Apple Struggling With Security & Malware

[ad]

It’s inevitable as Apple products become more and more popular they will get targeted by the bad guys. Count on more viruses, malware, exploits and rootkits for Apple Operating Systems.

They are a bit behind in the curve as they don’t have a formal security program and it’s unknown if they use secure development practices (they seem to focus more on interface design than anything else).

Something has to be done though or the next big botnet could be running on Apple machines.

A well-known security consultant says Apple is struggling to effectively protect its users against malware and other online threats and suggests executives improve by adopting a secure development lifecycle to design its growing roster of products.

“Based on a variety of sources, we know that Apple does not have a formal security program, and as such fails to catch vulnerabilities that would otherwise be prevented before product releases,” writes Rich Mogull, founder of security firm Securosis and a self-described owner of seven Macs. “To address this lack, Apple should integrate secure software development into all internal development efforts.”

Microsoft was among the first companies to integrate an SDL into its internal development routine. Under the program, products are built from the ground up with security in mind, so that poorly written sections of older code are replaced with code that can better withstand attack. It also subjects programs to a variety of simulated attacks. Adobe Systems recently beefed up the SDL program for Reader and Acrobat following criticism about the security of those two programs.

With their fairly rapid development and pumping out of new product lines (Apple TV, Mac Mini etc) they are going to face security problems at some point.

That’s without considering the Internet connected mobile devices (iPhone, iPod touch).

Adobe has taken notice too with it’s recent spate of exploits and improved its Secure Development Lifecycle to ensure future problems are minimized.

Mogull’s suggestion was one of five he made recently to ensure company is doing everything it should to safeguard its customers.

“It’s clear that that Apple considers security important, but that the company also struggles to execute effectively when faced with security challenges,” he writes in a recent article on Mac news website Tidbits. He goes on to fault the company for its ongoing failure to patch a gaping security hole in Mac versions of Java.

The suggestions came as Apple on Monday announced Safari 4.0, a release that fixes more than 50 vulnerabilities in the browser. Protection against clickjacking attacks, denial-of-service flaws and bugs that allow for remote code execution were among the fare.

Another suggestion from Mogull is that Apple appoint and empower a high-ranking executive to oversee security in all Apple products. The CSO, or chief security officer, would serve as the public face for Apple security as well as the internal boss who coordinates the company’s response to security incidents and development of new products that are safe.

I believe Apple is indeed need of a solid CSO, one that can implement more proactive measures against security flaws such as secure development, a dedicated response and research team for vulnerabilities and spearhead a generally more responsible organisation when it comes to security concerns.

Obviously to fit into Apple it has to be someone charismatic that can ‘sell’ the benefits of Apples ‘iSecurity’ system or whatever they are gonna call it.

I’m sure they’ll find some way to spin whatever security measures they take into a marketing exercise.

Source: The Register