[sf-lug] Prince Ciao & Master Sun
rick at linuxmafia.com
Sun Jul 22 22:42:57 PDT 2007
Quoting jim stockford (jim at well.com):
> i'd love to know how to evaluate software with
> respect to security features. is there a well-known
> suite of tests that detects crappy software?
Wetware is the best tool *I* know of.
This manual gives an excellent overview of what to test, but not how to
do it: http://www.isecom.org/osstmm/
There are lots of code checkers of various sorts. One is the thing
called "Purify", which is said to be pretty useful. There's also
Coverity's code-checkers. The Debian Security Team has a list of useful
open-source checkers here: http://www.debian.org/security/audit/tools
But, if you're really serious about this, read David Wheeler's HOWTO:
> one approach to security is to have sensitive data on a machine that's
> not connected to any network;
True. My friend Richard Couture had as a consulting client a medical
clinic that did a considerable amount of work with AIDS patients. They
wanted him to connect all their machines, including those with sensitive
patient data, to broadband Internet. He kept trying to explain why this
was a bad idea; they kept pushing back.
He finally found a way to make the point: "What would be the amount of
your loss, if large amounts of your patient data were to suddenly show
up on the open Internet?" They blanched: "Incalculable." "Ah, well,
OK, what probability of an incalculable loss do you consider to be a
In the end, the machines with sensitive data ended up being air-gapped
from the less-sensitive machines he connected up to network access.
 I.e., your brain.
More information about the sf-lug