Feeds

Mozilla develops browser security metrics

Seeks smarter vuln stats

Intelligent flash storage arrays

Mozilla is piloting a project designed to develop a better model for the security of Firefox, by tracking a whole series of metrics over time.

Instead of simply recording the number of patches issued in a year the scheme also aims to gauge the relative risk to users over time and the effectiveness of Mozilla's developers in trying to develop a more secure browser.

The approach will allow Mozilla to develop a baseline model for the security of its browser that measures factors such as how long users are exposed to bugs (the so-called window of vulnerability). This model will be refined over time, a post on Mozilla's security blog explains.

"We do not think any model can define an absolute level of security, so we decided to take the approach of tracking metrics over time so we can track relative improvements (or declines), and identify any problem spots. This information will support the development of Mozilla projects including future versions of Firefox," it explained.

Independent security consultant Rich Mogull has been working with Mozilla's developers on the project over recent months. A preliminary summary of the project's goals can be found here (spreadsheet file). Mozilla is encouraging community feedback in developing the approach. Ideas include correlating the severity of a vulnerability with how long it takes users to apply patches.

It hopes its scheme will eventually provide a framework that other software developers can apply while creating a more sophisticated slant of the software security debate. In part Mozilla is looking to dispel the notion that software that is frequently updated must be inherently less secure. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.