Computerworld has an interview with General Motors CISO (chief information security officer), Eric Litt....His goal: present to the hackers his look at the problems large corporations face when dealing with software vulnerabilities -- and the manner in which they are disclosed and remedied.

Excerpts from the same:

Why is this issue of vulnerability disclosure practices so important to you? If you are a CISO, you really are stuck in the middle between a bunch of different constituents that are out there. You have the researchers and the academic folks and then you have the software vendors -- and we have to deal with the cards that get dealt to us. Somebody releases off-the-shelf software and it has got vulnerabilities in it. If those vulnerabilities don't get plugged, I have to deal with the fact that I have vulnerable code in my environment. Then we have people out there who are trying to figure out how to hack into an environment or to exploit a vulnerability, and they may be doing it for different ethical or nonethical reasons. And I have to try and protect my environment.

Microsoft has drawn a lot of criticism for its security failures. How do the other major vendors compare? I think Microsoft is an easy target, so people pick on Microsoft all the time. You can complain about Microsoft all you want, but you also have to recognize they have made significant investments, and I think they have made significant progress. They are still not where we want them to be, but they are significantly better. Then you start looking at the other people and say, "What kind of a job are they doing?" There was one who released 82 or 83 patches very recently. Not stellar, right? I am glad they were released, but on the other hand, you are talking core business systems here. With those kind of changes in the software, did they all happen to be discovered at the same point in time or were they just held back? And how long was I vulnerable that I didn't know I was vulnerable? So Microsoft is not the only one with this problem. And quite frankly, I think some of the other vendors are in denial, and they are the ones that worry me the most.

Prashanth Rai