Walter,
From my own experience developing security alone (I did security alone, focused), it's already
hard enough. Well, ok, not all that tough. All-in-one-place convenience.
From my own experience developing applications USING security modules, I'd say it's close to
impossible to build such "trip wires" or to totally secure an application. Well, ok, not that
impossible, you just need to do a complete security audit (professional help needed, ie it's not
very possible or cost-effective for non-techies to do this).
For this particular example of security breach (if everybody still remembers the example), it has
to do with a mistake in the USAGE of the security module. It's like I could make a "mistake"
programming security access to allow my janitor to enter my private office. That isn't a "mistake"
per se; it's the fact that I didn't include lock-outs for my safe deposit box inside my private
office that's the real mistake. The security module itself is not at fault.
Going back to my initial comment on building "trip wires", I'd say that it's more cost-effective
to correctly lock-down an application than to build "trip wires". Well, of course, given an
abundance of wealth, I wouldn't mind puttig in multiple layers of security (outer door, inner trip
wires, laser-zap-em-up devices, etc).
I'd say that bill could mean this: It is a requirement to conduct thorough security audit of your
internet applications.
In case you're wondering, the answer is No, many internet applications are not completely locked
down. You see security patches for MySQL, Mantis, MS, and most other internet apps. However, such
security updates are mainly to patch holes in the security module, not to correct misuse of the
security module inside the application layer.
OFBiz has a consistent security framework to facilitate a consistent "usage pattern" to facilitate
an easy security audit. Many applications that don't have such a consistent security framework
will require developers to chase down security holes all over the place.
Imagine a security system for doors that only requires pressing 10 buttons on a consistent panel;
my audit will only have 1 diagram of that panel for hundreds of doors. Now, imagine a security
system that requires button-pressing in some cases, lever-pulling in others, flying kicks,
head-banging, etc.
Jonathon
Walter Vaughan wrote:
The recently discovered/fixed gap in ecommerce security got me wondering
about an article I just read. Sen. Dianne Feinstein is re-introducing a
bill that is supported by the United States Direct Marketing Association
that would require businesses to notify consumers in the event of a
security breach.
http://www.dmnews.com/cms/dm-news/legal-privacy/39740.html
I'm not adverse to the bills actually, what I am adverse to is "How
would I know with an ofBiz installation that I've had a breach?"
I don't want the FBI coming after me because I failed to notify the
Secret Service because someone downloaded 10,001 names from our system.
In the case of the recent ecommerce gap, say on a live system, does
anyone have some sort of trip wires that would tell them that someone
is scraping data they shouldn't? And more importantly, unusual requests
that just look suspicious?
--
Walter
