bugtraq - Re: How secure is software X?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060512210414.GA598@dymaxion.org>
Date: Fri, 12 May 2006 14:04:14 -0700
From: "Paul B. Saitta" <pbs-sf@...axion.org>
To: David Litchfield <davidl@...software.com>
Cc: full-disclosure@...ts.grok.org.uk, ntbugtraq@...tserv.ntbugtraq.com,
	bugtraq@...urityfocus.com, dbsec@...elists.org
Subject: Re: How secure is software X?

On Fri, May 12, 2006 at 02:59:17AM +0100, David Litchfield wrote:
> How secure is software X?
> 
> At least as secure as Vulnerability Assessment Assurance Level P; or Q or 
> R. Well, that's what I think we should be able to say. What we need is an 
> open standard, that has been agreed upon by recognized experts, against 
> which the absence of software security vulnerability can be measured - 
> something which improves upon the failings of the Common Criteria.

The Trike threat modeling methodology has as it's goal being able to produce
exactly this kind of formal model of software risk -- models which have a high
degree of real world relevancy, can be reliably generated by multiple teams,
and compared across both different applications and different versions of an
application.

We're strongest right now on architectural level issues; the further into
the details of the implementation, the more complex the model becomes,
obviously.  That said, formal threat models provide a solid analysis
foundation to build on, and can work nicely with either automated test suites
or more ad-hoc methods, including heuristics like previous bugs filed, number
of code audits, etc.

You can find a bit more at www.octotrike.org, but we've taken some pretty big
steps from the work that's documented there.

/P.

-- 
Ideas are my favorite toys.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/