David LeBlanc's Web Log : December 2007

Implementation vs. Design Defects: I got a comment to my last post that's worth following up on: Can you comment on what percentage of defects you all are finding are implementation vs. design defects? Its pretty clear that older code that doesn't have buffer overflows isn't going to all Read More...
Posted 18 December 07 01:36 by david_leblanc | 1 Comments
Securing Existing Code: Just read Michael Howard's post about differentiating secure features, security features and security response, found at http://blogs.msdn.com/sdl/archive/2007/12/17/security-is-not-all-about-security-updates.aspx , and wanted to offer some counterpoints. Read More...
Posted 17 December 07 12:28 by david_leblanc | 4 Comments
How to cause a regression: This one isn't really security related, except that we security people often want to get rid of old stuff because it's sometimes easier to disable it than to make it really robust. If only a few people use it, good attack surface reduction practices tell Read More...
Posted 13 December 07 11:11 by david_leblanc | 2 Comments

David LeBlanc's Web Log