The power of candy-coated bits [security]

Database administrators of the world guard the heart and soul of their businesses: information about customers, employees, orders, accounts receivable, and any other bits that keep a business running. They must build systems that serve up this data to the right people while locking out everyone else. Every so often, sometimes as often as several times a day, the programmers of the world salute these administrators with a software update that plugs some holes. Then, they release a new update that patches the holes created by the first old patch. And, occasionally, the programmers ship yet another patch to plug the holes opened by the patch meant to close the holes in the first patch. This scenario is life under the fortress model of system security, and this model is growing increasingly fragile.