By George V. Hulme
InformationWeek
April 15, 2003

IT security pros are aware that hackers and data thieves are increasingly targeting software vulnerabilities that traditional intrusion-detection systems, firewalls, and antivirus software do little to defend against.

To thwart the growing threats, more companies have been turning to various security products to get the job done: patch-management applications to push software updates across the network; application and vulnerability scanners to find security holes; and application firewalls to block attacks waged against Web apps.

A small group of Internet security companies have an idea they hope will make it easier for administrators to lock down their apps. The group has proposed the Application Vulnerability Description Language to the standards group Oasis. AVDL, based on XML, will be designed to provide a standard way for application vulnerabilities to be defined and classified so all of the applications companies use to secure their apps will speak the same language when it comes to security threats.

The group, founded by Citadel Security Software, GuardedNet, NetContinuum, SPI Dynamics, and Teros, hopes to have version 1.0 of the spec completed by year's end. The first full meeting of the Oasis technical committee is slated for May 15.

If it works as promised, AVDL would help security pros better react to newfound software vulnerabilities and attacks, says Pete Lindstrom, research director for Spire Security. Eric Ogren, senior analyst at the Yankee Group, agrees. "This is a good idea to better help companies manage risks to the application security," he says.

---

More at source: Internet Week