Security Management Strategies for the CIOAccess "Face-Off: Is vulnerability research ethical?"
This article is part of the May 2008 issue of Seven questions to ask before committing to SaaS
Security Experts Bruce Schneier & Marcus Ranum Offer Their Opposing Points of View Coming in July/August: Chinese Cyber-Attacks: Myth or Menace? Send comments on this column to feedback@infosecuritymag.com. POINT by Bruce Schneier The standard way to take control of someone else's computer is by exploiting a vulnerability in a software program on it. This was true in the 1960s when buffer overflows were first exploited to attack computers. It was true in 1988 when the Morris worm exploited a Unix vulnerability to attack computers on the Internet, and it's still how most modern malware works. Vulnerabilities are software mistakes--mistakes in specification and design, but mostly mistakes in programming. Any large software package will have thousands of mistakes. These vulnerabilities lie dormant in our software systems, waiting to be discovered. Once discovered, they can be used to attack systems. This is the point of security patching: eliminating known vulnerabilities. But many systems don't get patched, so the Internet is filled with known, exploitable ... Access >>>
Access TechTarget
Premium Content for Free.
What's Inside
Features
-
-
SaaS Offering Handles SSO
TechFocus: New Password Hell?
- Viewpoint: Let's add policy to GRC
-
Product review: CodeArmor 2.2 for Microsoft .NET
APPLICATION SECURITY
-
Security Services: Webroot Email Security SaaS
At Your Service
-
Identity Management Suites Enable Integration, Interoperability
IDENTITY MANAGEMENT Feature-rich product suites are putting a face on integration and interoperability.
-
SaaS Offering Handles SSO
-
-
Secure Computing SafeWord 2008 product review
Secure Computing SafeWord 2008 delivers identity management and access control for Windows systems using tokens that generate secure single-use passcodes. Information Security magazine reviews these capabilities.
-
7 Security Questions to Ask Your SaaS Provider
Outsourcing software as a service (SaaS) puts control over an organization's applications in the hands of others. Learn what questions to ask your provider, how to define security policies, how to understand how service providers handle security and ensure enforcement of policies.
-
Product review: Symantec Database Security 3.1
DATABASE SECURITY
-
5 Steps for Developing Strong Change Management Program Best Practices
Poor change control and configuration management can affect the security of your systems and networks. Follow these five steps for a strong change management program.
-
Product review: Mandiant Intelligent Response 1.0
INCIDENT RESPONSE
-
Secure Computing SafeWord 2008 product review
-
Columns
-
Interview: Jim Kirkhope of NCR
PING: Jim Kirkhope
-
Face-Off: Is vulnerability research ethical?
Bruce Schneier and Marcus Ranum debate the ethics of vulnerability research
-
Reasearch on Coding Backdoors Presents Ugly Picture
Editor's Desk: Backdoor Bedlam
-
Security, Privacy Offices Must Combine Resources
Perspectives: Nowhere to Hide
-
Interview: Jim Kirkhope of NCR
More Premium Content Accessible For Free
Unlock new pathways to network security architecture
E-Zine
Network security architecture is showing its age at many organizations. With new technology, different data types, and use of multi-generations of ...
Emerging threat detection techniques and products
E-Handbook
Advanced persistent threat (APT) has been a used and abused term in the security industry, but security experts say targeted attacks are a growing ...
The rapid evolution of MDM solutions
E-Zine
Mobile device management (MDM) continues to grow at a feverish pace, both in terms of adoption and mobile security features. BYOD policies, and the ...