Tag Archives | Security

For a story I wrote for SD Times, I asked leading software makers to tell me about the processes they use to develop secure software–and found that most were unwilling to discuss the subject. Some companies will provide specious reasons for not being transparent, including the notion of providing customers with “security through obscurity,’ but I believe that many are simply fearful of appearing disorganized and unconcerned.

How software is designed affects your safety, financial security, and privacy. Poorly-designed software has reportedly enabled foreign intelligence agencies to violate vital infrastructure in the United States (and presumably elsewhere), and it enables those with the know-how to get at your personal information on your own computer.

Consensus is that it is more effective to design software to be as secure as possible as early as possible in its development life cycle. Microsoft and other leading software companies have changed how they develop software to make security a requirement; consequently, vulnerabilities in Microsoft software are down dramatically.

Microsoft now shares its blueprint for developing software with its customers, and has begun to provide developers with free security tools that it uses internally. It did so because its knows that hackers are targeting applications that run on its platform, including third-party ones, as its hardens Windows with additional security.

If Microsoft is rising to the challenge, the other major software makers must be too, right? Wrong. I contacted over 20 leading companies including Apple, IBM, Nokia, Yahoo, only to be largely ignored. Include open source groups in that count. If those companies won’t be transparent, how can you trust the software that powers your cell phone, or stores your financial information?

Believe it or not, I am being told that many companies, including competitors, are asking Microsoft for advice or are simply copying its methods. That’s both encouraging and disappointing.

Some of those companies may be doing the right things, but I’m not encouraged by their silence. Software makers may do security testing after software is developed, or in bits and pieces, lacking a unified, company-wide strategy. However, security cannot be an afterthought, and there is no excuse for the industry to continue place its customers at risk.

Foreign intelligence agents critically infiltrated systems that operate critical U.S. infrastructure, and left behind malicious software that could disrupt and endanger the day-to-day lives of Americans, the Wall Street Journal reports.

The paper cites anonymous current and former U.S. intelligence officials in its report. The spies are reported to have been agents of China, Russia, and various unnamed other countries. The officials said that the intruders was a mission to map the U.S. electrical grid and other critical infrastructure, and to cultivate the capability to disrupt that infrastructure during a crisis. I’m certainly not surprised, and U.S. agents have probably done the same thing to other countries.

In my reporting for SD Times, I have spoken with companies that develop software according to the US National Security Agency’s Common Criteria Evaluation Assurance Level (EAL) program. EAL is an initiative operated by the National Security Agency to help industry create secure software, and classify existing software. The program is a relatively new public initiative that was born out of the “orange book,” the U.S. military’s once closely guarded guidelines for software security.

To date, only Green Hills Software, a company that develops a specialized operating system called Integrity, has received an acceptably high score on the EAL to address the problem. The NSA is also sponsoring secure programming classes at public universities.

Why is the NSA involving itself in the private sector, you may ask? It needs help. In a recent interview, Rex Black, president of Rex Black Consulting Services, explained to be how software engineers are essentially playing a game of multidimensional chess against hackers.

Black said that a big part of the problem is that modern operating systems (and that includes open-source ones) are constantly evolving and contain tens of millions of lines of code. It is only a matter of time until a defect slips by and is discovered by cybercriminals–or spies – even when the best development practices are followed.

And the technological environment in which an operating system exists is constantly in flux, making it nearly impossible to foresee threats that do not presently exist, but might exist in the future, Black said.

People involved with the EAL effort have told me just how poor the state of infrastructure security is. But fear not, in my research, security industry executives and an NSA official have assured me that President Obama “gets it.”

The reality is that there is an infrastructure crisis, and the WSJ’s hacking report, while troubling, is only a symptom of what ails us. The American Society of Civil Engineers has spent much of the past decade grading the nation’s infrastructure, only to be ignored.

This year, the engineers give the U.S. an overall grade of a D, and estimate that it will take an investment of several trillion dollars to bring states up to code. The stimulus package only goes a small way toward meeting those needs.

It’s time for the U.S to get serious about infrastructure, and yes, it costs money to do these things. That could even require –gasp~-a tax hike to pay for our safety. The work needs to be done, and is long overdue.