Software Security Data Sheets
Ephraim Schwartz from InfoWorld wrote about a discussion he and I had in his column this week. He is right, we did have a long discussion (actually a handful of discussions) and I am glad he is bringing these ideas, some of which are not incredibly unique in the security space, to the mainstream world. Anyway, it is probably worth elaborating a bit on some key topics:
On VPNs. The key takeaway should be that you understand what VPNs can and cannot do. Their primary function is to protect the confidentiality of communications. Your risk assessment should have identified this threat as important if you have a VPN. What really gets my goat with VPNs (or regular SSL for that matter) is that non-security folk often misconstrue the relative level of security that you can attain from them. VPNs are great - they are not a panacea and do nothing to protect a client or host, which are generally much easier and usually more lucrative targets.
On MyDoom and Viruses. I am a big believer in allowing the end user to do whatever he/she wants on his/her desktop. I absolutely believe that enterprises need antivirus on the mail server and if they don't want that, there are other techniques that can protect them. But MyDoom was really a virus that targeted the little people - Grandmothers and children, small businesses and home offices, etc. All of those folks who have nobody to protect them. Unless..... ISPs get more involved in this protection. I am no fan of AOL's previous actions, but I absolutely believe that ISPs need to be more involved.
On Performance and Usability. Security is always a tradeoff, and performance and usability are the two primary candidates for competition.
On Standards. Standards are a "problem" when it comes to security, but the tradeoff is extremely valuable. They are the reason the Internet exists today. So security folks have to get over it and build that into their protection plans.
On Microsoft. Microsoft has always given us what we wanted, unfortunately we are only now realizing it wasn't what we needed. It is doing an admirable job digging itself out of the hole we all created, but it will take time.
On Software Security Data Sheets. SSDSes are not intended for humans to read and take action on. Think of them more like an XML Schema that can be populated and then read on the host. There is no reason that an ISV couldn't come up with them. The real value is that the SSDS would be a hedge against software liability.
2:37:59 AM 
|
