Technologists tend to prefer technological solutions. If there’s a problem, then perhaps there’s a box,
or a piece of software, that can be bought or built to solve it. This can often work well for problems
of physics, or logic, or regular organization. File servers hold files; backup servers back them up.
Atomic clocks measure time; routers move packets between networks.
That same regularity is not true of security. It’s critically important to remember that security is
about people, not technologies. Many people act honorably, but some make mistakes, and some lie,
cheat, and steal—sometimes for their own profit or advantage; other times to demonstrate a system’s
vulnerability. People cause their technologies to act for them in a like manner.
Ken Thompson, co-inventor of the C programming language and the Unix operating system,
demonstrated this issue in a memorable way10 in 1984. He created a C program fragment that
would introduce Trojan Horse code into a program compiled by the C compiler. For example, when
compiling the program that accepts passwords for login, you could add code that would cause the
program to accept legitimate passwords or a special backdoor password known to the creator of the
Trojan. This is a common strategy even today and is often detectable through source-code analysis.