Re: [Full-disclosure] How secure is software X?
From: "Michael Silk" <michaelslists@xxxxxxxxx>
<SNIP>
why do we need this?
Take your average bit of common software. I can bet someone's thrown Spike
at it, someone else crazyfuzz, and another foofuz. Now let's say that it
stood up to everything that was thrown at it - and let's say another product
crumbled in the first few seconds. I'd rather have the first product on my
network if, as a business requirement, I need the functionality that that
software provided. Sure - it's not a guarantee that it's devoid of security
vulnerability but I can be assured that the software's not going to fall to
a script kiddie.
If a product did stand up the Spike, crazyfuzz and foofuzz then let's talk
about it! The problem is you only ever hear about when these fuzzers
actually find things.
What I'm suggesting is simply collating our bug-hunting collective knowledge
into a standard. Those who wish to protect their "trade secret bug find
techniques" don't have to play if they don't want.
But in answering "why do we need this?" you clearly don't - but there are
people out there that do need this - or at least would like it.
you're referring to what already takes place commercially.
"hi i want a security assessment".
who's going to do these assessments for free? who confirms that the
people doing the assessment know what they are doing?
The thing with a standard is that it is a standard. A such efforts should be
entirely reproducible. Have 3 or more people follow that standard and
compare results at the end. If there's a discrepancy someone's not following
the standard. The other aspect of course that it's trivial to write and
verify tools that follow a standard.
"Customer: I was hacked .." -> me: -> "David Litchfield told me it was
secure, blame him" -> "David Litchfield: Oh no, our VAAL is just a
guide." -> "Customer: So why the hell do I care about it then?"
Guides for people to use are okay (hello OWASP Guide, and others) but
all your trying to start is a non-commercial free security assessment
service.
Absolutely. Let's face it - it's what goes on every day, anyway. At least
people who care about assurance would be able to make something useful out
of all that effort. Besides, who said it had to be free? Like CC - if a
company wanted their product evaluated they could pay for it. Or not. I'm
sure cost will become relevant at some point but not now. I'm more
interested in the technical merits at the moment.
Cheers,
David Litchfield
http://www.databasesecurity.com/
http://www.ngssoftware.com/