One Step Ahead (Or Behind?)
I recently had a discussion with a friend about security. His claim was, "I am always one step ahead of attacks". I was a little taken back by that, since the opposite is probably the case. Attackers are always one step ahead of us. They are the ones that usually force us to come up with cutting edge technology for security. The best we can do is put up the best defense we can. The worst assumption you can make is that all of your bases are covered. They aren't. There is always a weakness, or something that was overlooked. Though it is hard to admit, without attackers we wouldn't be forced to come up with more innovative and defensive security techniques and measures.
There is no
clear
definition of what a security weakness is. It can be defined as a buffer overrun, SQL Injection, or just code that has a hole in it. The best we can do is generalize it to a point where it's meaningless in terms of implementation. If your boss came to you, and said, "Make our product more secure." – Where to start? That's pretty vague.
What is the best defense against attacks? Never assume you are totally secure, and be mindful of attacks.