Google Corrects IBM's Security Math - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Software // Operating Systems
News
8/31/2010
01:20 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Corrects IBM's Security Math

IBM has fixed a security report it issued last week that misstated Google's security vulnerabilities.

Google has a considerable number of very smart people in its employ and it isn't shy about deploying its bright lights to reveal flawed criticism.

Back in 2006, when worries about click fraud seemed as if they might cause a loss in confidence in Google's search ads, the company argued convincingly that claims of rampant click fraud were based on bad statistics.

On Monday, Google struck again, challenging the accuracy of an IBM X-Force security report issued last week and the security industry's lack of transparency in how it compiles its vulnerability reports.

Conceding that there's some value in bug reports and catalogs of vulnerabilities compiled by security companies and organizations, Adam Mein of Google's security team nonetheless asserts in a blog post that much of the data in these reports is to some extent inaccurate or outdated.

Mein singles out IBM X-Force's 2010 Mid-Year Trend and Risk Report as an example for claiming that 33% of critical and high-risk bugs found in Google services during the first half of 2010 were left unpatched.

"We questioned a number of surprising findings concerning Google’s vulnerability rate and response record, and after discussions with IBM, we discovered a number of errors that had important implications for the report’s conclusions," he wrote. "IBM worked together with us and promptly issued a correction to address the inaccuracies."

It turns out that the 33% figure was based on the belief that one of the supposedly three vulnerabilities affecting Google during the first half of 2010 remained unpatched. In fact, as Mein explains, that one item was mistakenly assumed to be a security flaw due to some confusion about the terminology used to describe it.

The issue was thought to be a stack buffer overflow (a real security risk) when it was actually a stack overflow or stack exhaustion (not in most cases a security risk). So Google actually faced two security vulnerabilities during the first half of 2010 and patched them both.

IBM's correction shows that Google did better than any of the other vendors listed in terms of promptly addressing critical security flaws.

Which company did the worst? IBM.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Commentary
Enterprise Guide to Edge Computing
Cathleen Gagne, Managing Editor, InformationWeek,  10/15/2019
News
Rethinking IT: Tech Investments that Drive Business Growth
Jessica Davis, Senior Editor, Enterprise Apps,  10/3/2019
Slideshows
IT Careers: 12 Job Skills in Demand for 2020
Cynthia Harvey, Freelance Journalist, InformationWeek,  10/1/2019
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Getting Started With Emerging Technologies
Looking to help your enterprise IT team ease the stress of putting new/emerging technologies such as AI, machine learning and IoT to work for their organizations? There are a few ways to get off on the right foot. In this report we share some expert advice on how to approach some of these seemingly daunting tech challenges.
Slideshows
Flash Poll