Incident response is a key part of the profile of any organisation. For

many customers, how problems are handled is an important part of their relationship with that business. For some organisations, how incidents are handled is a core part of their effectiveness.

For that reason, key organisations have invested time and money in their

incident response capability. This article looks at a dimension to that provi-sion that is often overlooked: the third dimension of ‘backstage’ provision and support. This oversight could well lead to higher staff turn over and lower efficiency. How can that be avoided? Wendy Goucher explains.

Continued on page 16...

Featured this month:Three-dimensional incident management

ISSN 1361-3723/10 © 2010 Elsevier Ltd. All rights reservedThis journal and the individual contributions contained in it are protected under copyright by Elsevier Ltd, and the following terms and conditions apply to their use:PhotocopyingSingle photocopies of single articles may be made for personal use as allowed by national copyright laws. Permission of the publisher and payment of a fee is required for all other photocopying, including multiple or systematic copying, copying for advertising or promotional purposes, resale, and all forms of document delivery. Special rates are available for educational institutions that wish to make photocopies for non-profit educational classroom use.

NEWSTop 25 software errors identified 1Trustwave: Businesses making same security mistakes 2US embarrassed in cyberattack simulation 2IE 8 reaches top browser slot 3

FEATURESThe (in)consistent naming of malcode 5For many years, anti-malware companies have each stuck to their own naming conventions when discovering new malware strains. That can be confusing for the people who write about new viruses, trojans, and worms - but does anyone else care? Tom Kelchner of Sunbelt Software gives an anti-virus company’s perspective.

A fractured reaction to the Christmas bomber 8Neil Fisher, vice president global security solutions at Unisys, talks about why full body scanners may be a red herring in the fight against terrorism.

A new strategy for the protection of intellectual property 8Meenu Gupta explores the meaning of intellectual property in a world rife with peer to peer filesharing and other technologies designed to make information flow like water through corporate boundaries.,

Software ownership: Where does it lie when it comes to M&A and outsourcing? 11With the rise of new software consumption models, how does the ownership of software change, and what are the legal ramifications for companies?

Fraud 2009 bad, 2010 better? 13Jim Gee, director of counter fraud services at McIntyre Hudson LLP, discusses the worst frauds of 2010, and makes predictions for the next year.

Three-dimensional incident management 16Incident response is an important part of busi-ness’s activity. An effective team needs to be well trained and managed, but it also needs good sup-port. Wendy Goucher explains the oft-overlooked third dimension of incident management.

UK police computer audit logging and control technology in the spotlight 18The need for protective monitoring and auditing of activity on police computers has never been greater, argues Tim Ellsmore, managing director of 3ami, a Lancashire-based IT security company that recently carried out an in-depth survey into UK police management’s attitudes to the technology

REGULARSEditorial 3News in brief 4Calendar 20

Contents

computerFRAUD & SECURITYISSN 1361-3723 February 2010 www.computerfraudandsecurity.com

The SANS Institute and Mitre have come together to update their

annual list of top 25 software pro-gramming security bugs. SQL injec-tion is the number one danger to software customers, according to the organisations.

SANS and Mitre have made several improvements over the 2009 program-ming errors list. Focus profiles have been created to explain how software weaknesses relate to real-world scenari-os. The new list also ranks items using a survey of 28 organisations who pri-oritised bugs based on their prevalence and importance.

After SQL injection, classic buffer overflow was public enemy number two in terms of application security. Cross-site scripting came a close third, followed by operating system command injection. The fifth-ranked programming security error was the unrestricted upload of a file with a dangerous type. Cross-site request forgery, while increasingly common in web application attacks, failed to

make the top five, resting instead in sixth place.

The bugs were ranked according to importance and prevalence. Each of these parameters were used to assign a sub-score to a bug. The importance sub-score was squared, and then added to the prevalence sub-score to achieve the final result, thus giving importance much more weight.

The study also produced a separate ranking focusing purely on the techni-cal impact of each weakness. “Note that skilled attackers can combine multiple weaknesses into a single, larger attack that is more severe than any of its parts,” the report said.

Several weaknesses that were identi-fied last year, including input validation, have been moved to a separate section called Monster Mitigations. “A number of general purpose CWE entries were removed from the top 25 because they overlap other items,” said Mitre. “This also made room for other, more specific weaknesses to be listed.”

Continued one page...5

Top 25 software errors identified