Phil Martin - SHARKS in the MOAT: How to Create Truly Secure Software

Its amazing how the technology of the medieval ages built primarily with wood and stone mirrors our modern struggles to keep hackers out of networks and databases. Could it be that we could learn a thing or two from our ancestors from centuries ago? After researching castle warfare at-length, my answer is a resounding YES! Not only do defensive measures line up with modern tactics, the ways in which attackers attempted to penetrate deep into the heart of a castle closely reflects the latest attempts at identify theft, ransomware and back doors. Just as hackers increase the sophistication of each attack, and in response we must deploy new technologies to defeat them, castle builders faced the exact same problem as newer technologies emerged such as better siege engines and the introduction of gunpowder. Most of us believe that encryption technologies, such as TLS, are a modern invention, but the truth is that cryptography started many millennia ago and medieval residents employed it with great success, albeit in a much weaker form. After all, its pretty hard to construct a proper computer out of wood and stone! Nevertheless, there is a great deal of alignment between the threats and countermeasures deployed over a millennium ago and todays world that is wholly dependent on the big, bad Internet.

The premise of this book is two-fold:

1) To illustrate how the bulk of contemporary struggles have already been faced by our ancestors and gain some insight into how to protect our own modern valuables.

2) Discuss the dizzying array of options available to us in terms of securing data, systems and networks, and show how to implement each.

In truth, I was surprised to discover the close alignment between our 21 st century approaches to defense and how the castle owners of England and France protected their kingdoms. But, there are certain areas of castle attack and defense in which there is no corollary (yet) with modern technologies, and it is within those areas that we perhaps can learn a lesson or two from our distant relatives. Of course, the reverse is true as well we citizens of the 21 st century have access to technology that medieval warriors could not possibly have dreamed of. Imagine an invading army attempting to cross a watery moat, only to be devoured by a pack of ravenous sharks. The idea of moat sharks would have been so far out of line with reality as medieval soldiers understood it, that it would represent a fusion of the mundane and the impossible. Yet, that is exactly where we currently live in the modern, always-connected world facing impossible threats from hackers on a daily basis, and we are expected to somehow keep our data and systems safe. In short, we in the software development world have to continuously invent and deploy new moat sharks as quickly as hackers can get around the old ones. If we can surprise a hacker who encounters a moat shark of our own device, then we deserve a huge pat on the back. How to roll out these lurking sharks is the whole point of this book.

In the first section of this book, were going to explore castle construction and how warfare was carried out in the medieval ages. Beyond being a fascinating subject, this approach provides a natural way to understand modern network and software defenses and how best to apply current security controls. As we discuss ancient warfare tactics, I will immediately show you how it applies to modern approaches along with best practices to combat the latest threats.

But before we start, there are a few things we need to discuss