It is with great excitement and anticipation that I announce the Month of No Bugs (MONB)!
This month, I promise NOT to look for any new bugs out there, NOT to artificially elevate my bugs above all others, NOT to complain that vendors should give me the attention I deserve, NOT to pound my chest and [...]

There has been a lot of discussion lately about vulnerability disclosure, with Google and Microsoft respectively weighing in with their latest opinions on the topic.
There is really nothing new here, as evidenced by the Google folks referencing a 9-year-old Bruce Schneier essay on the topic. I have written extensively on the topic and the related [...]

Rich Mogull has started a fire on his Securosis blog addressing questions of value and loss. I would like to provide some feedback.
Most importantly, I would like to address this point:
“I consider that an implied or assumed value, which may bear no correlation to the real value”
Rich’s reference to something called a real value [...]

Pre-eminent bugfinder Charlie Miller mentioned an interesting approach to disclosure after he compromised another Apple system - demonstrate the attack, describe how the vulnerability was found, and let the chips fall where they may. (Actually, I think his “teach a man to fish” approach might have been ancillary to the pwn2own contest…)
At this stage of [...]

Robert Graham at Errata Security has yet another thoughtful post - this one on the “rudeness” of vulnerability disclosure. His key point:
“However, vuln disclosure isn’t friendly. It is an inherently rude act.”
It is an interesting post, primarily focused on the psychological relationship between bugfinders and vendors, but the thing I find the most puzzling is [...]

Gunnar Peterson has a great post on security budgeting. His essential point is to apply a “flat tax” to all IT spending. The value is in its simplicity. We can get a lot more complex (and often do), but this is an excellent starting point.
Don’t forget the business and don’t forget we are “optimizing” our [...]

I was talking with my buddy Ben Rothke tonight about the security graveyard - companies that are no longer with us (he’s been a part of a number of them, but I’m not making any connections ;-). He also challenged me to find an old list of companies exhibiting at RSA. Herewith is a list [...]

In the past few weeks, the Advanced Persistent Threat (APT) has been all the rage in the infosec world.  Security professionals everywhere are taking sides about whether APT is new or not, despite (or perhaps due to) the lack of a clear and consistent definition.
It started with Google suggesting (but not explicitly stating) that the [...]