Name: News and Advice on the World's Latest Innovations | ZDNET
Brand: zdnet.com
SKU: zdnet-com-48
Availability: OnlineOnly

critic

News and Advice on the World's Latest Innovations | ZDNET

preview

/&gt;In the latest Red Hat Product Security Risk Report, Red Hat reveals how it addresses security concerns both for Linux and open-source software.historically has had the best record of all the Linux companies in finding and fixing Linux and open-source security bugs. Here's how the Raleigh, NC-based company does it. First, is in charge of both finding and fixing security holes. It doesn't do this alone. The team works with other Linux and open-source companies and developers. Security in the Linux world isn't done in secret, but with the full cooperation of all involved programmers.&nbsp; The security team is also a member of the . It uses the industry-standard for each vulnerability -- which is useful to describe how an attack works. All Red Hat product-related&nbsp;&nbsp;a CVSSv3.x score. But Red Hat doesn't use CVSS to prioritize vulnerabilities. Instead, it uses a four-point scale to describe the severity of a particular bug.&nbsp; This scale is meant to help users determine the risk each bug poses to them. Red Hat's four-point scale rates vulnerabilities are: Low, Moderate, Important, or Critical. Critical vulnerabilities pose the most severe risk to an organization. A Critical vulnerability could be exploited remotely over a network or the internet and could be automated (by a worm, for example). Red Hat also includes flaws that affect web browsers or browser plug-ins that users might be susceptible to if they visit malicious or compromised websites. Other open-source companies use similar scales. Christopher Robinson, the Red Hat Product Security Assurance Team Lead, explained:&nbsp;" (CVSS!=Risk). Anyone who thinks otherwise is mistaken and setting themselves up for more work, pain, and stress than they realistically should have to go through. A risk is a potential for loss or damage if a threat exploits a vulnerability (which is a weakness in hardware or software)." Robinson went on:&nbsp;"CVSS is a great, yet imperfect tool. It does not account for all possible things … Even when CVSSv4 is released, it will still leave room for interpretation between an overall security risk and the specific risk for a specific implementation of software in a specific environment."&nbsp;What Red Hat's scale added to this is: A for the incident. This is more precise guidance from that organization about how they feel the vulnerability affects their particular implementation of that hardware or software. This gives us additional flexibility to escalate the visibility of a given issue as the need arises. It also allows us to provide additional context about features/protections/processes we use that might help alter the severity of the problem.&nbsp; Robinson also wrote in a recent blog:"We provide that we felt could have the most impact from a real-world risk perspective, as well provide a filter to the fear, uncertainty and doubt that is sometimes shown around high profile vulnerabilities, which in turn introduces additional challenges to your operations." In the just-released , Red Hat said it's seeing more customers than ever trying to grapple with ever-mounting security issues by using third-party scanners. But, he said, "While scanning tools can provide a useful 'single pane of glass' view of vulnerabilities across an enterprise-wide environment, they generally do a poor job of articulating risks specific to a technology or implementation." So, Red Hat Engineering and Red Hat Product Security both explain exactly what's what with security issues and making Red Hat's "upstream packages enterprise-ready by regression testing, hardening, and tweaking the package to meet our customers' unique business demands and our release standards."To help improve this process, Red Hat made a fairly sizable change to support life cycle. Because "RHEL is the foundation of all of our products and services, we felt it was important to expand the scope of what we supported."&nbsp;So, RHEL now includes patches and fixes for Important-rated issues, which typically cover the largest share of issues. Previously, Red Hat was more selective about which Important-rated issues were addressed in .&nbsp; Overall, in 2019, Red Hat reports: Robinson added:&nbsp; "Where the rubber meets the road, so to speak, are the RHSAs that are issued and ultimately applied to a system, be it physical, virtual, or container. We released 968 RHSAs, which is a three-fold increase from 2011. This speaks to the diversity and complexity of the portfolio of 2019. System administrators have their work cut out for them, no matter what types of systems they manage, which is part of the reason one might note the difference in number of CVEs fixed versus the number of issued security advisories. As time, content, and opportunity allows, we'll bundle multiple CVE updates into a single RHSA (but then issue separate RHSAs based off of product and version) to try and help ease that administrative burden of getting downtime windows for maintenance. Obviously, as an awesome enterprise vendor, we do have solutions that can help with that (cough, cough, , cough cough, , cough … just sayin')."Maintaining security across Red Hat's software ecosystem -- not to mention how it spans standalone servers, containers, and the cloud -- is a big job. Fortunately, not just for Red Hat's software, but for the entire Linux and open-source world, Red Hat is up to the job.

/&gt;In the latest Red Hat Product Security Risk Report, Red Hat reveals how it addresses security concerns both for Linux and open-source software.historically has had the best record of all the Linux companies in finding and fixing Linux and open-source security bugs. Here's how the Raleigh, NC-based company does it. First, is in charge of both finding and fixing security holes. It doesn't do this alone. The team works with other Linux and open-source companies and developers. Security in the Linux world isn't done in secret, but with the full cooperation of all involved...

public

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system; 300bps was a fast Internet connection; WordStar was the state of the art word processor; and we liked it.His work has been published in everything from highly technical publications (IEEE Computer, ACM NetWorker, Byte) to business publications (eWEEK, InformationWeek, ZDNet) to popular technology (Computer Shopper, PC Magazine, PC World) to the mainstream press (Washington Post, San Francisco Chronicle, BusinessWeek).

https://www.zdnet.com/meet-the-team/us/steven-j-vaughan-nichols/

Steven J. Vaughan-Nichols

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

News and Advice on the World's Latest Innovations | ZDNET

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS