rm "information security" is often used to encompass all of them and to distinguish them from closely related and important issues – such as physical security, operational security, and personnel security – that do not rely primarily on computing technology.
             Computing is as risky as any other aspect of modern life, and in some sense more so because of the complexity of computing systems. Vulnerabilities exist at all levels: network, operating system, middleware and application because all software has bugs, administration is error-prone and users are unreliable.
             It is virtually impossible to develop any significant system without some errors in it. We know how to build bridges so the imperfections are tolerable. That is, we can build bridges that do not crash (if proper engineering methodology is followed), but we cannot build systems and applications that do not crash.
             In computing systems, flaws are often bugs – repeatable situations in which the system behaves in an unintended manner. Each bug can also be a security vulnerability, if the bug can be used in a way that allows a failure of security: either authorized users exceeding their privileges, or unauthorized users gaining access to systems. Furthermore, the complexities of modern computing systems make them difficult to manage.
             Configuration and administrative errors also create security vulnerabilities. It can be difficult to determine whether the system is "properly" configured. For example, to "harden" Windows NT for usage on the Internet, Microsoft recommends over a hundred specific configuration changes that effectively turn off many features that led people to want to use NT. In addition, security experts have other recommendations in addition to those described by Microsoft.
             Computing, like life, has many threats. But what are the risks? Given the wide rage of threats, the sheer number of vulnerabiliti...