Perspectives: SSL No Security Blanket

Encryption cannot patch the holes created by insecure software.

This article can also be found in the Premium Editorial Download: Information Security magazine: Does security make the grade in Windows Server 2008?:

Encryption cannot patch the holes created by insecure software.


Security practitioners love SSL, and with good reason. It is well designed with support for multiple encryption protocols, and is easily reconfigured in case any should get cracked or outdated. It is an incredibly useful tool, protecting transactions as they cross otherwise insecure channels such as the Internet. It's also great for certificate-based bilateral authentication, provided of course you actually have the cash and personnel resources to maintain it.

If anything, SSL is too well implemented, and people think it covers all their needs, like a giant security blanket. They forget there is much more to security than just using SSL.

Gene Spafford famously once said, "Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench." He's still right today.

Although operating systems are more secure than they were 10 years ago, and we are much better at patching them, that isn't sufficient. Dan Geer recently released an extensive paper on trends in the information security industry. Using data from the National Vulnerability Database, he quantitatively showed what we already had intuited: Attackers have moved to targeting applications with great success, exploiting cross-site scripting and SQL injection vulnerabilities by the boatload.

Despite what we know and what industry leaders like Microsoft and Oracle have done to make their products more secure, the software industry just doesn't seem to get it. While some Web-based applications display badges from services like Hacker Safe, which actually test for vulnerabilities, these sites are few.

If you look at the average Web-based application, you're lucky if there's a reference in the vendor's privacy policy about use of SSL or a cute badge advertising its SSL vendor. While it is gratifying to know the risk of someone sniffing my credit card number is effectively zero when using a particular Web site, this unfortunately doesn't tell me a single useful thing about the security of the application, and odds are, the security is poor.

This is why ISVs need to start implementing security into their software development lifecycles and be more transparent as to what they are doing to keep data safe. This is only going to happen if we as security practitioners and customers press vendors to start producing more secure software. And if the past is any indicator, acting as customers will be far more effective. Practitioners can have a deep impact, especially from the angle of driving down support costs, but what really gets the attention of marketing and sales departments is customers demanding features.

Years ago, someone asked Mark Graff, author of Secure Coding, when the company he worked for would stop making "such crappy software." He answered, "When you stop buying it." It was irate customers who pushed Microsoft into starting its Trustworthy Computing initiatives, and it will be irate customers who will push Web application vendors to start taking security seriously. It is up to us to teach those customers not only what they are missing so they know what to ask for, but also that the little lock icon is not enough to keep their data secure.

This was first published in February 2008

Dig deeper on Security Resources

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close