Feeds

Trust me, I'm a developer

Code signing product suite

Internet Security Threat Report 2014

Web services may be a clever way of conducting business with or delivering services to customers, but it also constitutes a helluva risk – after all, users get involved in downloading code from hither and yon, and are probably far too busy with their own work to ponder too deeply on whether that downloaded code is as wholesome as they assume it to be.

The same goes for mobile phone users. It is now only grumpy old curmudgeons who treat them as…… well……. telephones. For a growing army of users they are the delivery point for a whole range of new services that involve them in downloading code.

So here are two scenarios in which users are left wide open to code of any degree of malice. What can help here is a way of identifying the authorship of code and verifying its integrity as being the same as when it left the software vendor. That is the market GeoTrust is pitching at with a new Code Signing Product Suite. According to the company’s European marketing director, Steve Waite, the objective is to provide end users with security on the authorship and traceability of code by providing software vendors with a means of digitally signing their work prior to its use on public and private networks.

Software authors can sign up for the service by applying to GeoTrust, which checks that they are a genuine business. It then issues them with code-signing credentials which are embedded into Windows, Windows Mobile or Java software. This allows developers to then add a digital signature to the code. If the code is corrupted or tampered with in any way the signature fails and a warning pop-up appears automatically. Alternatively, the code can be stopped from running at all.

For mobile software it offers signing options for both privileged and unprivileged code for Windows Mobile. The latter are applications that do not affect the core operating system, such ringtones. The former category does affect the core. Here, developers need to register both with Microsoft and GeoTrust to sign up for the scheme. The cost is $159 per certificate per year for computer code, with developers then allowed as many signing as they like. For the mobile market, the cost is $295 for 10 signings, with a signing equalling a product release or a product upgrade. ®

Security for virtualized datacentres

More from The Register

next story
Microsoft WINDOWS 10: Seven ATE Nine. Or Eight did really
Windows NEIN skipped, tech preview due out on Wednesday
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.