Re: [SC-L] [External] Re: SearchSecurity: Dynamism

2015-09-08 Thread Goertzel, Karen [USA]
k cat in a dark room, especially if there is no cat." - Confucius From: Peter G. Neumann [neum...@csl.sri.com] Sent: 06 September 2015 15:24 To: Goertzel, Karen [USA] Cc: Alfonso De Gregorio; Johan Peeters; Secure Code Mailing List Subject: Re: [SC-L]

Re: [SC-L] [External] Re: SearchSecurity: Dynamism

2015-09-08 Thread Goertzel, Karen [USA]
From: Gary McGraw [g...@cigital.com] Sent: 08 September 2015 15:44 To: Goertzel, Karen [USA]; Peter G. Neumann Cc: Secure Code Mailing List Subject: Re: [SC-L] [External] Re: SearchSecurity: Dynamism As far as I know, Microsoft integrated some reference monitoring into their OS family under Fred S

Re: [SC-L] [External] Re: SearchSecurity: Dynamism

2015-09-06 Thread Goertzel, Karen [USA]
Does anyone else remember "reference monitors"? What an old-fashioned idea. But they'd certainly solve a lot of problems. === Karen Mercedes Goertzel, CISSP, CSSLP Senior Lead Scientist Booz Allen Hamilton 703.698.7454 goertzel_ka...@bah.com "The hardest thing of all is to find a black cat in a

Re: [SC-L] [External] Re: SearchSecurity: Medical Devices and Software Security

2014-07-07 Thread Goertzel, Karen [USA]
Scientist Booz Allen Hamilton 703.698.7454 goertzel_ka...@bah.com Answers are easy. It's asking the right questions which is hard. - The Doctor From: Jeffrey Walton [noloa...@gmail.com] Sent: 07 July 2014 14:56 To: Goertzel, Karen [USA] Cc: Secure Code

Re: [SC-L] [External] Firewalls, Fairy Dust, and Forensics

2014-04-04 Thread Goertzel, Karen [USA]
The one point that's missing from the article is to remind people: What the heck do you think firewalls are made of? Software! So unless a software manufacturer has got software security religion, their product is just as likely to be broken inside than the things it allegedly protects. ===

Re: [SC-L] [External] Re: Sad state of affairs

2013-09-24 Thread Goertzel, Karen [USA]
I agree that ONE end goal of software security is to safeguard data - but it is not the only goal...and may not even be the primary goal, depending on the type of system the software is part of. In a safety-critical system, safeguard the data takes on a very different meaning from what one

Re: [SC-L] [External] Sad state of affairs

2013-09-24 Thread Goertzel, Karen [USA]
On the other hand, isn't it somewhat analagous to hiring 24/7 armed security guards and installing a state of the art physical security system in a museum, and passing and enforcing strict laws against grand larceny? The secure coding alternative would be for museums to stop displaying

Re: [SC-L] [External] Chinese Hacking, Mandiant and Cyber War

2013-02-20 Thread Goertzel, Karen [USA]
I agree - and grow increasingly frustrated with those who insist on confusing cyber war with cyber espionage (and vice versa). But I've found it's quite easy to get them to understand the difference by simply asking them to drop the prefix cyber from each. Cyber war is simply war fought on an

[SC-L] Won't it be great if they can finally make survivable software-intensive systems a reality?

2013-02-19 Thread Goertzel, Karen [USA]
http://www.newscientist.com/article/mg21729045.400-the-computer-that-never-crashes.html === Karen Mercedes Goertzel, CISSP Lead Associate Booz Allen Hamilton 703.698.7454 goertzel_ka...@bah.com If you're not failing every now and again, it's a sign you're not doing anything very innovative. -

Re: [SC-L] Re (badware vs. goodware): SearchSecurity: Badware versus malware

2012-05-14 Thread Goertzel, Karen [USA]
] Sent: 13 May 2012 04:17 To: sc-l@securecoding.org Cc: Goertzel, Karen [USA]; Peter G. Neumann; Gary McGraw Subject: Re (badware vs. goodware): [SC-L] SearchSecurity: Badware versus malware Karen, whereas flaws and defects can hardly be argued to have possibly some good affects, there have been

Re: [SC-L] SearchSecurity: Badware versus malware

2012-05-11 Thread Goertzel, Karen [USA]
In other words, flaws and defects caused through developer error, ignorance, negligence etc. can be exploited to cause harm. So even if one could prevent actual intentional malicious inclusions in software, one hasn't eliminated the problem of exploitable flawed logic. The megachallenge, of

