Secure Coding Practices: Running with Least Privileges in Windows

O divine art of subtlety and secrecy!
Through you we learn to be invisible, through you inaudible;
and hence hold the enemy's fate in our hands.

-- Sun Tzu, The Art of War, c. 500bc

Sun Tzu said it best. I am your run of the mill security engineering geek that likes to break things. Well more to the point, I like to prevent others from being able to break things.

I dislike the FUD people sling around about how any one piece of software or their OS can completely secure the world. Security is a process and not a product, and should be treated as such. I think General Patton said it best when he said:

“Fixed fortifications are monuments to man’s stupidity.”

I spend most of my days developing code that is part of our security management life cycle, in the hopes people start to realize that static defences are not enough.

I spend most of my time on flavours of Windows (Currently XP) in a set of Cygwin bash shells SSHing to Linux and BSD systems to actually do a lot of my work. My main editor is vim with ctags (I can work faster in it than in Developer Studio) and it works great editing code both locally and remotely.

When I am not in front of a computer I can typically be found at the Squash courts or listening to contemporary jazz like Chris Botti, Diana Krall or Miles Davis (ok... so he is more Blues and fusion but his trumpet still sings). Otherwise, I will be immersed in a book which probably relates to information security, cryptography or has some sort of animal on the cover and is published by OR&A.