In other news:
– After many delays, the Senate voted (83-14) to begin debate on amendments to the Cybersecurity Information Sharing Act (CISA) this week, with a vote on the bill scheduled for next Tuesday afternoon. CISA has broad bipartisan support and is expected to pass next week. However, hurdles remain as there is wide opposition from grassroots organizations as well as software and other technology companies. The bill would also have to be reconciled with a version that was approved by the House earlier this year.
– This week Cigital Inc. released data from latest release of the sixth version of the Building Security In Maturity Model (BSIMM6) showing that the health care industry is lagging on software security. The healthcare industry data, added to the model in the wake of the Anthem and UCLA Health data breaches, “confirm underlying issues in healthcare software security practices,” according to Cigital. Dr. Gary McGraw, CTO of Cigital, stated that “the addition of healthcare in BSIMM6 enriches the model and shows growing awareness of all verticals toward measuring their software security initiative. The healthcare data show that the industry has plenty to learn from other industries when it comes to software security. Fortunately, the BSIMM community is set up to facilitate and accelerate that learning.”
– In the wake of publication earlier this month of a paper showing that a practical defeat of SHA-1 is within the financial reach of criminal enterprises, and that signature forgeries could be seen in the wild soon unless SHA-1 is deprecated, Mozilla is considering accelerating its schedule for rejecting SHA-1 SSL certificates as “untrusted connections”, moving the deadline for servers to update their certificates from January 1, 2017, to July 1, 2016. The paper, Freestart collision for full SHA-1, showed that the cost of defeating SHA-1 has dropped in part due to the efficiency of using graphics cards, and they “project that a real SHA-1 collision will take between 49 and 78 days on a 512 GPU cluster. Renting the equivalent GPU time on EC2 will cost between 75K US$ and 120K US$ and will plausibly take at most a few months.” According to Netcraft’s October survey, millions of businesses are still using SHA-1. SHA-1, which was declared “dead” in 2005 by Bruce Schneier, but it is still being used by millions of businesses, and CAs are even still issuing SHA-1 certificates, according to Netcraft’s October survey report.