Posted by Marco Ivaldi on Sep 16
Not to mention the fact that the best (only?) way to verify that the securitymodel in place is indeed "good" or at least "good enough" is to perform a
thorough operational security audit [1]. Otherwise you're just guessing at
best.
Agreed. That's why the focus should be shifted from threats to operations.
[1] See the OSSTMM 3, available at www.osstmm.org.