[ISN] Foreign Software: Security Threat?

alerts@private

http://www.military-information-technology.com/article.cfm?DocID=2354

By Cheryl Gerber
Military Information Technology
Volume: 12  Issue: 2
Feb 28, 2008

Although the global outsourcing of software development and the 
expanding use of commercial software have dropped the price and often 
boosted the quality of software, the practices have also raised the rate 
of malicious code attacks. That has presented a potential national 
security risk that the Department of Defense and a number of companies 
are battling with multiple technologies.

Two reports last year corroborated the nature of the risk and made 
recommendations to mitigate it. In March 2007, the Center for Strategic 
and International Studies (CSIS) issued a report citing malicious code, 
cyber-attacks and espionage as top threats facing the DoD and defense 
industry today, resulting primarily from software developed overseas, 
and to a lesser extent, from the global use of commercial software. The 
report also contended, however, that new software security policies 
ought to focus more on how, rather than where, software is developed.

In September, the report of the Defense Science Board Task Force, 
entitled, Mission Impact of Foreign Influence on DoD Software, came to 
similar conclusions and proposed processes and strategies to reduce the 
risk.

Both reports recommended new policies for improving software assurance 
and network integrity. The CSIS report noted that the number of U.S. 
companies outsourcing software development overseas had grown 25 percent 
from 2003 to 2006.

The DSB report warned that the risk of software supply chain exploits 
will escalate as adversaries gain more access through global 
outsourcing. It distinguished between the risks in COTS and higher risks 
of mission-critical custom software, pointing out that while COTS 
development environments are more porous to attack than those of DoD 
custom development environments, subversion of the latter is more likely 
to achieve adversarial objectives.

Hundreds of millions of people look at commercial code, such as Windows, 
whereas critical custom code does not receive the daily scrutiny, does 
not have as many eyeballs on it, rendering it more vulnerable, pointed 
out Dr. Robert Lucky, chairman of the DSB task force that wrote the 
report.

Security software experts agree that when it comes to vetting software, 
the larger the talent pool, the better the result. You want to make 
algorithms public because they cant be trusted unless they are, and you 
get enormous benefit from the public attacking it, said Dan Geer, chief 
scientist and vice president of Verdasys, a security software firm.

Concurrently, opponents wielding malicious code have grown more 
sophisticated. This is no longer hobbyists doing it for fun and games. 
Its playing for keeps. The skill level is increasing. Now its a job paid 
for out of revenue, said Geer. Instead of trying to put a mole in the 
CIA, they try to put a mole in software.

As such, cyber-attacks are now more devious and focused. Theyre getting 
good enough at it that they now favor stealth over persistence. Many 
attacks are now targetednot blanketed, shot-in-the-dark viruses, said 
Geer.

[...]

___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn 