Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
GET RECOGNIZED
Let an ISACA® certification elevate your career.
Register today and save
You are here: Home / Data Security / Heartbleed Exploit Could Cost Millions
DDoS Protection Powered By Verisign
Heartbleed Could Cost Millions, Could Have Been Prevented
Heartbleed Could Cost Millions, Could Have Been Prevented
By Jennifer LeClaire / CRM Daily Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
APRIL
18
2014


Early estimates of Heartbleed’s cost to enterprises are running in the millions. Revoking all the SSL certificates the bug leaked will come at a hefty price, according to CloudFlare, a Web hosting service provider.

Indeed, CloudFlare insists the revocation process for SSL certificates is far from perfect and imposes a significant cost on the Internet’s infrastructure. After completing the process of revoking and reissuing all the SSL certificates it manages for its customers, the company measured a clear spike in bandwidth due to the exercise. CloudFire estimates overall costs could run into the millions, based on its own experience.

“Globalsign, who is CloudFlare's primary CA partner, saw their Certificate Revocation List (CRL) grow to approximately 4.7MB in size from approximately 22KB on Monday,” CloudFlare’s Matthew Prince wrote in a blog post. “The activity of browsers downloading the Globalsign CRL generated around 40Gbps of net new traffic across the Internet. If you assume that the global average price for bandwidth is around $10/Mbps, just supporting the traffic to deliver the CRL would have added $400,000 to Globalsign's monthly bandwidth bill.”

It Could Have Been Prevented

We turned to Richard Kenner, co-founder and vice president of AdaCore, a software solutions provider for Ada, which is a programing language designed for large, long-lived applications where security is critical, to get his take on lessons learned so far from this costly bug. He pulled back the lens and asked a significant question: Why are these things still happening?

First, let’s look at what he means by “still.” He reminded us of the incident just over a month ago where a bug in the same type of software affected Apple devices. He also pointed to a glitch two years ago that caused a Wall Street trading firm to lose $440 million in 30 minutes. And, he noted, almost every week we hear about some glitch that shuts down airlines, hotel reservation systems, or stock trading for a few hours. Cars are even being recalled in the wake of defective software.

“The programming language used in the software responsible for Heartbleed [is] 40 years old. The tools used to write it are much the same as would have been used 40 years ago,” said Kenner, who was a researcher in the Computer Science Department at New York University from 1975 through 1998. “The same language and tools were used in the recent Apple bug. Analysis of that bug showed that using any one of multiple practices that should be standard in the industry would have prevented that bug.”

We Can Do More

So, then, could IT best practices have caught Heartbleed sooner? Following best practices isn’t enough for software that provides security services, but Kenner said technology does exist that IT can use to prove programs meet certain properties, such as ensuring the program never reads from a place in memory where it didn’t write.

“The program that contained the Heartbleed bug did exactly that and an attempt to prove that it didn’t would have quickly found this bug -- as would the use of certain tools that also detect this type of error,” Kenner said.

“But we can do more. Programs providing security services should never transmit private keys, usernames, and passwords externally and that’s a property we should also be able to prove, as well as the conditions under which they grant access to secured services," he added.

Tell Us What You Think
Comment:

Name:

Frank:

Posted: 2014-05-07 @ 5:45am PT
@SecurityByDesign - do you think so? If you have a strong master password it should work fine. I use Sticky Password for couple years now and never had a problem.

SecurityByDesign:

Posted: 2014-04-19 @ 2:48pm PT
@Rob: Password managers are useless. They just concentrate all the eggs in one basket.

Rob:

Posted: 2014-04-19 @ 10:36am PT
Are password managers safe? Sticky Password, LastPass, 1Password?

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.
MORE IN DATA SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Who Is the Hacker Group Lizard Squad?
Are they dangerous or just obnoxious? That’s what many are wondering about the hacker group Lizard Squad, which tweeted out a bomb threat that grounded a flight with a Sony exec aboard.
 
Are Government Spies Tipping Off Tor?
Less than a month ago, tech news headlines heralded a Tor Project breach. Now, some are saying that government spies are sharing information with Tor to help it prevent future breaches.
 
Backoff Malware Hits 1,000+ Businesses, Likely More
More than 1,000 businesses across the U.S. might have been affected by Backoff, a new kind of point-of-sale (PoS) malware, according to the Department of Homeland Security.
 

Enterprise Hardware Spotlight
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Alert: HP Recalls 5 Million Notebook AC Power Cords
HP is recalling about 5.6 million notebook computer AC power cords in the U.S. and another 446,700 in Canada because of possible overheating, which can pose a fire and burn hazard.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 

Mobile Technology Spotlight
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Verizon Hops on the Voice-Over-LTE Bandwagon
Wireless provider Verizon is gearing up for a nationwide launch of its Voice-over-LTE service over the next several weeks, promising clearer and crisper phone calls and a Skype-like video service.
 
Smartphone 'Kill Switch' Law in California; Will Other States Follow?
California’s new law -- signed by Gov. Jerry Brown on Monday -- aimed at deterring cellphone theft could mean most mobile phones sold in the U.S. will soon include similar “kill-switch” tech.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.