Industry View
Who Pushed Vendors Toward Better Security?
Hint: It had something to do with pressure from customers and government agencies, writes Oracle Corp. CSO Mary Ann Davidson
By Mary Ann Davidson, CSO at Oracle Corp.
It may take three to five years for a secure configuration change to ripple through the entire product stack that must consume it. Allowing vendors to make progress at significant (major release) milestones is preferable to asking them to meet an arbitrary deadline that may force them to install products in a way that breaks everything that depends on current settings.
Even with some of the timing, scope and governance challenges of secure configuration programs, it is nonetheless a crucial means to change the market expectation for software vendors from "it's the customer's problem to configure this product securely" to "my product installs more securely than my competitor's product." Increasing the default security posture of software makes too much sense not to do it.
There is broad awareness among customers and software vendors that software security must improve. Lowering lifecycle costs to customers through secure configurations and providing them with the tools to know how much security they are getting is a critical trend that will enable the market for better software security to flourish.
Oracle Corp. Mary Ann Davidson
Security Directions: A Virtual Conference
Available On Demand Sept. 30 - Dec. 30
Join us for a virtual event with candid, expert information on top security challenges and issues - all from the comfort of your desktop.
Protecting PII: How to Work with IT to Manage Risk
Understand the critical nature of the test data privacy problem and get tips on how to work with IT to implement a test data privacy program.
- Practical Approaches for Securing Web Applications across the Software Delivery Lifecycle
- Managing A Growing Threat: An Executive's Guide to Web Application Security
- FISMA Prescriptive Guide
- The Tripwire HIPAA Solution: Meeting the Security Standards Set Forth in Section 164
- Beyond PCI Checklists: Securing Cardholder Data with Tripwire's Enhanced File Integrity Monitoring
- IDC White Paper: CCM for IT Compliance and Risk Management
Get instant notifications when whitepapers, webcasts and case studies are added
to our library. Sign up for a Resource Alert now!
CSO Corporate Partners
CSO Perspectives
-
April 5-7, 2010Hyatt Regency Santa ClaraClick here for more information!
Santa Clara, California
(ISC)2 members can earn up to 24 CPE Credits!
