The 10 Immutable Laws of Security, still true
Microsoft’s famous list of security truths that no software update can fix, and why they still hold.
From the archive: in 2014 I shared “10 Immutable Laws of Security” by Scott Culp, Microsoft (2000) on my old blog. This page is a short summary in my own words; the original belongs to its author.
In 2000, Scott Culp at Microsoft’s Security Response Center wrote down ten “laws”: problems no vendor can patch, because they come from how computers work. In short:
- If someone can get you to run their program, your computer isn’t only yours anymore.
- If someone can change your operating system, it isn’t your computer anymore.
- If someone has unrestricted physical access, it isn’t your computer anymore.
- If you let someone upload programs to your website, it isn’t your website anymore.
- Weak passwords beat strong security.
- A computer is only as secure as its administrator is trustworthy.
- Encrypted data is only as secure as the key that unlocks it.
- An out-of-date antivirus is barely better than none.
- Complete anonymity isn’t practical.
- Technology is not a cure-all.
Twenty-five years later, almost every incident I hear about still maps to one of these. Law 4 is the reason I wrote about file uploads, and law 10 is the one people forget most: tools help, but people and process decide.
Read the original: 10 Immutable Laws of Security, by Scott Culp, Microsoft (2000).