Improving Web Application Installation as a Security Imperative
December 7th, 2005It looks there is a Mambo worm out now. I read Hackers Hitting Popular Apps a couple of weeks ago and it mentioned that hackers are targeting PHP apps among other things. Dog bites man for some. More interesting was this quote:
“The bottom line is that security has been set back nearly six years in the past 18 months,” Alan Paller, director of research for the SANS Institute, wrote in an E-mail. “Six years ago, attackers targeted operating systems and the operating system vendors didn’t do automated patching. In the intervening years, automated patching protected everyone from government to grandma. Now the attackers are targeting popular applications, and the vendors of those applications do not do automated patching.”
I’ve advocated better web application installation for a while, but as a usability issue. Increasingly, it is also a security issue. Just another example of why I think the PEAR installer is important. (and why I hope Zend PHP Framework is released on a PEAR channel.)
All Posts
December 8th, 2005 at 12:12 am
The eZ publish Network Edition ships with an automated update manager which allows for automated patching in case there’s a security flaw: http://ez.no/services/ez_publish_network