Facing criticism, Adobe rethinks PDF security
Promises more secure code, faster patching and regular updates for Reader
Computerworld - Blasted three months ago for being slow to fix a zero-day vulnerability in its popular PDF viewer, Adobe today promised it will root out bugs in older code, speed up the patching process and release regular security updates for Adobe Reader and Acrobat.
The flak Adobe caught in February, when it disclosed a critical vulnerability, admitted the bug was being used by hackers, but then took weeks to patch the problem, is what prompted Adobe to review its security practices, acknowledged Brad Arkin, Adobe's director for product security and privacy.
"At first, this was just another of our normal security incidents," said Arkin. "But it ended up expanding to [make] changes in our security practices with Reader and Acrobat."
The project, which kicked off in February, has three parts, said Arkin, starting with a look at the legacy code in Reader and Acrobat that he characterized as "at-risk areas."
Currently, Adobe develops new code under what it calls its Secure Product Lifecycle (SPLC), an approach similar to Microsoft's much-better-known Software Development Lifecycle (SDL), which involves several security-specific steps that programmers go through to make their software less liable to harbor bugs. From now on, said Arkin, Adobe will apply the SPLC methodology to some older sections of Reader and Acrobat, too.
"We're going to broadly look at the whole application, but focus on at-risk areas, where we'll do threat modeling, static code analysis and look for potential vulnerabilities," said Arkin, who refused to call that change a full-blown "code review," like the one Microsoft spent millions on to root out bugs in Windows XP.
"We're going to do a lot more pro-active work," he promised. "We want to shake loose vulnerabilities."
Adobe will also speed up its patching and communicate with users more frequently, Arkin said. The company was slapped by some in February for taking three weeks to fix the already-exploited bug, and then only for Reader and Acrobat 9; Adobe staggered the patch delivery for the other versions over several more weeks.
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!