Re: [SC-L] How is secure coding sold within enterprises?

2007-03-20 Thread McGovern, James F (HTSC, IT)
Thanks for the response. I already own the book and understand how to engage vendors. Where I am seeking assistance is all the work that goes on within a large enterprise before these two things occur. The ideal situation for me would be to get my hands on the five to ten page Powerpoint slide

Re: [SC-L] Economics of Software Vulnerabilities

2007-03-20 Thread ljknews
At 8:55 AM -0400 3/20/07, Michael S Hines wrote: I'm not sure what your sources are but from what I'm hearing and reading the problem is that there are many missing drivers for what have become standard peripherals that people are used to - and some of the vendors are reluctant to develop new

Re: [SC-L] How is secure coding sold within enterprises?

2007-03-20 Thread Gunnar Peterson
JD Meier had a good post recently on influencing without authority, which is the position security finds itself in: 1. assume all potential allies 2. clarify goals and priorities 3. diagnose the allies world 4. identify relevant currencies 5. deal with relationships 6. influence through give and

[SC-L] Question on User Groups

2007-03-20 Thread McGovern, James F (HTSC, IT)
Quick question for folks here. I participate in multiple user-groups and the topic of secure coding practices has never appeared. What would it take for a software vendor on this list to present to the CT OO Users Group ( www.cooug.org). These events are well attended. Likewise, I am also a

Re: [SC-L] Economics of Software Vulnerabilities

2007-03-20 Thread Wall, Kevin
James McGovern apparently wrote... The uprising from customers may already be starting. It is called open source. The real question is what is the duty of others on this forum to make sure that newly created software doesn't suffer from the same problems as the commercial closed source