March 06, 2009

Cognitive Dissonance in Security

Two continuous points of cognitive dissonance in security... as I read Brian Krebs' Security Fix post on firefox vs. IE:

  1. If finding vulnerabilities makes software more secure, why do we assert that software with the highest vulnerability count is less secure (than, e.g., a competitor)? (It is even more ironic that this has become more questionable an action as "favored" software has fared worse in this category).
  2. If disclosure date is the day that software becomes "at risk" why don't we try our hardest to prolong that date?

Conclusion: nobody really knows what the heck they are talking about when it comes to "secure software."

An alternative measure:
The Spire Vulnerability Rating
Why We Need the Spire Vulnerability Rating

Mar 6, 2009 7:23:03 PM | Vulnerability Management

The comments to this entry are closed.

NEXT POST
We are not Alone On one hand, misery loves company. On the other, it is not particularly comforting to know that there is little evidence supporting medical recommendations. An excerpt provided at Overcoming Bias (orginal is behind a paywall): Level of evidence provides the link between recommendations and evidence base. Although there is significant variation among individual guidelines in available evidence supporting recommendations, the median of level of evidence A recommendations [i.e., those supported by more than one randomized trial] is only 11% across current guidelines, whereas the most common grade assigned is level of evidence C, indicating little to no objective empirical evidence...
PREVIOUS POST
I have no idea who eats bacon sandwiches, but... ... this post on Understanding Uncertainty does a great job in highlighting various ways risk can be communicated to change the perception of whether that risk is high or low.

I'm a guy with some ideas and opinions.

The Typepad Team

Search

Recent Comments