Thou shalt have no other gods before the ANSI C standard 1563

many situation where they are playing catchup is because security hasn't been built into the infrastructure ... and has become a re-active post-deployment (after-market) solution (they appear to be constantly playing catchup because they are just reacting to stuff that happens).

when integrity is part of the fundamental infrastructure ... security is less featured ... because there are much fewer events that require post-deployment, band-aid workers.

about the time we were doing the original internet payment gateway,

i gave a talk at a graduate student seminar at isi-usc about why internet wasn't business critical dataprocessing. you do things differently if you think about situations in terms of threats and coutermeasures ... and it becomes part of the basic landscape.

architects designing buildings are taught about things like wind-loading on exterior surfaces and having to take into account worst-case local wind conditions. there are certain things you do when you design a building to withstand force 5 hurricane. attempting to retrofit an existing building to withstand a force 5 hurrican isn't normally very succesful. If you have situations where the daily wind is able to blow down every building ... eventually you create conventions &-or guidelines where the buildings don't blow down quite so often. i believe most licensed architects are held professional responsible if they don't take into account well understood hazards when they produce a design.

how is this for a little topic drift (curtesy of search engine):

SHOULD THE PUP BE SPENDING BORROWED MONEY ON 10,000 HOUSES WITH A CUBAN FACTORY, PRODUCING FLAT WALLS, OR BE BUILDING HURRICANE RESISTANT CONCRET DOME HOUSES INSTEAD?

--