Dennis Fisher

Perhaps no segment of the security industry has evolved more in the last decade than the discipline of software security. At the start of the 2000s, software security was a small, arcane field that often was confused with security software. But several things happened in the early part of the decade that set in motion a major shift in the way people built software: the publication of Bill Gates’s Trustworthy Computing memo, the release of Building Secure Software and Writing Secure Code, and a wave of high-profile attacks such as Code Red and Nimda that forced Microsoft, and ultimately, other large software companies, to get religion about software security. To get some persepctive on how far things have come, Threatpost spoke with Gary McGraw of Cigital about the evolution of software security since 2001.

Within days of the attacks on Sept. 11, 2001, politicians, social scientists and anyone else who could find a microphone was repeating a line that would soon become a mantra: Americans will have to make some sacrifices in the name of greater security and safety. Viewed now through the prism of privacy, that looks like the understatement of the century. Americans have surrendered virtually all of their privacy and have gotten nothing but wave after wave of new attacks and threats in return.

GlobalSign has found evidence that its main Web server was compromised recently, but has not discovered any indications that its certificate authority infrastructure was hacked, contrary to claims by the attacker responsible for the DigiNotar CA hack.

Apple has finally released a fix for the certificate trust issue caused by the attack on DigiNotar, more than a week after the fraudulent certificates were identified and other browser vendors moved to revoke trust in them. However, the company did not update the mobile version of Safari to remove the certificates in iOS.

Mozilla has released a comprehensive guide to the use and implementation of the Do Not Track technology that’s included in its Firefox browser, in an effort to give developers and advertisers a better handle on how the technology works and how users are taking advantage of it.

Botnets have been a problem for more than a decade now, but in recent years they’ve become a serious security threat, delivering exploit kits, malware and mass Web site injections. In this video, Jose Nazario of Arbor Networks discusses the current botnet landscape and the adoption of new modular functionality in some bot families.

Already having revoked trust in the root certificates issued by DigiNotar, Mozilla is taking steps to avoid having to repeat that process with any other certificate authority trusted by Firefox, asking all of the CAs involved in the root program to conduct audits of their PKIs and verify that two-factor authentication and other safeguards are in place to protect against the issuance of rogue certificates.