A technical papers written by Marc Brown and publish at EETimes. It can be read/downloaded from here. It is another good technical papers although it was not really technical enough or the word used was not really technical jargon. It is very easy for non-technical person to read and understand the papers. The only limitation was references our proof on all facts/data used in the paper.
Sunday, July 24, 2011
Threat Modeling for Secure Embedded Software
Klocwork had publish a paper on the above title. You can read/access it here.
I won't comments on the paper as it was a good idea/framework they proposed in the paper. The important things I would like to stress here is that the framework or idea is nothing new. It was first established by Microsoft in their SDL. It was already implemented in software development by major software vendor. They might want to re-phrase some of the contents by referring to the giant in doing threat modelling. It does not matter either you are developing normal software or embedded software as it is still treated as a software's project.
I won't comments on the paper as it was a good idea/framework they proposed in the paper. The important things I would like to stress here is that the framework or idea is nothing new. It was first established by Microsoft in their SDL. It was already implemented in software development by major software vendor. They might want to re-phrase some of the contents by referring to the giant in doing threat modelling. It does not matter either you are developing normal software or embedded software as it is still treated as a software's project.
Conference for July 2011
Saturday, July 23, 2011
Uneven maturity obscures cloud platform choice
Platform-as-a-service will play key role in unlocking cloud benefits for many businesses, but varying maturity of technology and lack of interoperability make choosing right vendor tough, industry watchers say. () [more].
That's is from business perspective. In my perspective, cloud provider are lacking of security either in securing their infrastructure (IaaS), platform (PaaS), system (SaaS), etc. Although there are works done on it, but it is yet to reduce the risk of user and provide from attacks. We thought cloud is something new, but to me, it is just an old things re-branded by business people to attract customer. It still carries the old things issues. If your cloud is running on Linux, the security holes of the OS is still there. If you are using Windows, the problems we faced with windows nowadays is still valid in cloud environment. Further more, it is more dangerous in cloud than in normal networked environment because users are sharing across boundaries on the same structures, platform, system, etc. One attacks on single node can cause lots of damages.
That's is from business perspective. In my perspective, cloud provider are lacking of security either in securing their infrastructure (IaaS), platform (PaaS), system (SaaS), etc. Although there are works done on it, but it is yet to reduce the risk of user and provide from attacks. We thought cloud is something new, but to me, it is just an old things re-branded by business people to attract customer. It still carries the old things issues. If your cloud is running on Linux, the security holes of the OS is still there. If you are using Windows, the problems we faced with windows nowadays is still valid in cloud environment. Further more, it is more dangerous in cloud than in normal networked environment because users are sharing across boundaries on the same structures, platform, system, etc. One attacks on single node can cause lots of damages.
