provided by: 
Originally published at Internet.com-----------------------------------
By Razvan Peteanu for SecurityPortal -----------------------------------
I'll admit I had double thoughts about creating yet another variation on the "Zen and the Art of..." theme. I myself shiver when I see such titles, but I hope Zen practitioners and Mr. Pirsig [1] will forgive me this time. The Zen quotation is appropriate for what we will describe in this two-part series: alternative, perhaps even unusual, means to induce or exploit security vulnerabilities.
Designing a secure solution, be it a protocol, algorithm or enterprise architecture, is far from trivial. Apart from the technical or scientific difficulties to overcome, there is a mental trap easy to fall into: looking at the picture through the eyes of the designer. The designer often works with concepts, not with the real thing. We look at an algorithm's specifications and we mistake it for its implementation in a particular program. We read several RFCs and we say, this is TCP/IP.
The more we work on a topic, the stronger the identification between the concept and its implementation. We often reduce the implementation to the concept, leaving nothing out of the real thing but the concept that originated it. In Zen, we are often reminded that the finger pointing to the moon is not the moon...
Read article at Internet.com site