Now let us try to apply what we know about data security to computer systems security
from the perspective of the user a perfect computer system should be Cheap functional.
That is it should do everything we wanted to do and the most intuitive way.
And at the same time secure users are flooded with reminders that security is important and that they
should not use unsafe software.
Unfortunately such a system does not exist.
Let us drop computer systems for a moment and try to tackle this problem from the perspective of a single
program.
It turns out that you can't develop an application that would be equally cheap functional and secure.
At best you can only have two of them at the same time.
You can create cheap and secure software but it will not be functional.
For example older Unix servers were cheap and secure.
They had few vulnerable areas but basic installation options did not provide enough functionality.
What they did provide was command line interface and some basic services.
By definition fewer vulnerable areas equal more security
Unix distributions are cheap for the end user.
Yet from the same perspective they are also simply not functional enough.
There are firms that specialize in designing solutions which are both secure and functional.
However their products are not cheap.
Thus the price of security is similar to the price of functionality.
To sum up there are no solutions that would be equally secure functional and cheap
at best.
Out of these three you can only choose to.
For years we've preferred low price and functionality over security
recently.
Things have changed however.
Another dilemma arises.
Should we choose security and low price or security and functionality.
For example Windows 98 was the answer to a demand for cheap and functional systems.
It was relatively inexpensive and worked with most popular software.
However it definitely wasn't a secure system.
Nowadays in response to negative feedback from users the Microsoft company pays more attention to the
security of its products.
All the principles we've mentioned applied primarily to data.
They are equally true with regards to computer systems.
It is very difficult to create a system that would be secure functional and cheap at the same time.
You have to decide what your priorities are and look for a compromise.
When you consider security solutions and security policy you have to take into consideration the issue
of risk management and decision making.
For example when you make a business decision you have to consider potential profits and losses in much
the same way security solutions must be cost effective.
Unfortunately this is still hard to achieve.
In consequence security solutions we use are often ineffective.