Whose bug is it anyway? The battle over handling software flaws

Attacks exploit vulnerabilities in software code. They come in many forms: logic attacks, Trojan horses, worms and viruses, and variants of each. They serve a host of purposes: corporate espionage, white-collar crime, social "hacktivism," terrorism, and notoriety. Greater connectivity, more complex software, and the persistence of older protocols ensure growing vulnerability. End users lose time and money when networks go down. Software vendors lose face and market share. Security researchers struggle to keep pace with the bugs to keep businesses operating safely. The only people with no complaints are the hackers, who reverse-engineer patches released by vendors to exploit the holes. It\´s enough to make you nostalgic for the old days of the Nimba and Code Red viruses, when attacks came six months after vendors released patches. Blaster attacks began three weeks after release. Security experts anticipate so-called "zero day" vulnerabilities, in which attacks precede patches. Although marathon patching sessions have become the norm for harried IT administrators, even top-of-the-line patch management can\´t keep up with malicious code\´s growing sophistication.