http://www.techworld.com/security/news/index.cfm?NewsID=5128 By John E. Dunn Techworld 10 January 2006 Security management vendor Qualys has denied that its innovative Laws of Vulnerability research has been jeopardised by the sudden departure of its key instigator, Gerhard Eschelbeck. The company has confirmed that no individual had been appointed to directly replicate Eschelbeck's work on the research, an analysis of real-world vulnerabilities taken from scans of Qualys's substantial enterprise customer base. The findings for 2005 were announced last November at the Black Hat conference in Las Vegas. Former company CTO and VP of engineering, Eschelbeck, announced before Christmas that he was leaving the company he'd worked at for five years to take up an identical position at anti-spyware vendor, Webroot. He is considered an authority on the topic of vulnerabilities and patching strategies. Eschelbeck was also a key figure in the Qualys's involvement in the Common Vulnerability Scoring System (CVSS) - an evolving standard for assessing security risks - and in compiling the SANS Top 20, an annual measure of security vulnerabilities. Qualys CEO Philippe Courtot was adamant that personnel would be found from within the company to maintain involvement in the SANS Top 20 - and in CVSS - a standard the company was strongly committed to. However, he confirmed that the company had not yet appointed anyone to oversee the workload, despite appointing an interim CTO in Eschlbeck's place. Longer term, the company might look outside Qualys itself for a champion for the Laws analysis. "One person can't do it all and so you will see more spokespersons," Courtot said. Eschelbeck, meanwhile, has his hands full at Webroot, as it attempts to move from a consumer business model to one orientated towards businesses. _________________________________ InfoSec News v2.0 - Coming Soon! http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Tue Jan 10 2006 - 22:59:44 PST