<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.5730.11" name=GENERATOR></HEAD>
<BODY
style="WORD-WRAP: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space">
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2>On page 107 of "Software Security" </FONT><A
href="http://www.swsec.com"><FONT face=Arial
size=2>www.swsec.com</FONT></A><FONT face=Arial color=#0000ff
size=2>, </FONT></SPAN><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2>I talk about this very issue in a bit more depth. I
have attached a pdf snapshot of that page from the book.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2>I think the idea of binary analysis is a great one for many
reasons (see Exploiting Software for a ton of examples), and I am glad that
Veracode has come out of stealth mode. However, this should be treated as
an arrow in our quiver, not as the ultimate weapon. I think the best part
of the business model these guys are pursuing is the idea of holding COTS
vendors accountable by outting them to their more dilligent
customers.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2>gem</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2>company <A
href="http://www.cigital.com">www.cigital.com</A></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2>podcast <A
href="http://www.cigital.com/silverbullet">www.cigital.com/silverbullet</A></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=536133320-22012007><FONT face=Arial
color=#0000ff size=2>book <A href="http://www.swsec.com">www.swsec.com</A>
</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> sc-l-bounces@securecoding.org
[mailto:sc-l-bounces@securecoding.org] <B>On Behalf Of </B>Kenneth Van
Wyk<BR><B>Sent:</B> Monday, January 22, 2007 1:53 PM<BR><B>To:</B> Secure
Coding<BR><B>Subject:</B> [SC-L] Dark Reading - Discovery and management -
Security StartupsMake Debut - Security News Analysis<BR></FONT><BR></DIV>
<DIV></DIV><BASE href=data:>
<DIV
style="FONT-SIZE: 12px; COLOR: black; FONT-FAMILY: Helvetica; TEXT-ALIGN: left">Ok,
last software security news item for today, I promise. :-) This
article (see </DIV><A
href="http://www.darkreading.com/document.asp?doc_id=115110&WT.svl=news1_1">http://www.darkreading.com/document.asp?doc_id=115110&WT.svl=news1_1</A>)
is about a couple of new startup companies. One of them in particular,
Veracode, may be of some interest here. The article says, "<FONT
class=Apple-style-span face=Arial>Veracode, founded by Chris Wysopal and other
former executives of @stake, is now offering patented binary-code analysis of
software for enterprises that want to analyze their software's security on a
regular basis. The ASP will also offer security reviews of enterprise products
and security analysis of third-party apps for software developers."</FONT>
<DIV><BR class=khtml-block-placeholder></DIV>
<DIV>
<DIV>The article also provides some counterpoints, including some from Gary
McGraw, that are worth reading. Among other things, Gary says, "<FONT
class=Apple-style-span face=Arial>However, if you want real security analysis
you have to go past the binary, past the source code, and actually consider the
design."</FONT></DIV>
<DIV><FONT class=Apple-style-span face=Arial><BR
class=khtml-block-placeholder></FONT></DIV>
<DIV><FONT class=Apple-style-span face=Arial>Opinions on binary vs. source code
(and design!) analysis, anyone?</FONT></DIV>
<DIV><FONT class=Apple-style-span face=Arial><BR
class=khtml-block-placeholder></FONT></DIV>
<DIV><FONT class=Apple-style-span face=Arial>Cheers,</FONT></DIV>
<DIV><FONT class=Apple-style-span face=Arial><BR
class=khtml-block-placeholder></FONT></DIV>
<DIV><FONT class=Apple-style-span face=Arial>Ken</FONT></DIV>
<DIV>
<DIV>
<DIV><SPAN class=Apple-style-span
style="WORD-SPACING: 0px; FONT: 12px Helvetica; TEXT-TRANSFORM: none; COLOR: rgb(0,0,0); TEXT-INDENT: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; border-spacing: 0px 0px; -khtml-text-decorations-in-effect: none; -apple-text-size-adjust: auto; orphans: 2; widows: 2"><SPAN
class=Apple-style-span
style="WORD-SPACING: 0px; FONT: 12px Helvetica; TEXT-TRANSFORM: none; COLOR: rgb(0,0,0); TEXT-INDENT: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; border-spacing: 0px 0px; -khtml-text-decorations-in-effect: none; -apple-text-size-adjust: auto; orphans: 2; widows: 2"><SPAN
class=Apple-style-span
style="WORD-SPACING: 0px; FONT: 12px Helvetica; TEXT-TRANSFORM: none; COLOR: rgb(0,0,0); TEXT-INDENT: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; border-spacing: 0px 0px; -khtml-text-decorations-in-effect: none; -apple-text-size-adjust: auto; orphans: 2; widows: 2"><SPAN
class=Apple-style-span
style="WORD-SPACING: 0px; FONT: 12px Helvetica; TEXT-TRANSFORM: none; COLOR: rgb(0,0,0); TEXT-INDENT: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; border-spacing: 0px 0px; -khtml-text-decorations-in-effect: none; -apple-text-size-adjust: auto; orphans: 2; widows: 2">
<DIV>-----</DIV>
<DIV>Kenneth R. van Wyk</DIV>
<DIV>SC-L Moderator</DIV>
<DIV>KRvW Associates, LLC</DIV>
<DIV><A href="http://www.KRvW.com">http://www.KRvW.com</A></DIV>
<DIV><BR class=khtml-block-placeholder></DIV>
<DIV><BR class=khtml-block-placeholder></DIV><BR
class=Apple-interchange-newline></SPAN></SPAN></SPAN></SPAN></DIV><BR></DIV></DIV></DIV><p></p><p><hr noshade>This electronic message transmission contains information that may be confidential or privileged. The information contained herein is intended solely for the recipient and use by any other party is not authorized. If you are not the intended recipient (or otherwise authorized to receive this message by the intended recipient), any disclosure, copying, distribution or use of the contents of the information is prohibited. If you have received this electronic message transmission in error, please contact the sender by reply email and delete all copies of this message. Cigital, Inc. accepts no responsibility for any loss or damage resulting directly or indirectly from the use of this email or its contents.<br>Thank You.<hr noshade></p></BODY></HTML>