Developers' secure-coding skill put to the test
Flaw reduction push gets industry backing
A coalition of security companies and organisations announced a plan this week to create assessment tests that would certify programmers' knowledge of secure-coding practices.
The groups, led by the SANS Institute, aim to create a set of four tests covering major programming languages that could give companies a tool to measure software developers' ability to create secure code. The tests would also act as a guide to software buyers of the ability of the developers who created the programs, as well as give coders a way to identify gaps in their knowledge of secure programming techniques, said Alan Paller, director of research for the SANS Institute.
"If we are ever going to get ahead of the security problem, we are going to have to take care of the bugs at the development level," Paller said during a conference call with reporters. "There are at least a million and a half people writing programs and they all need to know this stuff."
Dubbed the Secure Programming Skills Assessment (SPSA), the initiative boasts the support of 362 companies, government agencies and universities, according to the SANS Institute.
Among the participants are government contractor MITRE, University of California at Davis, web security firm SPI Dynamics, code auditing firm Fortify Software, the Open Web Application Security Project (OWASP), and consulting firm Booz Allen & Hamilton. Symantec, the owner of SecurityFocus, has also voiced support for the assessment tests.
The initiative comes as software companies are increasingly being taken to task for the flaws in their programs. Researchers have used month-long release of daily bugs to highlight the security issues in particular classes of software, specific areas of the operating system and specific languages.
Different programming languages hold different pitfalls for programmers. Web applications written in the PHP programming language, for example, likely account for about 43 per cent of the more than 8,000 vulnerabilities recorded in 2006. While developers using languages such as Java tend to create more secure code, a recent study found that sample programs provided with large Java-based projects still contain a significant number of bugs.
According to the SANS Institute, nearly 85 per cent of all vulnerabilities are due to three common developer errors: input validation, buffer overflows, and integer overflows.
Much of the problem is because computer programmers are not trained in secure programming methods in college courses, said Steve Christey, editor of the Common Vulnerability and Exposures (CVE) Project at MITRE.
"Most educational institutions have failed to teach the most fundamental skills in making secure products," Christey said in a statement. "There needs to be a revolution."
Developers can take the Secure Programming Skills Assessment (SPSA) in one of four language areas: C/C++, Java/J2EE, Perl/PHP and .NET/ASP. The tests are being designed to be a reliable gauge of a developer's "expertise in identifying and correcting common programming errors that lead to security vulnerabilities", according to the SANS Institute.
Three different tests will be developed in each area. A proctored test that individuals can take at certified testing stations and which will lead to a Global Information Assurance Certification (GIAC) in secure programming. Another test will be available to corporations that want to test their developers' skills in secure programming. And a third test will be available as a practice exam to programmers that want to determine on what secure-coding topics they might want to focus.
"Test security is being taken seriously," the SANS Institute's Paller said. "We don't want test leakage."
India's software development outsourcing firm Tata has pledged to test its 60,000 programmers.
Microsoft is the initiative's notable holdout. The software giant, which has pioneered the corporate focus on secure coding with its Trustworthy Computing Initiative and the Secure Development Lifecycle (SDL), did not commit to supporting the assessment tests.
"We are pleased that other third parties and vendors are encouraging secure coding practices through certifications, test and services as that broadens the scope of focus on secure coding practices across the industry," Microsoft said in a statement to SecurityFocus. "Microsoft also believes that the best means for ensuring long-term security education is to work collaboratively with academia and experts in that community to make sure that security concepts are integrated as part of a well-rounded program of study."
Microsoft has trained inhouse developers and key partners in its own secure coding methodology, the Secure Development Lifecycle (SDL), as a way to reduce the number of security holes shipped in its products. In March, one of the company's creators of the SDL predicted that the development style will result in half as many flaws in Microsoft's latest operating system, Windows Vista.
The SPSA exam will be piloted in August in Washington DC and then rolled out worldwide during the remainder of 2007.
This article originally appeared in Security Focus.
Copyright © 2007, SecurityFocus