Former cybersecurity czar: Code-checking tools needed
115446
DECEMBER 02, 2004 (IDG NEWS SERVICE) - WASHINGTON -- Software vendors need automated tools that look for bugs in their code, but it may be a decade before many of those tools are mature and widely used, said the former director of cybersecurity for the US
166587
For some security researchers who uncover flaws in leading computer programs, a nod of appreciation from software companies is no longer enough.
178190
Here's a look at the evolution of software coding from the early days of wires and physical switches to the untimely death of "automatic programming."
108829
Recently , Google has released a new service for their search engine, the Google Code Search. It allows for developers to look through and locate items in public source code through the simple Google interface we're all used to. Fortunately, there's also a few security problems the site can help with as well, and Chris Shiflett shares some of these in his latest post.   Stephen de Vries sent an email to SecurityFocus's web application security mailing list earlier today to comment on the new Google Code Search: "Google's code search provides an easy way to find obvious software flaws in open source and example applications."   Chris talks about cross-site scripting problems, issues with the superglobals, SQL injection problems, and even a misplaced trust of the $_SERVER superglobal. Each of the items is linked to is search terms on the Code Search to make it easy to locate.
458563
Security-minded users can find out faster if their applications need to be patched with a free tool.
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
587220
A Washington, D.C., think tank has launched a cybersecurity commission full of top experts in the field, with the goal of creating a list of recommendations for the next U.S. president.The Center for Strategic and International Studies ( CSIS ) wants the commission to come up with a list of recommendations that the new president who takes office in January 2009 &quot;can pick up and run with right away,&quot; said James Lewis, director of the CSIS Technology and Public Policy Program. The commission, made up of 32 cybersecurity experts, plans to finish its work by the end of 2008.Co-chairmen of the commission are retired Admiral Bobby Inman, former director of the U.S. National Security Agency; Scott Charney, corporate vice president for trustworthy computing at Microsoft; U.S. Representative Jim Langevin, a Rhode Island Democrat and chairman of the Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology; and Representative Michael McCaul of Texas, the ranking Republican on the subcommittee.Cyberthreats against the U.S.&#160;are growing, and it&#39;s&#160;important for Congress and the next president to take action, Langevin said. In the past year, his committee has investigated hundreds of cyberbreaches within the U.S. government.Langevin remains concerned about U.S. government networks, he said. The U.S. Department of Homeland Security reported 844 cybersecurity incidents in fiscal years 2005 and 2006, he noted.When the lead agency for protecting the U.S. against cyberattacks has hundreds of vulnerabilities, &quot;we&#39;ve clearly reached an unacceptable situation,&quot; Langevin said.The commission will expect action on its recommendations, added McCaul. He promised to push the recommendations in the cybersecurity subcommittee.&quot;The time is now for action,&quot; he said. &quot;For any [presidential] administration, it&#39;d be unwise to ignore that.&quot;Among the members of the committee are three former cybersecurity directors at the White House Office of Management and Budget; former Federal Trade Commission member Orson Swindle; former DHS assistant secretary for cybersecurity Amit Yoran; former head of the U.S. Department of Justice computer crimes division Marty Stansell-Gamm; and executives with Oracle, EMC, Internet Security Systems, and Verizon Communications.
427785
Copycats are keeping busy. Security researcher says the Net threat's source code is "hot stuff."
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
763821
Companies that have spent billions on cyberdefenses to thwart intruders are now addressing an even bigger threat: employees. Many are investing in software that monitors sensitive content inside corporate networks, say security analysts and venture capitalists.
369317
Software vendors need automated tools that look for bugs in their code, but it may be a decade before many of those tools are mature and widely used, said the former director of cybersecurity for the U.S. Department of Homeland Security (DHS).
267638
Malware, carelessness, data leaks--whether internal or external threats, there's too many to count.
552640
Security specialist issues patches for vulnerabilities that could have allowed denial-of-service attacks against some hardware models.
187002
Security technologist Bruce Schneier explains that while cryptography is one of the most basic tools of computer security, it barely existed as an academic discipline 30 years ago.
763048
Borland has unveiled a software suite designed to help developers eliminate errors before their code can be checked in.
105905
Blog: Original researcher makes public his own exploit code.
562395
Serious security vulnerabilities in Veritas NetBackup software could let cyberattackers get into corporate networks.