Blunder Dome Sighting  
privacy 
 
 
 

Hangout for experimental confirmation and demonstration of software, computing, and networking. The exercises don't always work out. The professor is a bumbler and the laboratory assistant is a skanky dufus.



Click for Blog Feed
Blog Feed

Recent Items
 
As Complex as Necessary and no More.
 
The Same Old Mistakes, Over and Over Again
 
Sorting the Mail: Agile Databases, Vulnerable Appl...
 
SSH and Known_Hosts Vulnerabilities Threaten Grid
 
Service Research: Focusing on Requirements for Tec...
 
TiddlyWiki: Ohmygosh, I'm in Love.
 
3I: Individualized Interactive Instruction
 
Three Defects We Can Do Without: Memory Leaks, Buf...
 
Windows Genuine Advantage: So, did I fail the test...
 
Hark, Is That a Pattern I See Before Me?

This page is powered by Blogger. Isn't yours?
  

Locations of visitors to this site
visits to Orcmid's Lair pages

The nfoCentrale Blog Conclave
 
Millennia Antica: The Kiln Sitter's Diary
 
nfoWorks: Pursuing Harmony
 
Numbering Peano
 
Orcmid's Lair
 
Orcmid's Live Hideout
 
Prof. von Clueless in the Blunder Dome
 
Spanner Wingnut's Muddleware Lab (experimental)

nfoCentrale Associated Sites
 
DMA: The Document Management Alliance
 
DMware: Document Management Interoperability Exchange
 
Millennia Antica Pottery
 
The Miser Project
 
nfoCentrale: the Anchor Site
 
nfoWare: Information Processing Technology
 
nfoWorks: Tools for Document Interoperability
 
NuovoDoc: Design for Document System Interoperability
 
ODMA Interoperability Exchange
 
Orcmid's Lair
 
TROST: Open-System Trustworthiness

2005-05-29

 

A Litany of Lists: Creatiing Secure Applications

Let’s have some lists and check them over and over:

ACM News Service: Security – More Than Good Programming.  The first list is based on a BZ Research survey of software development managers reported in Alan Zeichick’s 2005-05-15 SD Times article.  Here are the heavy hitters:

  • poor programming practices (apparently everyone’s favorite at 55.9% of respondents)
  • poor design and architecture
  • lack of developer security training
  • inadequate testing and quality assurance
  • insufficient management emphasis on security
  • flaws in software components and libraries (42.5%)
  • poor deployment and administrative practices (42.0%)

There were also respondents who proposed remedies, and some also cited problems of user behavior and lack of security consciousness.

The breakdown on where the problems occur declines as follows:

  • Desktop operating system (63.2%)
  • Desktop application
  • Server operating system
  • Web server
  • Web application
  • Server application
  • Database server
  • Application server
  • Web services and middleware (14.7%)

Other dimensions of the systems security picture are also explored in the full article.

ACM News Service: Collaboration Is a Necessity for a Secure Infrastructure.   This burb begins with an auspicious assertion: “Now that IT is considered an integral part of the business, it is time for collaboration between industry users and vendors to establish best practices.”  This is being put forward at the Global CSO Council, according to Emma Nash’s 2005–05–26 Computing article.  From that perspective, promoted by Oracle’s Chief Security Officer, Mary Ann Davidson, the following remedies are among those called for:

  • Incorporation of auditing standards in commercial software, enhancing its ability to detect and report disrepancies
  • Drumming security into students while they are still learning, breeding a security-conscious next generation
  • Certification of university programs and requirement that competence at basic secure coding be demonstrated

 
Construction Structure (Hard Hat Area) You are navigating Orcmid's Lair.

template created 2004-06-17-20:01 -0700 (pdt) by orcmid
$$Author: Orcmid $
$$Date: 10-04-30 22:33 $
$$Revision: 21 $