http://www.eweek.com/article2/0%2C1895%2C2194578%2C00.asp
I got this in my email this morning, and was totally expecting the read to be yes. You should be legally obligated to fix vulnerabilities. But as I read this, I swear to god my impression of the people being interviewed was eh. Depends, is it worth the trouble.
[i]By itself, a given vulnerability doesn’t mean anything. It has to be evaluated in the context of a broader IT environment, and of the broader business, and only then can you make an informed decision as to whether or not it is a critical, code-red vulnerability. But without context, nobody can tell what the impact of vulnerability is. It could be that the Web application doesn’t touch the database, or it could be that even if a program is subject to a SQL injection, it might not create a risk for the database. [/i]
??????????????????? Who the hell is making decisions like this. Do they know what they are talking about? Do they know the total structure of the online application? Do they know that this injection for sure will not allow root access to the machine through some vulnerability of the os they know NOTHING about.
Sorry, I think that was a terrible statement. And my impression of the whole article was they had the same attitude. Which, I think is why we have so many problems right now.
Ok, not enough coffee. Just woke up. Running around trying to read that and also get ready for work. I’m done with my rant. They are probably right(god, I hope I never work for them). I’m probably wrong. Thats why I’m still the grunt and they are the overpaid suits that walk two feet above the ground because they are god like in their knowledge and wisdom.
Dan