Opinion

Letters

By CSO Contributor

Page 2

Notification of the penetration through the InfraGard organization gives the company the choice to simply report without having company-identifying information revealed and allows others to be alerted to the exploit before they encounter it in their network on an opt-in basis. A simple report through InfraGard serves the higher purpose to reduce our shared risk. A critical mass of real-world incident data can contribute greatly to analysis and trending, resulting in improvements in preventive, investigative and incident-reduction efforts. Submission of incident data without fear of a confidentiality leak or loss of control is an important message and one that was completely missing in this article. For more on incident reporting through InfraGard, see www.infragard.net/ireporting.htm.
Betty Pierce
President
Secure Network Systems
FBI InfraGard Denver Board Member

A former security officer for the Department of Energy recommended a different route to report computer crime. I forwarded the process to a company that used it successfully. The company hired a private security company to come in and compile the evidence. The security company assisted in taking the evidence to the authorities. The process worked very well, and the company was successful in court.
Phil Shockley
CIO
Payday People PlusPatchy PrayersIn August, we told you to patch. And to pray. Some of you found that advice sinful.

Although patching is a chore, it is the only way to currently keep the vandals and their viruses at bay. Slammer was a very tricky exploit, but most worms are not as sophisticated and most patches are beneficial.

On the other hand, the big problem is the lack of liability that the software publisher faces in the real world. Every license stipulates that the publisher is not responsible for "collateral damage" resulting from the use of the software. This is like a carmaker saying that its liability is limited to the car itself and not the passengers or pedestrians.

If there is no incentive to make the software more secure through exhaustive testing, the publishers will not do it. If industry reviewers criticize a company for being late to market because of thorough testing, as Microsoft was with Windows 95, then we can expect more buggy code.

Software publishers have the most restrictive rights of any intellectual property I can think of. Along with that should come a responsibility to produce the best, most thoroughly tested product possible.
Terry Clark
Systems Manager
The Republic

We must find ways to automate the maintenance of systems. We cannot hope to defend against sophisticated automated exploits without sophisticated automated defenses!
Connie Sadler
IT Security Officer
Brown University