After this week, Rich and I are “Home for the Holidays”, with the last of the year’s travel behind us.
We have started work on our Web Application Security Program, and in keeping with our dedication to transparency in our research, we will be posting research notes for comments here on the blog during the next couple of weeks. We’re the first to admit that more of our revenue comes from sponsors/vendors than end users, but we believe that total transparency in our research process can help weed out any overt or subconscious bias and keep us honest. And let’s face it- we want to give you free stuff, and this is the only way I can do that and keep all my dogs fed.
Rich and I are looking forward to avoiding the airports during the holidays and we should be pumping out a ton of research to close out our year.
Now on to the week’s security summary:
Webcasts, Podcasts, Outside Writing, and Conferences:
Rich was in Mi esota this week, meeting with clients and giving his DLP pitch, at a T-Wolves game before returning. (No, he didn’t wear a gorilla suit, and no flaming rings were involved).
On the Network Security Podcast this week, Martin and Rich interviewed Glenn Fleishman on the recent WPA crack and more.
CSO Magazine published seven of Rich’s predictions for 2009. Not one involves Hoff or SCADA.
Rich wrote a TidBITS article on how the new anti-phishing features work (or don’t) in Safari. This one really isn’t Apple’s fault, he’s just not a fan of Extended Validation certificates, and hopes users don’t rely on a blacklist filter to completely protect themselves.
Favorite Securosis Posts:
Rich: Gives his perspective on the evolution of, and current challenges facing, Building a Web Application Security Program.
Adrian: Rich’s post on Microsoft’s move to give AV away to Windows users.
Favorite Outside Posts:
Adrian: Amrit Williams’ humorous look at great Tech Failures.
Rich: Gunnar Peterson’s lecture on security, economics, and breaches: The Economics of Finding and Fixing Vulnerabilities in Distributed Systems. I may not agree with all of it, but this is exactly the kind of perspective we need to develop more in security professionals.
The big news all week has been the automobile manufacturers in Washington looking for bailout loans. The political game has been high drama, with both sides accusing each other of ineptitude.
Oh yeah, that whole Stock Market bug-a-boo. Anyone think we will drop to 6k before this is all over? 5k? You didn’t own stocks, did you?
Deja Vu all over again … IT functions being outsourced during tough economic conditions. What’s next, call centers in India?
The Metasploit Framework, version 3.2 has been released.
Not security related, but this parody of the real estate crisis is just too funny not to share.
The Chinese Hacker Flowchart. Nothing new, but interesting anyway.
Google is supporting OAuth for secure mashups. I’d like to dig into the model more and see if a malicious gadget can use this to compromise credentials. At a minimum, it will likely enable easier CSRF. We finally have users suspicious about installing desktop apps, but now we have to explain why online gadgets/widgets are also dangerous. Sigh.
Massachusetts privacy law includes security standards. Most of which just require documentation, and other than encryption very little security.
Blog Comment of the Week:
From ‘ds’, on Building A Web Application Security Program:
Looking forward to this series. I undertook this process last year with much success. It was something that benefited the business, with an ability to conduct testing more regularly than could be done with externals as well as more affordably. It also provided a nice career path for the technical team members and raised the profile of security as something more than just a specialized system administrator. We’ve gotten more “good press” with our business leadership on this than most anything else we’ve done.