POLL - What is your experience with security in the Software Development LifeCycle?

Errata Security is conducting a survey on the real world usage of software development methodologies such as Microsoft SDL, OWASP's SAMM, and BSIMM. We are interested in learning which organizations are successfully implementing these methods, and also the reasons companies are abstaining from using these methods. The survey went live over the weekend, and already we are collecting some very interesting experiences. The most noteworthy observation is how varied the responses have been. There appears to be no one correct solution for any two organizations. We will have this survey up through the RSA Conference and the following week, and see if any patterns emerge.

To participate in this short survey, go to http://bit.ly/ErrataSurvey. If you would like a copy of the results of this survey, there is a request button at the end of the survey where you can enter your email address.

In order to encourage participation in this survey, and to explain the reasons behind it, I will be giving a lightning talk at Security B-Sides in San Francisco on March 3 at 12:00 PST.

Please share the survey link with software developers, security experts, product managers, or anyone involved in product development. Thanks!

Nehalem vs. IDS

Intel's latest desktop processor is code-named "Nehalem". It adds a lot of good features for intrusion-detection software. I thought I'd summarize those features here. The biggest features are more processing cores, better synchronization, and specific instructions to accelerate intrusion-detection.

The reason I think this is important is because while more expensive systems ("hardware IDS") may be faster or have more features, it's the software IDS on cheap desktop processors that defines the mainstream intrusion-detection industry. Indeed, unless the more expensive hardware vendors continue to innovate, the cheap software systems will overtake them. What's impressive about Intel's latest chip is that it contains more theoretical processing power than hardware-based IDS of just a few years ago -- as long as the software can be written to take advantage of it.

Kindle DX vs. the iPad

I just got the large screen version of the Kindle ("Kindle DX"), and spent the last day reading on it. It makes daily reading, especially magazines, more comfortable. However, it's larger/heavier, so I'll still take my smaller Kindle on trips

The new device came labeled "Robert's 6th Kindle". My first two Kindle's were versions 1 and 2 of the device, the other three are the software readers on my iPhone, notebook, and desktop. Presumably, once I get the iPad in two months, that will be my 7th Kindle tracked by Amazon.

The fact that I have some many Kindles reinforces the fact that it's a "cloud book library" and not a device. I have 168 items in my library. Many have described the Apple iPad as a competitor to the Kindle, but the opposite is true: Amazon is in the business of selling books, it'll happily sell you a book for your iPad, and store it in your cloud library.

I bring up the iPad because it's roughly the same size as the Kindle DX. It has roughly the same physical dimensions, although the iPad is about 40% heavier. The Kindle's screen is 1200x800, while the iPad is 1024x768.

The devices have different trade-offs. The Kindles use "e-ink" technology that requires no power to maintain its state. Thus, the device wakes up to redraw the page, then goes back to sleep while you read it. This means it has fantastic battery life, going for a week between charges even under heavy use. The iPad, though, will only go 10 hours between charges. Because of the battery life, I'd rather travel with my Kindle than an iPad.

The e-ink has problems. It doesn't support color, and is a dark-grey on light-grey text. This makes it hard to read in low-light conditions, although it's easy to read in bright sunlight. The iPad is a normal LCD display, which is easy to read in low-light, but harder to read in bright light. However, whereas many laptops are nearly impossible to read in direct sunlight, the iPad should still be legible. That's because it uses the same IPS LCD technology found on the iPhone and MacBooks.

Another trade-off is screen refresh. It takes about a half-second for the Kindle device to update the screen. This makes navigating the device painfully slow. It's a minor tradeoff when reading books from start to finish, but is painful when navigating a college textbooks. And, of course, the Kindle lacks touch screen, which makes navigation even worse. Amazon created the Kindle DX for colleges, but in my experience, it sucks. The iPad will be much better.

Another problem is PDFs. I plugged the Kindle into my computers, where it appeared as an external drive. I dragged-n-dropped some PDFs over to the Kindle to read them. Some worked fine, but others didn't. The problem is that the DX forces a PDF to be scaled at 100%, one page per screen. You can't zoom in or out. In some cases, the font was too small to be legible, and there's just no fixing that. The iPad handles PDFs much better.

Humorously, the first thing I read on the Kindle DX was the latest The Economist magazine that has picture on it's cover showing Jobs' new iPad. Reading magazines on the larger Kindle is much easier, due to the difficulty of reading images.

SUMMARY

The DX is my new primary device for reading books and magazines. I read roughly 2 magazines a week and one book every two weeks, so that's quite a bit of time I'll be spending with the device. However, in two months, that might change again when I get the iPad, and read Kindle books from that device instead.

FUTURE NOTE

By the way, I think the iPad will be about as successful as the Mac Mini: not a failure, but not a runaway success either. I believe the keyboard is just too important to give up, and that there will never be a replacement (not voice recognition, not touchscreens, not anything). On airplanes, I see a lot of laptop computers and Kindles, I doubt I'll be seeing tablet computers (the iPad or the coming crop of competitors) displacing the laptop.

More on Twitter.

Special events like the football playoffs, awards shows, and politics can been seen in the twitter post statistics Twiguard collects. We can normally see some sort of spike, with the Grammys being no exception. We recorded 3.2 million tweets in a single hour which is way above the average of around 1.4 million tweets. To the left is a chart from 3am on Feb 1 showing the last 24 hour of tweet data we collected.

Malware authors often take this as a chance to spread new malware advertised as a link to something about the event. Normally we flag about 8% of Twitter traffic as spam or malware. Last night during the highest hour of tweets that number skyrocketed to almost 22%.

Just thought the stat was interesting.

Twiguard update week 4 and final week.

Although this update was a little late the analysis ran at the correct time and produced its results. 1239 bad urls in the list with 876 of them being new. That is almost 70%. The chart to the left shows the progression from week one of total flagged URLs in red with the unique URLs that week in blue. After 4 weeks they almost intersect and at this rate I am guessing that they will intersect in the next few weeks. This goes along way to showing that URL blacklisting alone is not fast enough to stop a spread on malware on a social network like twitter.

There are alot of reasons that can explain the numbers with one being that although we captured the URL weeks ago it didn’t start hosting malware until recently. Keep in mind though that the purpose of this experiment is to judge how quickly traditional blacklists can respond to malware spread with Twitter. Although Safe Browse may have flagged a URL as bad this week that doesn’t mean it was serving malicious content when it was first captured by Twiguard. In this experiment the majority of bad urls captured (58.6%) are hosted in Brazil. On Sunday the 7th twiguard will capture another 24 hours worth of URLs and make them available to anybody who wishes to duplicate this experiment.