Feeds

Developers' secure-coding skill put to the test

Flaw reduction push gets industry backing

Choosing a cloud hosting partner with confidence

A coalition of security companies and organisations announced a plan this week to create assessment tests that would certify programmers' knowledge of secure-coding practices.

The groups, led by the SANS Institute, aim to create a set of four tests covering major programming languages that could give companies a tool to measure software developers' ability to create secure code. The tests would also act as a guide to software buyers of the ability of the developers who created the programs, as well as give coders a way to identify gaps in their knowledge of secure programming techniques, said Alan Paller, director of research for the SANS Institute.

"If we are ever going to get ahead of the security problem, we are going to have to take care of the bugs at the development level," Paller said during a conference call with reporters. "There are at least a million and a half people writing programs and they all need to know this stuff."

Dubbed the Secure Programming Skills Assessment (SPSA), the initiative boasts the support of 362 companies, government agencies and universities, according to the SANS Institute.

Among the participants are government contractor MITRE, University of California at Davis, web security firm SPI Dynamics, code auditing firm Fortify Software, the Open Web Application Security Project (OWASP), and consulting firm Booz Allen & Hamilton. Symantec, the owner of SecurityFocus, has also voiced support for the assessment tests.

The initiative comes as software companies are increasingly being taken to task for the flaws in their programs. Researchers have used month-long release of daily bugs to highlight the security issues in particular classes of software, specific areas of the operating system and specific languages.

Different programming languages hold different pitfalls for programmers. Web applications written in the PHP programming language, for example, likely account for about 43 per cent of the more than 8,000 vulnerabilities recorded in 2006. While developers using languages such as Java tend to create more secure code, a recent study found that sample programs provided with large Java-based projects still contain a significant number of bugs.

According to the SANS Institute, nearly 85 per cent of all vulnerabilities are due to three common developer errors: input validation, buffer overflows, and integer overflows.

Much of the problem is because computer programmers are not trained in secure programming methods in college courses, said Steve Christey, editor of the Common Vulnerability and Exposures (CVE) Project at MITRE.

"Most educational institutions have failed to teach the most fundamental skills in making secure products," Christey said in a statement. "There needs to be a revolution."

Developers can take the Secure Programming Skills Assessment (SPSA) in one of four language areas: C/C++, Java/J2EE, Perl/PHP and .NET/ASP. The tests are being designed to be a reliable gauge of a developer's "expertise in identifying and correcting common programming errors that lead to security vulnerabilities", according to the SANS Institute.

Three different tests will be developed in each area. A proctored test that individuals can take at certified testing stations and which will lead to a Global Information Assurance Certification (GIAC) in secure programming. Another test will be available to corporations that want to test their developers' skills in secure programming. And a third test will be available as a practice exam to programmers that want to determine on what secure-coding topics they might want to focus.

"Test security is being taken seriously," the SANS Institute's Paller said. "We don't want test leakage."

India's software development outsourcing firm Tata has pledged to test its 60,000 programmers.

Microsoft is the initiative's notable holdout. The software giant, which has pioneered the corporate focus on secure coding with its Trustworthy Computing Initiative and the Secure Development Lifecycle (SDL), did not commit to supporting the assessment tests.

"We are pleased that other third parties and vendors are encouraging secure coding practices through certifications, test and services as that broadens the scope of focus on secure coding practices across the industry," Microsoft said in a statement to SecurityFocus. "Microsoft also believes that the best means for ensuring long-term security education is to work collaboratively with academia and experts in that community to make sure that security concepts are integrated as part of a well-rounded program of study."

Microsoft has trained inhouse developers and key partners in its own secure coding methodology, the Secure Development Lifecycle (SDL), as a way to reduce the number of security holes shipped in its products. In March, one of the company's creators of the SDL predicted that the development style will result in half as many flaws in Microsoft's latest operating system, Windows Vista.

The SPSA exam will be piloted in August in Washington DC and then rolled out worldwide during the remainder of 2007.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Apple grapple: Congress kills FBI's Cupertino crypto kybosh plan
Encryption would lead us all into a 'dark place', claim G-Men
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.