GEEKONOMICS

Apple: The Grueling Spotlight of Popularity

Apple delivers record monster security update

Becoming wildly popular has benefits; it also has repercussions. According to a Computerworld article:

Apple [yesterday] patched 92 vulnerabilities, a third of them critical, in a record update to its Leopard and Snow Leopard operating systems.

"The sheer number, it's almost so daunting that you don't even want to look," said Andrew Storms, director of security operations at nCircle Network Security.

On the contrary, we need to take a look; a very hard look. The grueling spotlight of popularity makes blemishes all too conspicuous in software products, but by then, it is too late: customers become unwitting targets for cyber attackers. As Apple increased in popularity, so did its customer's exposure - specifically, latent security defects that jeopardized Apple's loyal followers. The graph below illustrates the rise of disclosed vulnerabilities in Apple products compared to market share. 

  

The 2004 to 2005 time frame shows a marked increase in number of disclosed vulnerabilities as Apple market share improved from 3.4 percent to 4.35 percent. When market share reached 7.3 percent in 2007, disclosed vulnerabilities skyrocketed by 268 percent (from 2004). This suggests that security is not part of the popularity contest; that is, a drastically increasing number of vulnerabilities did not negatively impact Apple's market share. Security is highly decoupled from other competitive pressures and thus software manufacturers can largely ignore software security without fearing customer backlash. 

Of course, strong opposition exists to employing software vulnerabilities as a measure of security. Still others argue that it is not number of vulnerabilities, but number of exploits that matter most. Both arguments have some merit. But vulnerabilities give cyber attackers an unacceptable advantage. Vulnerabilities are indicative of poorly written, poorly designed software. Vulnerabilities signal attackers which in turn invites more attackers to search for other vulnerabilities the software manufacturer failed to detect before releasing the product. Vulnerabilities jeopardize customers. Period.

Perfect software is not possible, but it could be suggested that buyers tolerate far too much imperfection, and discover the degree of imperfection far too late to sufficiently counter risks to themselves or significantly alter the behaviors of software manufacturers that introduce those risks in the first place. 

 

Geekonomics on Beyond the Perimeter with Amrit Williams (Part 1)

Amrit Williams, BigFix CTO, discusses Author David Rice’s concept of Geekonomics in this two part interview. We discuss:

• My wardrobe of black Armani for my up-coming show on SciFi.
• The absence of a brightline and why that's perverse.
• The lessons of The Three E's (Engineering, Education, Enforcement).

Episode 82: Geekonomics and the Impact of Insecure Software, Part 1.

Geekonomics: Chinese Edition

The Chinese edition of Geekonomics is now available.

 

 
 

Are You Rugged?

Infrastructure needs software that is not only agile, but also rugged. Rugged software is capable of withstanding hostile actions and harsh environments while delivering value. Rugged Software Development provides a philosophical foundation for regularly and consistently creating resilient, survivable software. Rugged guides software developers to create better software without the draconian notion of security police breathing down their necks. Rugged is a value system, not a compliance system.

Rugged values results over style. We don't care if you are Agile, if you use waterfall, if you employ Open SAMM, Microsoft SDL, or if you leverage BSI-MM. We don't care if your White Crane programming kung-fu style is more elegant than someone else's Dancing Tiger programming kung-fu process. We don't care.

What Rugged cares about is results:

• software that can deliver value irrespective of the savviness of end-users or the technical capabalities of adversaries.
• Software that endures against the environmental forces arrayed against it in cyberspace.
• Software that is not a source of weakness for customers, but a source of strength.

U.S. Deputy Secretary of Defense William Lynn stated in The New York Times that "a fortress mentality will not work in cyber. We cannot retreat behind a Maginot Line of firewalls...If we stand still for a minute, our adversaries will overtake us."

To do that, we need software that is Rugged.

Are you Rugged?

Recite the Rugged Manifesto:

I am rugged... and more importantly, my code is rugged.

I recognize that software has become a foundation of our modern world.

I recognize the awesome responsibility that comes with this foundational role.

I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended.

I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic, and national security.

I recognize these things - and I choose to be rugged.

I am rugged because I refuse to be a source of vulnerability or weakness.

I am rugged because I assure my code will support its mission.

I am rugged because my code can face these challenges and persist in spite of them.

I am rugged, not because it is easy, but because it is necessary... and I am up for the challenge.

To find out more about Rugged, please visit www.ruggedsoftware.org.

