Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/17/2006
06:05 PM
Mitch Wagner
Mitch Wagner
Commentary
50%
50%

Security Research Isn't Pretty, But It's Necessary

Security research is a dirty job, but somebody has to do it. Security researchers run an assembly line of self-aggrandizing publicity, churning out press releases and announcements patting themselves on the back for discovering security vulnerabilities in software by Microsoft, Oracle, and other major vendors. The researchers operate under a constant cloud of suspicion: Are they simply creating a climate of useless fear, stifling innovation, E-commerce, and technology implementation? Are they

Security research is a dirty job, but somebody has to do it. Security researchers run an assembly line of self-aggrandizing publicity, churning out press releases and announcements patting themselves on the back for discovering security vulnerabilities in software by Microsoft, Oracle, and other major vendors.

The researchers operate under a constant cloud of suspicion: Are they simply creating a climate of useless fear, stifling innovation, E-commerce, and technology implementation? Are they providing guideposts to computer criminals on where and when to attack?

But as reported in "The Fear Industry" by Larry Greenemeier, security researchers provide an essential function. They apply pressure on vendors to fix security flaws instead of simply denying the flaws exist and hoping they go away. And they help fill IT managers' insatiable need for information about vulnerabilities and security.Larry describes how security researchers drove exposure of the Windows Metafile vulnerability earlier this year, discovering the flaw, posting a sample exploit, releasing a third-party patch when Microsoft moved too slowly to fix the problem, and eventually driving Microsoft to release its own patch for the vulnerability five days ahead of schedule. The relentless action by security researchers drove people like Connie Sadler, director of IT security at Brown University, to tear up their schedules for several days and focus on fixing the Windows Metafile vulnerability on their own networks.

Vendors like Cisco, Apple, and Oracle have similarly had their feet held to the fire.

Security vendors like 3Com and iDefense offer bounties of up to $10,000 to researchers who discover a serious security flaw. They say they provide an alternative to security researchers, who can be paid up to $4,000 for selling those vulnerabilities to crooks.

So are these researchers providing a service, or are they little better than crooks themselves? IT managers like Sadler love them, despite the inconvenience they cause. "Yes, sometimes that backfires. But from a high level, it's a good thing. The folks who use this information to do damage are going to know about it long before us anyway," she says. And she likes knowing which vendors are producing insecure products.

What do you think? Should security vulnerabilities be covered up, or aggressively exposed to public scrutiny?

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25159
PUBLISHED: 2020-11-24
499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
CVE-2020-25654
PUBLISHED: 2020-11-24
An ACL bypass flaw was found in pacemaker before 1.1.24-rc1 and 2.0.5-rc2. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went throu...
CVE-2020-28329
PUBLISHED: 2020-11-24
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.
CVE-2020-29053
PUBLISHED: 2020-11-24
HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
CVE-2020-25640
PUBLISHED: 2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.