Q&A: Adobe's Brad Arkin on dealing with security

We spoke to Brad Arkin, Adobe's director for product security and privacy, about coping with security threats and future plans.

It's definitely already working in getting protections out to users, but it is hard to measure how many attacks would have happened if it wasn't there.

There's the mechanics of putting the information in the right format and sharing that. That is a little bit of extra work but it is worth it.

You recently announced sandboxing for Reader. Could you explain a little more about what this is and the benefits it will bring?

The marketing term for sandboxing is Adobe Reader Protected Mode and it is a way to take all the activities involved and render them in a PDF file so you can actually see it on your computer and put it inside a sandbox process that runs with low rights.

Advertisement
Advertisement - Article continues below

The end result is that a bad guy that finds a flaw and is able to take over Reader will get stuck inside the sandbox. So they'd have to leverage a two-stage attack to actually do something interesting, whereas today they just need to find that one flaw.

This is an exciting mitigation technology but it is not perfect. It is not going to fix every single possible problem but it will make it harder for bad guys to do interesting things.

It will be available before the end of the year and it will be in the next available version.

This is a really exciting mitigation technique that will defend against all the different types of attacks that we have seen in the real world today. Then we'll just have to respond to what happens next.

Will sandboxing become more widespread in software in the future?

It is really hard to do but it is also quite a powerful mitigation technique. We're looking at ways in which we can use sandboxing for other Adobe products, but until they find a way to do a lot of the work that we had to do by hand, I don't know if sandboxing is going to become the standard.

Featured Resources

Application security fallacies and realities

Web application attacks are the most common vulnerability, so what is the truth about application security?

Download now

Your first step researching Managed File Transfer

Advice and expertise on researching the right MFT solution for your business

Download now

The KPIs you should be measuring

How MSPs can measure performance and evaluate their relationships with clients

Download now
Advertisement

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

4 Nov 2019
Visit/domain-name-system-dns/34842/microsoft-embraces-dns-over-https-to-secure-the-web
Domain Name System (DNS)

Microsoft embraces DNS over HTTPS to secure the web

19 Nov 2019
Visit/strategy/28115/the-pros-and-cons-of-net-neutrality
Business strategy

The pros and cons of net neutrality

4 Nov 2019
Visit/social-media/34844/can-wikipedia-founders-social-network-really-challenge-facebook
social media

Can Wikipedia founder's social network really challenge Facebook?

19 Nov 2019