{"id":728,"date":"2013-08-10T15:18:37","date_gmt":"2013-08-10T15:18:37","guid":{"rendered":"http:\/\/triangleappshow.com\/?p=728"},"modified":"2022-12-15T06:46:44","modified_gmt":"2022-12-15T11:46:44","slug":"apple-finishes-update-to-developer-portal","status":"publish","type":"post","link":"https:\/\/michaelrowe01.com\/index.php\/blog\/apple-finishes-update-to-developer-portal\/","title":{"rendered":"Apple finishes update to Developer Portal"},"content":{"rendered":"

Last night, as I was checking my email before going to bed, I got a note from Apple that their replace\/rebuild of the Developer portal had been completed and all services are working again.\u00a0 Great news, and hopefully Apple has addressed, not only the security flaws identified by the Turkish researcher<\/a>, but any fundamental design flaws which could expose other security issues going forward.<\/p>\n

The biggest lessons I’ve learned from watching this all unfold is – security is hard.\u00a0 Steve Gibson<\/a> (from Spinrite fame) has been recording a long running podcast on security called “Security Now<\/a>“.\u00a0 He spends 2 hours, each week, going thru all the latest info on security patches, and describing the underlying design and technology of various protocols, etc. which shows how much you need to know to make truly secure applications.<\/p>\n

Years ago, when I was working as a consultant, I wrote a Human Resources system for a home health care management company.\u00a0 I was asked to make sure that we had an appropriate level of security and could segregate data between managed companies via passwords.\u00a0 The design was simple.\u00a0 Within the application, you had to enter a unique company identifier and password for each company’s data.\u00a0 Simple and somewhat effective, given that the entire application and all of its data resided on a midrange computer that could only be accessed within the companies physical boundaries.\u00a0 Within 1 month of the application going live, every monitor within the HR department had a nicely printed sticker listing the company identifier and the password for each.\u00a0 So much for security.<\/p>\n

The reason I bring this up is to identify how technology is only as secure as its weakest link.\u00a0 Kevin Mitnick, shows us in his biography – Ghost in the Wires<\/a>, that the best hacks are really around social engineering and not technology.\u00a0 Even Mat Honan’s famous twitter \/ gmail \/ icloud hack,<\/a> was much more a social engineering issue than a technology flaw.<\/p>\n

If you are storing sensitive data (however you define sensitive), what are you doing to make your application secure, with out distracting from its functionality?<\/p>\n","protected":false},"excerpt":{"rendered":"

Last night, as I was checking my email before going to bed, I got a note from Apple that their replace\/rebuild of the Developer portal had been completed and all services are working again.\u00a0 Great news, and hopefully Apple has addressed, not only the security flaws identified by the Turkish researcher, but any fundamental design […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_wp_convertkit_post_meta":{"form":"-1","landing_page":"0","tag":"0","restrict_content":"0"},"hide_page_title":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[2],"tags":[26,217,241,356,357,370],"class_list":["post-728","post","type-post","status-publish","format-standard","hentry","category-blog","tag-apple","tag-ios","tag-kevin-mitnick","tag-security","tag-security-now","tag-steve-gibson"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t