Lesson From the DNS Bug: Patching Isn't Enough Jul 25, 2008, 15 :30 UTC (3 Talkback[s]) (6399 reads) (Other stories by Bruce Schneier)
"The real lesson is that the patch treadmill doesn't work, and it hasn't for years. This cycle of finding security holes and rushing to patch them before the bad guys exploit those vulnerabilities is expensive, inefficient and incomplete. We need to design security into our systems right from the beginning. We need assurance. We need security engineers involved in system design. This process won't prevent every vulnerability, but it's much more secure -- and cheaper -- than the patch treadmill we're all on now."
