Q&A: Adobe's Brad Arkin on dealing with security

We spoke to Brad Arkin, Adobe's director for product security and privacy, about coping with security threats and future plans.

It's definitely already working in getting protections out to users, but it is hard to measure how many attacks would have happened if it wasn't there.

There's the mechanics of putting the information in the right format and sharing that. That is a little bit of extra work but it is worth it.

You recently announced sandboxing for Reader. Could you explain a little more about what this is and the benefits it will bring?

The marketing term for sandboxing is Adobe Reader Protected Mode and it is a way to take all the activities involved and render them in a PDF file so you can actually see it on your computer and put it inside a sandbox process that runs with low rights.

The end result is that a bad guy that finds a flaw and is able to take over Reader will get stuck inside the sandbox. So they'd have to leverage a two-stage attack to actually do something interesting, whereas today they just need to find that one flaw.

This is an exciting mitigation technology but it is not perfect. It is not going to fix every single possible problem but it will make it harder for bad guys to do interesting things.

It will be available before the end of the year and it will be in the next available version.

This is a really exciting mitigation technique that will defend against all the different types of attacks that we have seen in the real world today. Then we'll just have to respond to what happens next.

Will sandboxing become more widespread in software in the future?

It is really hard to do but it is also quite a powerful mitigation technique. We're looking at ways in which we can use sandboxing for other Adobe products, but until they find a way to do a lot of the work that we had to do by hand, I don't know if sandboxing is going to become the standard.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Most Popular

School laptops sent by government arrive loaded with malware
malware

School laptops sent by government arrive loaded with malware

21 Jan 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
What is the Raspberry Pi Pico?
Hardware

What is the Raspberry Pi Pico?

21 Jan 2021