Categories
- Economics and Risk (13)
- Highlights (347)
- Identity Management (103)
- Incidents (31)
- Metrics (74)
- Quotes (2)
- Random (18)
- Threat Management (125)
- Trust Management (16)
- Vulnerability Management (201)
Archives
Disclosing the Elephant in the Room of the Disclosure Debate
There has been a lot of discussion lately about vulnerability disclosure, with Google and Microsoft respectively weighing in with their latest opinions on the topic.
There is really nothing new here, as evidenced by the Google folks referencing a 9-year-old Bruce Schneier essay on the topic. I have written extensively on the topic and the related ...
There is no such thing as *Real* Value
Rich Mogull has started a fire on his Securosis blog addressing questions of value and loss. I would like to provide some feedback.
Most importantly, I would like to address this point:
"I consider that an implied or assumed value, which may bear no correlation to the real value"
Rich's reference to something called a real value ...
Charlie Miller’s “Teach a Man to Fish” approach to disclosure: the happy medium?
Pre-eminent bugfinder Charlie Miller mentioned an interesting approach to disclosure after he compromised another Apple system - demonstrate the attack, describe how the vulnerability was found, and let the chips fall where they may. (Actually, I think his "teach a man to fish" approach might have been ancillary to the pwn2own contest...)
At this stage of ...
Can you have “more secure software” and still have greater risk?
Answer: Yes.
Here's how: The software element of the risk equation only accounts for vulnerabilities, it doesn't address threat. So we can reduce our vulnerability level and therefore have "more secure software" in the midst of increased risk. This manifests itself in a higher number of incidents, which is the outcome of the threat and vulnerability ...
Rudeness, risk and vulnerability disclosure
Robert Graham at Errata Security has yet another thoughtful post - this one on the “rudeness” of vulnerability disclosure. His key point:
“However, vuln disclosure isn't friendly. It is an inherently rude act.”
It is an interesting post, primarily focused on the psychological relationship between bugfinders and vendors, but the thing I find the most puzzling is ...
Vswitch isolation and segmentation - an Illusion
Brad Hedlund points out a common misunderstanding in the virtualization networking world - you can segment and isolate all you want, but it is simply a logical construct.
From a risk perspective, I equate this type of virtual segmentation (for DMZs) to connecting the physical DMZ components all to the same switch.
There is lots of other ...
Can Lower Risk be Higher Risk?
I saw the headline yesterday, "Security Experts Warn Firms of the Higher Risk of Lower-Risk Flaws." It is the kind of headline that makes one do a double-take (the mark of a good headline, I suppose). But can it be true? Well, on the one hand, it could be justified simply by asserting that the ...
I’m having a zen moment
"Security Experts Warn Firms of the Higher Risk of Lower-Risk Flaws"
Is it a paradox or something Confucius would say? I am going to meditate on it overnight and write something tomorrow.