Feeds

Developers' secure-coding skill put to the test

Flaw reduction push gets industry backing

Protecting against web application threats using SSL

A coalition of security companies and organisations announced a plan this week to create assessment tests that would certify programmers' knowledge of secure-coding practices.

The groups, led by the SANS Institute, aim to create a set of four tests covering major programming languages that could give companies a tool to measure software developers' ability to create secure code. The tests would also act as a guide to software buyers of the ability of the developers who created the programs, as well as give coders a way to identify gaps in their knowledge of secure programming techniques, said Alan Paller, director of research for the SANS Institute.

"If we are ever going to get ahead of the security problem, we are going to have to take care of the bugs at the development level," Paller said during a conference call with reporters. "There are at least a million and a half people writing programs and they all need to know this stuff."

Dubbed the Secure Programming Skills Assessment (SPSA), the initiative boasts the support of 362 companies, government agencies and universities, according to the SANS Institute.

Among the participants are government contractor MITRE, University of California at Davis, web security firm SPI Dynamics, code auditing firm Fortify Software, the Open Web Application Security Project (OWASP), and consulting firm Booz Allen & Hamilton. Symantec, the owner of SecurityFocus, has also voiced support for the assessment tests.

The initiative comes as software companies are increasingly being taken to task for the flaws in their programs. Researchers have used month-long release of daily bugs to highlight the security issues in particular classes of software, specific areas of the operating system and specific languages.

Different programming languages hold different pitfalls for programmers. Web applications written in the PHP programming language, for example, likely account for about 43 per cent of the more than 8,000 vulnerabilities recorded in 2006. While developers using languages such as Java tend to create more secure code, a recent study found that sample programs provided with large Java-based projects still contain a significant number of bugs.

According to the SANS Institute, nearly 85 per cent of all vulnerabilities are due to three common developer errors: input validation, buffer overflows, and integer overflows.

Much of the problem is because computer programmers are not trained in secure programming methods in college courses, said Steve Christey, editor of the Common Vulnerability and Exposures (CVE) Project at MITRE.

"Most educational institutions have failed to teach the most fundamental skills in making secure products," Christey said in a statement. "There needs to be a revolution."

Developers can take the Secure Programming Skills Assessment (SPSA) in one of four language areas: C/C++, Java/J2EE, Perl/PHP and .NET/ASP. The tests are being designed to be a reliable gauge of a developer's "expertise in identifying and correcting common programming errors that lead to security vulnerabilities", according to the SANS Institute.

Three different tests will be developed in each area. A proctored test that individuals can take at certified testing stations and which will lead to a Global Information Assurance Certification (GIAC) in secure programming. Another test will be available to corporations that want to test their developers' skills in secure programming. And a third test will be available as a practice exam to programmers that want to determine on what secure-coding topics they might want to focus.

"Test security is being taken seriously," the SANS Institute's Paller said. "We don't want test leakage."

India's software development outsourcing firm Tata has pledged to test its 60,000 programmers.

Microsoft is the initiative's notable holdout. The software giant, which has pioneered the corporate focus on secure coding with its Trustworthy Computing Initiative and the Secure Development Lifecycle (SDL), did not commit to supporting the assessment tests.

"We are pleased that other third parties and vendors are encouraging secure coding practices through certifications, test and services as that broadens the scope of focus on secure coding practices across the industry," Microsoft said in a statement to SecurityFocus. "Microsoft also believes that the best means for ensuring long-term security education is to work collaboratively with academia and experts in that community to make sure that security concepts are integrated as part of a well-rounded program of study."

Microsoft has trained inhouse developers and key partners in its own secure coding methodology, the Secure Development Lifecycle (SDL), as a way to reduce the number of security holes shipped in its products. In March, one of the company's creators of the SDL predicted that the development style will result in half as many flaws in Microsoft's latest operating system, Windows Vista.

The SPSA exam will be piloted in August in Washington DC and then rolled out worldwide during the remainder of 2007.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.