The day before yesterday I was lucky enough to be invited to a Security discussion with some very senior security people in the
It was clear to me that we do however need some sort of security architecture which has to include both the technical sort of stuff I blogged about earlier and also less security technology focussed areas such as:
Present and projected threat analysis / risk mitigation.
Security and auditability.
Alerting and patching.
There were also some interesting specific areas of interest that came up the discussion too such as:
Anti Virus / Malware strategies.
Spoofing / phishing / farming strategies.
This last one seemed to me to be the most immediately pressing area which needed some innovative thinking. An addin to the client which did host change detection and warning seemed like a simple and effective solution to this.