Security and Sensationalism

Where do you get your security updates? In the past few weeks, several nonissues have exploded in the media as security scares, only to be debunked quickly by technologists. I don't know what drives this drivel, but if you're like me, you already have enough going on in your life to keep your blood pressure high.

On Feb. 20, one popular e-zine reported that a "significant security flaw was discovered in Microsoft software." A malicious user could use a Windows 2000 CD to pull up a recovery console without a password. Separately, reports surfaced of a problem with the OpenSSL implementation, which would let a savvy attacker recover a password exchanged over a set of SSL-encrypted POP e-mail sessions. Another report followed about how BGP could be exploited to send bad routing tables from one router to another.

To read these reports you would think the Internet is on the verge of complete breakdown. In truth, taking advantage of these flaws would require physical contact with the PCs themselves or the wire running between routers. The attacks would be difficult to pull off, and the resulting damage would be minimal because they would be detected quickly.

The problem is that your bosses are reading these reports. As the hype spreads, you may turn around to find a suit breathing down your neck, and for little reason. Sure, it would be nice to fix every little flaw on the Internet, but you have to prioritize based on the real risks.

Here's a tip: Monitor security mailing lists like VulnWatch and BugTraq, and scan Slashdot. Those sources carried a wealth of useful information minutes after the above-mentioned stories went public. When that suit comes a-knockin', you'll have the answers at your fingertips.Post a comment or question on this story.