Re: [SC-L] Fwd: [SEWORLD] SWEBOK Version 3 Call for Reviewers

2012-03-07 Thread Goertzel, Karen [USA]
Unfortunately, it seems like the SWEBOK folks still believe that if you have high-quality software, that will be sufficient to assure robustness against intentional threats. It also shows a touching lack of faith that there will never be an malicious participant in the SDLC intentionally

Re: [SC-L] informIT: Building versus Breaking

2011-09-02 Thread Goertzel, Karen [USA]
What we need is to start building software that can fight back. Then we could become part of cyber warfare which is much sexier than software assurance. :) === Karen Mercedes Goertzel, CISSP Booz Allen Hamilton 703.698.7454 goertzel_ka...@bah.com Sorry, you have reached an imaginary number. If

Re: [SC-L] informIT: Building versus Breaking

2011-09-01 Thread Goertzel, Karen [USA]
There are these: ISC(2) Secure Software Conference Series - https://www.isc2.org/PressReleaseDetails.aspx?id=650 ESSoS - http://distrinet.cs.kuleuven.be/events/essos/2012/ SecSE - http://www.sintef.org/secse SSIRI - http://paris.utdallas.edu/ssiri11/ But your point is taken. Most of the

[SC-L] Special Issue of IJSSE: Software Safety Dependability - the Art of Engineering Trustworthy Software

2010-01-13 Thread Goertzel, Karen [USA]
For those who might be interested. There are still a couple weeks until the submission deadline Karen Mercedes Goertzel, CISSP Associate Booz Allen Hamilton 703.698.7454 goertzel_ka...@bah.com --- Special Issue of IJSSE Theme: Software Safety Dependability - the Art of Engineering

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-26 Thread Goertzel, Karen [USA]
Not so much anti-social as untrusting, supicious, and paranoid. Actually, being highly social could provide an excellent cover to fool the bad guys into thinking one is a lot less security-savvy than one actually is. Karen Mercedes Goertzel, CISSP Associate 703.698.7454 goertzel_ka...@bah.com

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-26 Thread Goertzel, Karen [USA]
...@bah.com From: Benjamin Tomhave [list-s...@secureconsulting.net] Sent: Wednesday, August 26, 2009 12:27 AM To: Goertzel, Karen [USA] Cc: sc-l@securecoding.org Subject: Re: [SC-L] Where Does Secure Coding Belong In the Curriculum? Goertzel, Karen [USA] wrote: We

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-26 Thread Goertzel, Karen [USA]
I too remember learning proofs in Jr. High. And I also believe the main objective was to teach 12 and 13 year olds that it is possible to apply a repeatable, disciplined process to how they approach problem solving. Certainly not a worthless lesson, even if the mathematics involved are never

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-26 Thread Goertzel, Karen [USA]
I see your point. On the other hand, there are times I worry that teach the hacker mentality approach to secure development training smacks a bit too much teaching future policemen the delights of robbery, rape, torture, and murder in order to prepare the to defend the public against robbers,

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-26 Thread Goertzel, Karen [USA]
Your Picasso - or, perhaps, Frank Lloyd Wright would be a better analogy - definitely has a role in software development. I want his creativity up front in the specification and high-level design of the building (the software system). But when it comes to detailed design and testing, I'm going

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-25 Thread Goertzel, Karen [USA]
For consistency's sake, I hope you agree that if security is an intermediate-to-advanced concept in software development, then all the other -ilities (goodness properties, if you will), such as quality, reliability, usability, safety, etc. that go beyond just get the bloody thing to work are

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-25 Thread Goertzel, Karen [USA]
1:14 PM To: Goertzel, Karen [USA] Cc: Benjamin Tomhave; sc-l@securecoding.org Subject: Re: [SC-L] Where Does Secure Coding Belong In the Curriculum? On Tue, Aug 25, 2009 at 7:26 AM, Goertzel, Karen [USA]goertzel_ka...@bah.com wrote: For consistency's sake, I hope you agree that if security

Re: [SC-L] What is the size of this list?

2009-08-22 Thread Goertzel, Karen [USA]
Actually, we can't prove programs are bug free if by bug we also mean all possible anomalous behaviours. My colleagues keep pointing this out to me when I suggest that we should start leveraging the computational power of computing grids to analyze complex software the same way other

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-21 Thread Goertzel, Karen [USA]
Here's an extract from the Information Assurance Technology Analysis Center (part of DTIC) Software Security Assurance: A State of the Art Report (http://iac.dtic.mil/iatac/download/security.pdf): Courses on secure software development, secure programming, etc., typically begin by introducing

Re: [SC-L] embedded systems security analysis

2009-08-21 Thread Goertzel, Karen [USA]
A colleague and I have been looking at the problem a bit, in the context of need for survivability in safety-critical systems. Below is an extract of the paper Software Survivability: Where Safety and Security Converge authored by Larry Feldman, Ph.D., and myself, and presented by our colleague

Re: [SC-L] embedded systems security analysis

2009-08-21 Thread Goertzel, Karen [USA]
We looked at the problem of voting system security specifically in the context of insider threat for last year's IATAC State of the Art Report on the Insider Threat to Information Systems - some of which involved rogue developers engineering backdoors into such systems. Unfortunately the

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-21 Thread Goertzel, Karen [USA]
I think we need to start indoctrinating kids in the womb. Start selling Baby Schneier CDs alongside Baby Mozart. :) Seriously, though, cyberspace is such an integral part of modern life, parents need to inculcate online security into their toddlers the same way they teach them to look both

Re: [SC-L] Where Does Secure Coding Belong In the Curriculum?

2009-08-20 Thread Goertzel, Karen [USA]
I'm more devious. I think what needs to happen is that we need to redefine what we mean by functionally correct or quality code. If determination of functional correctness were extended from must operate as specified under expected conditions to must operate as specified under all conditions,

Re: [SC-L] Certified Application Security Specialists

2009-04-01 Thread Goertzel, Karen [USA]
Yes, yes. We know. It's April 1st and all's right with the world. -- Karen Mercedes Goertzel, CISSP Booz Allen Hamilton 703.698.7454 goertzel_ka...@bah.com -Original Message- From: sc-l-boun...@securecoding.org on behalf of SC-L Reader Dave Aronson Sent: Wed 01-Apr-09 11:25 To: Secure

Re: [SC-L] more relevant certifications

2009-03-20 Thread Goertzel, Karen [USA]
I would refer you to Section 7.2.2.2, Professional Certifications, starting on page 272 of Software Security Assurance: A State-of-the-Art Report which can be downloaded from: http://iac.dtic.mil/iatac/download/security.pdf The report was published in July 2007; there may be additional

Re: [SC-L] Secure Coding Books

2008-03-07 Thread Goertzel, Karen [USA]
Do you really mean secure coding only, or are you looking for books on secure software development more generally? -- Karen Mercedes Goertzel, CISSP Booz Allen Hamilton 703.902.6981 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] on behalf of Lawson, David L Sent: Fri

Re: [SC-L] Software process improvement produces secure software?

2007-08-07 Thread Goertzel, Karen
I've always had a question about this as well; specifically, what is really meant by adding security to a CMM? I've always felt that the level at which the software (or system) process is defined by a CMM is too high and too abstract for the addition of security activities to be particularly

Re: [SC-L] Anyone here attending the 6th Semi-Annual Software AssuranceForum

2007-02-22 Thread Goertzel, Karen
I'll be there, and presenting. I'd be interested in a BoF (but not a BOF). -- Karen Mercedes Goertzel, CISSP Booz Allen Hamilton 703.902.6981 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kenneth Van Wyk Sent: Thursday,

[SC-L] Samsung gets it!

2006-06-07 Thread Goertzel Karen
Title: Samsung gets it! Anyone looking to move to Austin, TX? -- Karen Mercedes Goertzel, CISSP Booz Allen Hamilton 703-902-6981 [EMAIL PROTECTED] -Original Message- [snip] 1. US: Austin, Texas: Senior Security Systems Analyst Posted by: Andrew Cardwell [EMAIL PROTECTED]

RE: [SC-L] Credentials for Application use

2005-05-12 Thread Goertzel Karen
I'm wondering whether role-based credentials, vs. individual user credentials, might not make more sense here. Could the database owner key be issued to a role vs. an individual identity? In this way, your human users could be associated with a role that has a right to issue a query to the

RE: [SC-L] Credentials for Application use

2005-05-11 Thread Goertzel Karen
Isn't a Single Sign-on System supposed to address exactly this kind of problem? Users need to be authenticated individually. Also, they don't want to have to deal with multiple sets of credentials and different login procedures for different apps/systems. Login requirements for various apps and

RE: [SC-L] Application Insecurity --- Who is at Fault?

2005-04-06 Thread Goertzel Karen
I think it's a matter of SHARED reponsibility. Yes, the programmers and their managers are directly responsible. But it's consumers who create demand, and consumers who, out of ignorance, continue to fail to make the connection between bad software security and the viruses, privacy, and other

RE: [SC-L] certification for engineers/developers?

2005-03-22 Thread Goertzel Karen
ISC(2), which sponsors the CISSP, co-developed with NSA a CISSP Concentration called the ISSEP - Information Systems Security Engineering Professional. The focus is really on the National Security Agency's way of doing systems security engineering, as reflected in the SSE-CMM methodology, and in