Security researchers are becoming discouraged from reporting vulnerabilities to vendors because the process is too onerous, a panel of security experts said at IT Security World held here this week.

"It is a pain to do the right thing so I think a lot of people just don’t bother," said Chris Wysopal, co-founder and chief technology officer of Burlington, Mass.-based security firm Veracode and founder of the Organization for Internet Safety, an industry group that created guidelines for responsible vulnerability disclosure.

"It’s just too big of a headache," said Jeremiah Grossman, founder and chief technology officer of Santa Clara, Calif.-based WhiteHat Security. "And the negative media attention really discourages researchers."

A study on IT security by the Computing Technology Industry Association (CompTIA) finds that human error continues to be the main reason for security breaches, cited by 42% of the IT professionals polled. The good news is the industry can learn from its mistakes: Two years ago, that number was 59%.

The decrease in human error parallels both an increase in the number of organizations that have instituted written security policies and a notable decline in major security breaches, suggesting that a greater awareness of IT security risks is paying off. Sixty-two percent of organizations said they had written security policies in 2006, compared with 47% in 2004. Thirty-four percent of respondents said they experienced a major security breach last year, down from 58% in 2004.

What happens when you build computer software? In one word: change. In this second article in a series on Software Configuration Management (SCM), Kathy T. Evans-Davis provides an amazing amount of value in a short article, describing best practices that work. If you read any article this year, read this one.

Read this DominoPower article.

Learn about IBM Lotus Expeditor restricted workbench and discover how to prevent users from accessing applications and functions without specific permission from the administrator.

Learn about the IBM Lotus Notes/Domino V8 enhancements to the NotesBench and Server.Load workloads. Three new workloads, N8Mail, N7Mail, and N8MailInit, demonstrate the typical tasks of a Lotus Notes user interacting with a Lotus Domino server.

One of the ways to achieve a close-to-real-world view of a Lotus Notes user is to closely mimic the API calls by the Lotus Notes V8 and Lotus Notes V7 clients. The N8Mail and N7Mail workloads used to reproduce those calls are completely new workloads with heavier transaction rates, which means that the data is different from your previous R6Mail results and that the results cannot be directly compared to each other.

This article is intended for system administrators and designers interested in conducting performance measurements in their Lotus Notes/Domino V8 environments. This article assumes that you are an experienced Lotus Domino administrator.

IBM announced an expansion of its collaboration software portfolio, introducing new products and features to help customers improve productivity, business networking and knowledge sharing. The announcements were made at IBM’s Collaboration Summit in New York City.

In the past year, IBM has upgraded every product area in its collaboration portfolio, including Web 2.0 features in Lotus Notes and Domino 8; professional networking tools for the enterprise with IBM Lotus Connections; easy document sharing through IBM Lotus Quickr; rich, browser-based Web 2.0 electronic forms with IBM Lotus Forms; expanded unified communications and instant messaging in IBM Lotus Sametime 8.0; and enterprise mashup capabilities in IBM WebSphere Portal.

Running Firefox or Opera as a default browser won’t save you from unpatched Internet Explorer vulnerabilities–a fact made explicit when a researcher showed how easy it is to put HTML inside files supported by Windows Media Player.

Researcher Petko D. Petkov said in a Sept. 18 blog posting that he’s found that a fully patched Windows XP Service Pack 2 system running Internet Explorer 6 or 7 along with Windows Media Player 9–the default, although the media player is now up to Version 11–will open any page of an attacker’s choice even if the default browser is not Internet Explorer.

Following its bankruptcy filing, The SCO Group may be booted off of the Nasdaq stock exchange as early as next week. The stock exchange informed SCO on Tuesday that "the Company’s securities will be delisted from Nasdaq on September 27, 2007, pending an appeal," SCO said in a statement. This comes as a result of the company’s recent filing for Chapter 11 bankruptcy protection, SCO said.

Acer’s planned $710 million acquisition of U.S. PC vendor Gateway won antitrust approval in the U.S. as the clock struck midnight Monday, Gateway said. The time marked the end of a 30-day waiting period in which the U.S. Federal Trade Commission or the Antitrust Division of the U.S. Department of Justice may intervene or request additional time to review the deal for possible antitrust violations.

IBM has released a suite of free software tools for creating and sharing documents, spreadsheets and presentations. The company announced the tool set, known as Lotus Symphony, at the IBM Collaboration Summit at the Hayden Planetarium in New York City.

IBM officials said there are three core applications that make up the Lotus Symphony tools: Lotus Symphony Documents, Lotus Symphony Spreadsheets, and Lotus Symphony Presentations. The tools support Windows and Linux desktops and are designed to handle the majority of office productivity tasks that workers typically perform.

Lotus Symphony supports multiple file formats including Microsoft Office and ODF (Open Document Format), and can also output content in PDF format.