LOGIN | REGISTER NOW | SUBSCRIBE
 
print Printable version 
Most Read Latest News Blog Resources
Three non-programming books for your booklist
Aside from programming skills, developers should know how management works and how to oper...
A fast start for an open-source cloud
Three developers from the OpenStack project talk about its already-thriving community and ...
Integration Watch: The intractability of parallel programming
Not much progress has been made in the field of parallel programming. What can be done to ...
Windows & .NET Watch: LightSwitch turns up
Microsoft's newest development environment will need to go a long way to fulfill its poten...
Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter


            iphoneapp GET THE APP!

Major software makers fail security transparency test


By David Worthington
April 24, 2009 —  (Page 1 of 3)
A majority of the industry's leading software makers surveyed by SD Times lack transparency about the internal principles that they use for writing secure software. Analysts believe that those companies are either practicing security by obscurity, do not adequately perform security practices during software development, or are simply unwilling to talk about it.

In March, we threw down the gauntlet and challenged leading software companies and organizations to show us what they are doing to write secure software. Not one of the 23 companies and organizations that we listed responded, and in a follow-up in April, only four provided us with answers.

The question was inspired by the publication of Microsoft's Security Development Lifecycle software security assurance process in 2004, as well as the company's subsequent steps to share that blueprint with developers within enterprises or third-party application firms.

Microsoft does not ship software unless it has been put through the SDL process, and it credits the process for markedly reducing security vulnerabilities in its products.

Adobe, Amazon.com, the Apache Software Foundation, Apple, CollabNet, the Eclipse Foundation, the Free Software Foundation, IBM, Intel, the Linux Foundation, Oracle, Red Hat, Software AG, Sun Microsystems, Sybase, VMware and Yahoo did not respond to our inquiry. Nokia and Salesforce.com acknowledged the request but were unable to provide comment by deadline.

"There is such a disconnect between security experts and application development professionals that they probably lack the ability to respond in a coherent manner," said Mike Gualtieri, a senior analyst with Forrester Research.

"Security at many firms is done after the software development life cycle. Also, they probably don't want to reveal their app dev security process because it could be sub-par to where it should be and encourage hackers to attack, attack, attack."

Google has published a security resource on its Security and Privacy page for Google Apps. That resource includes a white paper that provides information about Google's general organizational and operational security practices to customers, partners and users, said spokesperson Jay Nancarrow.

 Related Search Term(s): security

Pages 1 2 3 


Share this link: http://www.sdtimes.com/link/33432
 

Comments

04/24/2009 06:24:36 PM EST

Do you really believe The Linux Foundation is practicing security through obscurity or any other Open Source project/company?

United StatesRichard Chapman


05/20/2009 05:10:53 PM EST

@Richard I don't buy that argument that 'more eyes' automatically means more security. The requirements that go into developing the software, and the tools that are used matter regardless of the methodology.

United StatesDavid Worthington


Add comment


Name*
Email*  
Country     


  • Comment
  • Preview
Loading



 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 
Download Current Issue
ISSUE 9/1/2010 PDF

Need Back Issues?
DOWNLOAD HERE

Receive the print Edition?


 
blogs tab
VMworld hops to it
Data center operating systems play a big part at VMworld, but it's still too soon.
09/02/2010 01:42 PM EST

Certificate program for secure cloud computing
The Cloud Security Alliance introduces user certification.
09/01/2010 04:20 PM EST

What does the Army's Crusher tank and RIM's tablet computer have in common?
RIM plans to use Crusher tank technology on its yet-to-be-announced tablet.
08/25/2010 04:16 PM EST

 

Events calendar tab
Intel Developer Forum
9/13/2010 to 9/15/2010
San Francisco
Intel

JavaOne & Oracle Develop
9/19/2010 to 9/23/2010
San Francisco
Oracle

Oracle OpenWorld
9/19/2010 to 9/23/2010
San Francisco
Oracle

ESC Boston
9/20/2010 to 9/23/2010
Boston
TechInsights

High Performance Computing Financial Markets
9/20/2010
New York City
Flagg Management