2 or later
There is no single solution to create a secure system. Building secure systems is the art of keeping one step ahead of the competition, the bad guys. What I find to be a good aproach is using multiple layers in the defence. Do not trust the firewall, at least not on his own. If the systeem needs to be secure from a network point of view, make sure you use two different techniques to block access from the network: use a firewall and e.g. hosts.allow and hosts.deny files. If you want to make sure user accounts are checked thoroughly make use of the configuration of the application and e.g. PAM. By using two or more lines of defence a break-in based on a bug in one piece of code might be stopped by a routine in the other.
But still even if you use this approach, never ever trust your systems. Don't expect them to be safe, don't expect them to be trusted.
On the Internet I read somewhere: There’s no excuse to run insecure systems on your network. Your data’s integrity (and your job) depend on your ability to keep those systems running correctly and securely for your co-workers and customers.
I am not sure about the "no excuse", but at least you should be able to say that you did your best, and for sure there is enough documentation to read about maintaining secure systems. And I added my little bit in the hope that we might all be living in a more "trusted" world.