It is with great excitement and anticipation that I announce the Month of No Bugs (MONB)! This month, I promise NOT to look for any new bugs out there, NOT to artificially elevate my bugs above all others, NOT to…
Economics and Risk
Disclosing the Elephant in the Room of the Disclosure Debate
by Pete Lindstrom • • Comments Off
There has been a lot of discussion lately about vulnerability disclosure, with Google and Microsoft respectively weighing in with their latest opinions on the topic. There is really nothing new here, as evidenced by the Google folks referencing a 9-year-old…
There is no such thing as *Real* Value
by Pete Lindstrom • • Comments Off
Rich Mogull has started a fire on his Securosis blog addressing questions of value and loss. I would like to provide some feedback. Most importantly, I would like to address this point: “I consider that an implied or assumed value,…
Charlie Miller’s “Teach a Man to Fish” approach to disclosure: the happy medium?
by Pete Lindstrom • • Comments Off
Pre-eminent bugfinder Charlie Miller mentioned an interesting approach to disclosure after he compromised another Apple system – demonstrate the attack, describe how the vulnerability was found, and let the chips fall where they may. (Actually, I think his “teach a…
Can you have “more secure software” and still have greater risk?
by Pete Lindstrom • • Comments Off
Answer: Yes. Here’s how: The software element of the risk equation only accounts for vulnerabilities, it doesn’t address threat. So we can reduce our vulnerability level and therefore have “more secure software” in the midst of increased risk. This manifests…
Rudeness, risk and vulnerability disclosure
by Pete Lindstrom • • 1 Comment
Robert Graham at Errata Security has yet another thoughtful post – this one on the “rudeness” of vulnerability disclosure. His key point: “However, vuln disclosure isn’t friendly. It is an inherently rude act.” It is an interesting post, primarily focused…
Can Lower Risk be Higher Risk?
by Pete Lindstrom • • Comments Off
I saw the headline yesterday, “Security Experts Warn Firms of the Higher Risk of Lower-Risk Flaws.” It is the kind of headline that makes one do a double-take (the mark of a good headline, I suppose). But can it be…
Security Budget Planning in Three Easy Steps
by Pete Lindstrom • • Comments Off
Gunnar Peterson has a great post on security budgeting. His essential point is to apply a “flat tax” to all IT spending. The value is in its simplicity. We can get a lot more complex (and often do), but this…