[ISN] Apple security is 'struggling,' researcher says

http://www.theregister.co.uk/2009/06/09/apple_security_suggestions/

By Dan Goodin in San Francisco 
The Register
9th June 2009 00:52 GMT

A well-known security consultant says Apple is struggling to effectively 
protect its users against malware and other online threats and suggests 
executives improve by adopting a secure development lifecycle to design 
its growing roster of products.

"Based on a variety of sources, we know that Apple does not have a 
formal security program, and as such fails to catch vulnerabilities that 
would otherwise be prevented before product releases," writes Rich 
Mogull, founder of security firm Securosis and a self-described owner of 
seven Macs. "To address this lack, Apple should integrate secure 
software development into all internal development efforts."

Microsoft was among the first companies to integrate an SDL into its 
internal development routine. Under the program, products are built from 
the ground up with security in mind, so that poorly written sections of 
older code are replaced with code that can better withstand attack. It 
also subjects programs to a variety of simulated attacks. Adobe Systems 
recently beefed up the SDL program for Reader and Acrobat following 
criticism about the security of those two programs.

Mogull's suggestion was one of five he made recently to ensure company 
is doing everything it should to safeguard its customers.

[...]


_____________________________________________
Visit the InfoSec News security bookstore!
http://www.shopinfosecnews.org