No, seriously. “Architecture?”
”OK, I hear you. It’s important. But ‘Architects’ turn out to be expensive. What’s the point? What’s the value?”
I feel strongly that in order to be a competent practitioner of network security, you ought to be deeply familiar with the packets and protocols of the TCP/IP stack. By which I mean that you ought to be able to read packets in hex. Not that you’d necessarily do it often, but you darn well ought to be able to if you had to. (Would you trust a doctor who couldn’t at least hold an X-ray right-side-up when pointing to what he thought was a tumor?)
Similarly, I feel strongly that without a thorough understanding of the architectural aspects of whatever scale of system you're dealing with, it should be hard to qualify yourself as an enterprise systems security specialist. If you're coding operating systems, you'd better be familiar with buses and interrupts. If you're a systems integrator, you'd better be familiar with the architecture of all of the larger components as well. Every last one of them.
Again with my building analogy:
I'm now sitting in a café under a beautiful timber canopy. (I'm in Montana, after all.) To my eye it looks remarkably strong and safe, but I'm not that kind of architect, and neither am I a structural engineer. I can only hope and expect that some competent and qualified person has had to aver that the proprietor should be allowed to invite me to sit here. It is further my hope that whomever conducted such an inspection understood both the practice and the theory behind timber spans, lintels, joists, and lag bolts. Hopefully they understood a bit behind plate tectonics as well.
It is surely one thing to know, by rote, the practical difference between commodity timbers and sandwiched laminate beams. It has to be something altogether different to understand the theory behind them, such that a person could detect when the latter is being used improperly in some subtle way, or when a vendor has constructed beams that appear proper, but may not be. In other words, if you don't understand why laminates can be stronger than raw timbers, how can you hope to recognize when a poorly constructed beam wouldn't be?
I’m convinced that when properly selected and engaged, architects don’t cost money, they save money. You don’t have to agree with me, of course. But I’d challenge you to build something more complicated than a single-family house without one. Chances are your enterprise is already more complicated than a 3-bedroom 2-bath.
/jonathan
Weblog Entry
Wednesday, August 15, 2007
Entry Notes
Category: Do I have to...?
Event: A common question.
Weather: Surrounded by fire in MT
Other Details:
I agree that some of the studies required to pass the CISSP can seem arcane and useless, but this is not one of them.