Agile Development and Security

Adrian Lane over at Securosis posted a great article on the interaction between Agile software development and secure software development. Also, the comments/discussion are particularly good (Andre Gironda adds his remarks).

FireStarter: Agile Development and Security

The Difference a Label Makes

Labels matter, especially when it comes to intangibles in the market place. Intangibles cannot be readily observed. Fuel efficiency, energy effeciency, auto-safety, and software security are all examples of intangibles. Without a label identifying the "amount" of an intangible supplied by a given manufacturer, it is troublesome for buyers to receive trustworthy, objective information from a seller because sellers are biased in the transaction. As a result, an intangible will remain undersupplied.

The effect of labeling is as profound as its absence. The video below illustrates the impact of the NHTSA 5-star labeling system on the auto market.  A 2009 Chevy Malibu and a 1959 Chevy Bel Air collide head-on. Which vehicle would you want to be in?

Labels matter.

 

David Rice on Silver Bullet Security Podcast with Gary McGraw

Show 046 - An Interview with David Rice

On the bonus-length 46th episode of The Silver Bullet Security Podcast, Gary talks with David Rice, Executive Director of the Monterey Group and author of Geekonomics: The Real Cost of Insecure Software. Gary and David discuss David’s involvement with Infowar at the Naval Postgraduate School and how it impacted his thinking about software, the recent Chinese cyberattack on Google, what incentives exist to create and apply software security best practices, how users may be mistaking marketing for security, and the SANS WhatWorks in Application Security Summit. They close out by discussing unusual yoga positions.

Listen to the podcast on the Cigital website: Show 046 - An Interview with David Rice

Many thanks to Gary McGraw. I greatly enjoyed our conversation.

Special Webcast: The Impact of BSI-MM in Software Development Programs

I will be interviewing Gary McGraw, CTO of Cigital, on Friday, January 22 at 1pm EDT on the impact the Building Security In Maturity Model (BSI-MM) has had on software development programs since its release in Q1 of 2009.

The webcast will be delivered through the SANS Institute and is located here:

The Impact of BSI-MM in Software Development Programs

Gary McGraw also will be giving the opening keynote at the SANS Application Security Summit in San Francisco, February 4th. Please start planning today to attend.

SANS Application Security Summit 2010

Please join me at the first annual SANS AppSec Summit 2010 in San Francisco on February 4th and 5th (http://www.sans.org/appsec-2010/).

We've got a fantastic line up of speakers and panelists including:

• Gary McGraw (Cigital)
• Mike Howard (Microsoft)
• Jim Routh (former CISO for DTCC)
• Bob Martin (MITRE)
• Chris Wysopal (Veracode)
• Roger Thornton and Brian Chess (Fortify)
• and many more!

To follow or tweet about this event, use the hashtag #sansappsec2010.

Follow SANS at http://twitter.com/SANSInstitute.

Start making your plans today to attend!

David Rice

Chairman, What Works in Application Security Summit 2010

Google, China, and Insecure Software

Operating, but not with confidence

The news that Google and 30 other U.S. companies were victims of “highly sophisticated and targeted attacks” is not new or surprising. Cyberattacks have been increasing in scope and sophistication for more than 15 years. What is interesting is the direct challenge by the U.S. Secretary of State, Hillary Clinton, and what this event reveals.

On January 12th, Mrs. Clinton stated the following:

"We have been briefed by Google on these allegations, which raise very serious concerns and questions. We look to the Chinese government for an explanation. The ability to operate with confidence in cyberspace is critical in a modern society and economy."

This statement is a direct challenge to Beijing, which in the art of statecraft, is both bold and stern. There are only a handful of times the United States publicly confronted Beijing leadership on matters of cybersecurity. Though Mrs. Clinton’s challenge likely will be brushed aside by Beijing, the kerfuffle is evidence that cyberspace conflict is heating up. At root, insecure software.

Quoting ComputerWorld:

Sources familiar with the situation say that more than 30 U.S. companies, including Adobe Systems, were hit by this targeted attack, which Google first discovered in mid-December. Using an attack that exploited an unpatched bug in widely used software, the attackers were able to gain footholds in these companies and siphon out valuable intellectual property [my emphasis].

Google is right to call foul and Mrs. Clinton is correct to challenge Beijing, but the United States is equally remiss in failing to directly challenge a cold hard fact: preventable vulnerabilities in our own software are undermining our "ability to operate with confidence in cybersapce." Beijing deserves to be scolded; they are not the only ones.