LOGIN | REGISTER NOW | SUBSCRIBE
 

Guest View: IT security: apathy or ignorance?


By David N. Kleidermacher
Email    print   
April 1, 2009 —  (Page 1 of 3)
The world has a serious problem when it comes to IT security. In two words: It sucks. Critical IT systems, including national infrastructure, are built on software that is known to be hopelessly filled with vulnerabilities. We spend countless billions trying to patch and filter our way to security, but the hackers are always a step ahead. There are so many holes, it is downright child’s play to find a way in.

The daily reports of hacked credit cards are almost comical. However, a concerted attack by determined, well-funded, technologically sophisticated adversaries to take down our power grid or air-traffic control system wouldn’t be funny at all. As President Obama recently stated, “It's no secret that terrorists could use our computer networks to deal us a crippling blow.”

Why aren’t people more upset about (the lack of) cyber security? Sure, the economy is in shambles, but it has become clear from TARP and the stimulus bill that the best we can do is trial and error and patiently wait for the illness to run its course.

However, when it comes to computer security, there is a known cure for our cancer. Companies can create secure software by following a process that prevents vulnerabilities. It is done all the time in aircraft and in certain military and intelligence systems. But the enterprise software world chooses not to do it this way. There simply hasn’t been a strong enough incentive to do the right thing.

The dilemma is exacerbated by the common practice, from otherwise reputable companies, of making misleading statements about the security of their products. A naïve public puts its crown jewels under the control of software and systems that can’t even keep a smart teenager out, let alone a nation state that puts its best Ph.D.s on the problem.

In 2008, VMware announced its hypervisor’s certification to Common Criteria EAL 4+. The announcement included the claim of suitability for “sensitive, government computing environments that demand the strictest security.” Three days later, severe vulnerabilities in these products were posted to the U.S. Computer Emergency Readiness Team’s National Vulnerability Database. Among other pitfalls, the vulnerabilities “allow guest operating system users to execute arbitrary code.”


Related Search Term(s): security

Pages 1 2 3 


Share this link: http://sdt.bz/33368
 
Most Read Latest News Blog Resources
Branching and merging: the heart of version control
Providers hold their own views of the landscape, but the Git SCM system is drawing looks from them all
Not so fast when it comes to testing in the cloud
Developers face outsourcing, virtual lab management and mobile devices as obstacles
Microsoft pivots toward business intelligence
The goal is to make business intelligence accessible "to the masses"
From the Editors: Node.js is unruly, but that’s where the fun is
The time to get involved with Node.js is now; Hadoop is about to break its own barriers
Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter


Add comment


Name*
Email*  
Country     


  • Comment
Loading




close
NEXT ARTICLE
Cigital Develops Ready-to-Use Tools for Securing the Smart Grid
Cigital Inc. announced the release of the Guide to Developing a Cyber Security and Risk Mitigation Plan Read More...
 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 

Download Current Issue
FEBRUARY 2012 PDF ISSUE

Need Back Issues?
DOWNLOAD HERE

Want to subscribe?


 
blogs tab
GitHire: Use Headhunters to Find Your Perfect Programmer
Are you a hiring manager tired of scouring the job boards? Check out this new service that will find 5 people interested in your jobs.
02/03/2012 12:17 PM EST

Facebook claims hacker cred
Facebook's SEC S-1 filing form includes a short essay on the Hacker Way by Mark Zuckerberg himself.
02/02/2012 08:26 AM EST

Ryan Dahl steps down
Ryan Dahl, creator of Node.js, steps back from his position as gatekeeper for the project.
02/01/2012 04:58 PM EST

Bloomberg opens its API
Bloomberg's APIs could lead to a future standard for accessing market data.
02/01/2012 04:41 PM EST

The case for piracy
In the aftermath of SOPA and PIPA, some copyright holders have begun to embrace piracy as inevitable...and even beneficial.
01/30/2012 02:39 PM EST

Tablet sales boom, but applications lag
The installed base of tablet computers and e-book readers is growing rapidly, but no killer app has yet emerged -- hint, hint.
01/28/2012 05:48 PM EST

 
Events calendar tab
Cloud Connect
2/13/2012 to 2/16/2012
Santa Clara
TechWeb

SPTechCon: The SharePoint Technology Conf.
2/26/2012 to 2/29/2012
San Francisco
BZ Media

RSA Conf.
2/27/2012 to 3/2/2012
San Francisco
RSA

IBM Pulse Conf.
3/4/2012 to 3/7/2012
Las Vegas
IBM Tivoli

Game Developer Conf.
3/5/2012 to 3/9/2012
San Francisco
TechWeb