SITE SPONSORS

Software and Linux Security

By Kirk L. Kroeker
www.TechNewsWorld.com,
Part of the ECT News Network
December 3, 2003

"Linux exploits tend not to receive as much attention or awareness compared to a Microsoft threat," Chris Klaus, CTO of Internet Security Systems, told TechNewsWorld. "As we see more governments and companies standardizing on Linux within their own desktop and server infrastructure, Linux will become a bigger target in the future."

Bringing together experts from the government, the commercial sector and academia, the task force is bent on examining ways to improve "common criteria," a set of standards developed by a coalition of nations to help ensure that software products purchased and deployed by government agencies are secure.

Klaus founded ISS in 1994, and since then the company has become an established world leader in security. ISS products and services are based on the security intelligence work conducted by the ISS X-Force research and development team -- a recognized authority in vulnerability and threat research. To hear this insider's perspective on where software security is headed, TechNewsWorld turned to Klaus for an exclusive interview.

TNW: As you cochair this new task force, what are the challenges you're anticipating?

Klaus: In creating this task force, we are breaking new ground and bringing together new teams and expertise to better understand the current security issues we face as a nation. The challenge is to get the right committed parties to come to the table and work through these issues. I believe that once we truly understand the issues at hand, the security problems can be resolved by cooperation between customers, vendors and government parties.

Klaus: Common criteria sets a standard for security certifications

Klaus: The current certification process attempts to address both the functional components of the end product and the assurance components that can demonstrate that the product development process incorporated security measures.

Klaus: The current state of software security could dramatically be improved. Most software, and technology, is developed and deployed without any consideration for security. This is changing as more companies are seeing computer security as a business risk and integrating it into their priorities for products and services deployed.

As cyber risks are increasingly being recognized as a major issue for professional software engineers to identify and correct, this level of importance needs to be included in the college curriculum. Our future software engineers should be required to understand cyber-risk issues and how to correct them if we are going to make progress on software security. This way of thinking will help improve software security proactively rather than releasing a product and waiting until security researchers discover inherent vulnerabilities.

Klaus: Yes. Companies have only recently begun to purchase security products. However, as businesses increase their security spending, solutions will arise to meet demand. With the U.S. government becoming involved in cyber security, the information security industry will continue to innovate and introduce new ways to reduce cyber-risk while strengthening defense and protection mechanisms.

Klaus: There are many major differences between Internet Security Systems and other companies selling security technologies. Security is all we do. Our entire organization is focused on being the best security company in the world that provides not just the best security technology, but managed protection services and consulting services as well. ISS is a trusted security advisor to global enterprises and world governments, providing products and services that protect against Internet threats. We partner with companies to perform security assessments, build a security road map and business justification, then deploy the security solutions. The customer then has the choice whether to have ISS manage the technology or to manage security internally, in which case ISS will educate the customer on proper procedures and maintenance.

Klaus: ISS' security research team, the X-Force, is the world's leading security experts on vulnerabilities and threats. ISS spends about 18 percent of revenue on research and development to provide dynamic security. A typical security company spends approximately 10 to 11 percent to focus on threats (that is, exploits, viruses and worms) without understanding security vulnerabilities. Because of our regular research into vulnerabilities, we are able to provide our customers protection using a concept called "Virtual Patch" that enables the protected system to guard immediately against attack or misuse once a vulnerability has been discovered, often long before a patch or hotfix is available or can be applied. With Virtual Patch, companies can be protected against a threat before it even becomes public, while most other security companies wait until the exploit or worm has already caused damage in the wild. With new viruses and worms propagating around the globe in 15 minutes, the older model of security companies reacting to every new threat is severely flawed.

Klaus: ISS is the first company to produce an all-in-one protection appliance with a unified protection agent that analyzes all traffic simultaneously to apply firewall, antivirus, and intrusion prevention rules in a unified analysis process. Other security companies that have introduced -- or plan to introduce -- an all-in-one box have combined various stand-alone hardware blades or stand-alone security applications with multiple engines onto one system that all must be configured, managed and updated separately. ISS' Proventia M Series appliances converge firewall, VPN, antivirus, IDS/IPS capabilities into one unified agent that needs to be configured, managed and updated only one time as one agent. In the future, Proventia will add application protection, content filtering and antispam functionality to the unified engine to extend protection across servers, desktops and laptops.

Klaus: ISS also differentiates itself as a security vendor by providing managed protection services for companies that want to outsource and extend their security team to provide 24-7 security monitoring and management at a much lower cost than managing security internally. In providing managed protection services, ISS allows customers the option of having ISS immediately respond to and block threats before they damage a customer's system without alerting the customer and awaiting their response or approval to take action. The basis of this relationship is built on service-level agreements in which ISS promises to perform to a certain level agreed upon by the customer -- or they receive a credit to their contract.

Klaus: Both Linux and Microsoft have had many serious security vulnerabilities. Because of Microsoft's market share, and the vast difference in the number of computers on the Internet running Microsoft operating systems compared to Linux, Microsoft remains a much larger target for hackers and virus or worm writers. There are Linux worms existing on the Internet, but the number of Linux machines that can be infected is minuscule compared to the serious ramifications when a Microsoft virus or worm is released. Therefore, the Linux exploits tend not to receive as much attention or awareness compared to a Microsoft threat. As we see more governments and companies standardizing on Linux within their own desktop and server  infrastructure, Linux will become a bigger target in the future.

Klaus: As a member of the Technical Standards and Common Criteria task force, I have high hopes that we can raise the bar for security standards that will improve the overall protection of the government. Increasing the amount of security protection in commonly available products will help to improve the security of the general business and consumer public as well.