The point of this paper is not to leave the impression that IT security is really nothing more than a problem waiting for the ultimate technical fix. Rather, it is to argue that firewall and intrusion detection systems have a place in organizational security. The trick to exploiting the full potential of these and all other security technologies is to recognize and work with their inherent weaknesses. Winn Schwartau's concise and eminently readable book, Time-Based Security , takes this insight as its starting point, as does the U.S. Department of Defense's original Defense in Depth paper. Time-based security and defence in depth are based on the idea that, sooner or later, everything lets us down.
People get bamboozled or sloppy, processes get derailed, and technology gets holes poked in it.
Knowing this, we build in security system redundancies that give us a better chance of spotting and reacting to trouble. Thus, even as various parts of the system fail, on the whole it is achieving an acceptable level of assurance. And when these systems aren't letting us down, they can be producing some pretty useful information. Indeed, we are only beginning to take full advantage of what the available technology can tell us about the internal and external network environment. When federal and provincial departments shared information on network activity during the Y2K rollover period, there was a great deal of discussion about how quiet things were.