Hi. For the last three lessons, we talked about how secure software design as largely or just good software design. So it should come as no surprise to you that security is best implemented from the ground up being foundational in a project. This short lesson is simply to reiterate that point. Each of the elements we talked about in the last set of lessons, things like drawing pictures, having osmotic communication, so on, has security implications. Virtually none of these things we talked about with the possible exception of coding standards were things that you could implement as an afterthought. The people you hire, the attitudes they have, the mix of expertise, the communication and project-oriented goodwill among them are not elements you can choose to add when the time comes. They have to be there from the outset. If your project is going to be secure, if your software has a hope of being secure, the foundation has to be laid that way. Let's talk foundations for a minute. I mean in a building sense. When I was a kid, I loved to watch houses being built. From the time the first bit of earth was displaced for the construction process, I tried to imagine what the finished structure would look like. Of course, the first construction that was done in houses was the foundation. But it wasn't as simple as dig a hole, put concrete in it. There was plumbing and drainage beneath the concrete foundation. Depending on the situation, sometimes utilities like water and electricity were in place before the foundation was poured. All of this took foresight and planning. What became clear to me as a seven- or eight-year-old was that a lot of thought had gone into the planning of the foundation than was really obvious from looking at the finished foundation. Now, in the housing business, it occasionally happens that an initial foundation for a house is defective. The value of the house and the resources of the homeowner are such that the foundation can actually be replaced in situ. The house can be raised on jacks, safety devices put in place, and the foundation can be built or rebuilt beneath the house before lowering the house back down onto it. Yes, you can do things in a different order, but the time and budget impacts are considerable. We talked about how security frequently hinges on economics. If it's expensive, it won't get done, or at least it's less likely to be done. So things done in the beginning provide for better security. Oh, and have you ever watched a bank building being constructed? One of the first things that are built before any other structure besides the foundation is the vault. This is the least expensive time to do it, and it results in better vaults and more secure banks. Other things that have to be secure and which are built first are elevators and fireplaces. We've taken a pleasant diversion through the construction business and have seen analogies about foundations and security. Hopefully, what you'll bear in mind is that you can't easily or even effectively add security to a project. It has to be built in from the ground up. Thanks for your time and your good humor.
