Sometimes Hollywood gets it right. For instance, in the movies no matter how hard you try to run, the bad guys will find you. You can’t ever really hide.

As an industry, we sometimes try to run from hackers. We move from Internet Explorer to Firefox; from Windows to Linux; from IIS to Apache. But history is clear. You can run, but you can’t hide. The latest evidence? Mozilla, the alleged antidote to Explorer, was deemed vulnerable.

Of course Mozilla is vulnerable - it’s software, isn’t it? Granted, it may have fewer vulnerabilities. More importantly, it’s not as widely distributed, so it doesn’t get picked on as much. But, it is software and software is vulnerable. Switching from Explorer to Firefox might dodge a few bullets but it doesn’t reduce in the slightest the level of vigilance required. What does that mean?

We need to run toward the danger - headlong, full-tilt, all out - so that we can understand it and create countermeasures to protect ourselves from it. This is the stuff that keeps me awake at night. Where do we run out to meet the enemy? Where do we wait for them to get closer so we can see what they are doing? How do we better understand the structural flaws of applications or components that may lead us to vulnerabilities?

There are tools emerging like CVSS that will help. But even a system like this will have limitations. There will be lots of data on a handful of ubiquitous applications and nothing available on the thousands of custom built proprietary applications used by most businesses - Internet banking applications, web content management systems, customer service ticketing, business process monitoring, internal human resource applications, etc.

The bottom line - advising our users to switch browsers or implementing new applications on Linux will only delay the inevitable and may create a false sense of security. Keep your vigilance high. Learn everything you can about the latest threats and vulnerabilities. And never, ever assume that you can hide.

This entry was posted on Wednesday, June 7th, 2006 at 12:00 pm.

Share This Information | Firefox Down SlashDot | del.ico.us | Digg it | Technorati | Reddit

Other SecureWorks Blog Categories: General (24) Links (7) Phishing (3) Research (61) Spam (1) Trojans (4)