Is customization the weakest link in app security?
92588
Gartner Inc. research director Rich Mogull says that customization of off-the-shelf software is the weakest link in application security. He spoke at the Gartner IT Security Summit in Sydney. Needless to say, some vendors in attendance were moved to respond.
750999
From product keys to click behavior, application developers need to stop annoying their users.
454115
Weâve all been hearing a lotÂ  lately about spyware, those nasty little apps that secret themselves onto your computer, hog resources, change your default settings, and maybe even steal personal information and send it to third parties. Despite all the talk, spyware still isnât getting the attention it deserves in the enterprise.
234398
QUESTION: What is the best approach to protecting me from ID theft and related activities? Will a software package work best, or must I go to a hardware firewall?
90155
Based off of a previous article from Mike Willbanks, Stuart Herbert has posted some of his own thoughts on tuning and tweaking your applications for the best performance you can get out of them.   There's some good advice in there, and I thought it'd be a good idea to quickly add a bit more detail about the separate approaches that Mike raises.   He goes over the APC caching, memcache, the "gzip trick", the "Not Modified" header and optimized SQL statements.   He also mentions one thing that Mike didn't mention - a split between static files (no PHP needed) and their dynamic cousins. Having a more pure Apache (no PHP installed) can help give a minute jump in speed that, depending on the size of the site, could really add up from a user's perspective.
86222
In brief Exploit circulating for unpatched vuln
98557
Blog: Underneath the software-as-a-service hype, large organizations have a real concern. Yup, security jitters again.
701997
Beta search app creates vulnerabilities that may threaten your data's security.
490340
Browser beware Security experts are crying foul over a new supposedly secure browser application.â¦
405976
Letters: Going deeper on the question of security and operating systems.
208854
The problem that I have with some of the iPhone alarmism is that it leaves an impression that enterprise data is highly secure and that there aren't lots of other potentially much larger holes on which to focus.
182207
Following Microsoft's lead, software maker opts to issue fixes on a monthly timetable. But does that make customers more secure?
106639
Psychotherapy for UI design Editor's blog Here are some thoughts on user-interface design and the simple psychology of rooking the user. Try this for an example: I have been staying at a hotel where there is Wi-Fi available in the form of a T-Mobile hotspot. Letâs not go to the length of criticising the hotel for not fronting this service itself, putting the cost on the bill, etc â or indeed, just burying the cost in the hotel charges so it appears free. What it does mean, however, is that one has to go through T-Mobileâs SignUpWithYourCreditCard process... tedious but survivable.â¦
701756
(InfoWorld) - Uncertainty about how to secure mobile phones in the face of increasing threats is slowing enterprise adoption of mobile applications, experts exhibiting at theÂ 3GSM World CongressÂ in Barcelona this week said. Over two-thirds of mobile operators in Europe that took part in a survey said that they detected more than 100 incidents involvingÂ mobile virusesÂ orÂ mobile spywareÂ in 2006, according to a study by conducted by Informa for security software developer McAfee. The number of European operators reporting more than 1,000 such incidents more than doubled in 2006 compared to the previous year, the report said. IT administrators, uncertain how to protect their users from such attacks, are unwilling to enable mobile access to applications for workers. "Enterprise security professionals haven't really worked this out yet," said Lorcan Burke, CEO of AdaptiveMobile. Companies such as banks, with strict security requirements, simply block access to any service, including Internet access, that could open doors to security issues, he said. At the recent RSA Conference in San Francisco, some of the most crowded events were those tackling mobile security issues, said Simeon Coney, vice president of marketing for AdaptiveMobile. That was an indication that IT administrators are trying to find out how serious mobile security problems are and how to address them, he said. Mobile services can be secured in the application, the network or in hardware or software on the device. Among operators responding to the McAfee study, most found that virus protection was most important at application and device levels, although more of them had deployed network-level security systems than the other options. Over 200 respondents from the operator community took part in the study. AdaptiveMobile makes network-level security products for operators, including a system for filtering viruses in e-mail, SMS (Short Message Service), MMS (Multimedia Messaging Service) and WAP (Wireless Application Protocol) traffic. Beyond viruses, AdaptiveMobile can also control content, so it can stop phishing and other fraudulent attacks, or limit the types of content end users can access. If an operator has deployed AdaptiveMobile's platform, an IT administrator in a company can set and manage such controls down to the level of individual users. For the mass market, AdaptiveMobile's product allows operators to notify a user by text message if their phone becomes infected with a virus and offer a download, either for free or for a fee, to disinfect the device. Without such software, operators will replace a user's device or ask them to send it off for disinfection, both costly propositions. A network-based security mechanism offers some advantages over anti-virus software that sits on the handset, Burke said. Handset software doesn't prevent phishing and other nonviral scams. In addition, anti-virus software isn't compatible with all phones, making it logistically difficult for the software developers to tweak their products for each version of every phone and make sure to sell the proper software to end users. He calls anti-virus software on the handset "the minimum acceptable response. It's a tick in the box to make people feel comfortable." Some developers also sell security mechanisms that sit in the phone's hardware. Such solutions are ideal for organizations with very strict security requirements, such as government users, Burke said. One downside to the hardware-based solutions is that they take about two years to make it into a handset, he noted.
509091
JavaScript development goes to the dogs What you can - and cannot do - with your software is often determined by the code owner's license. From not using open source APIs with closed-source digital rights management (DRM) to being barred from fiddling with Windows source code, we've seen it all.â¦Learn &amp; Contribute, Live &amp; Online - The Register Debates Green Computing
476280
TechWeb - Unlike Microsoft and other vendors, Apple doesn't rank or rate the vulnerabilities it patches, but about two-thirds of the bugs could result in an attacker hijacking an unpatched Mac.
291518
(Source: HP)  Security is everyone's responsibility as it has severe impact on the business if not taken seriously. Learn how to integrate security throughout the software development lifecycle, not hastily add it to the end. Our white paper, Application Security: The Missing Pillar of Software Quality, will show you how to build security into an application without special security expertise and without delaying release schedules.