Feeds

Developers' secure-coding skill put to the test

Flaw reduction push gets industry backing

Protecting against web application threats using SSL

A coalition of security companies and organisations announced a plan this week to create assessment tests that would certify programmers' knowledge of secure-coding practices.

The groups, led by the SANS Institute, aim to create a set of four tests covering major programming languages that could give companies a tool to measure software developers' ability to create secure code. The tests would also act as a guide to software buyers of the ability of the developers who created the programs, as well as give coders a way to identify gaps in their knowledge of secure programming techniques, said Alan Paller, director of research for the SANS Institute.

"If we are ever going to get ahead of the security problem, we are going to have to take care of the bugs at the development level," Paller said during a conference call with reporters. "There are at least a million and a half people writing programs and they all need to know this stuff."

Dubbed the Secure Programming Skills Assessment (SPSA), the initiative boasts the support of 362 companies, government agencies and universities, according to the SANS Institute.

Among the participants are government contractor MITRE, University of California at Davis, web security firm SPI Dynamics, code auditing firm Fortify Software, the Open Web Application Security Project (OWASP), and consulting firm Booz Allen & Hamilton. Symantec, the owner of SecurityFocus, has also voiced support for the assessment tests.

The initiative comes as software companies are increasingly being taken to task for the flaws in their programs. Researchers have used month-long release of daily bugs to highlight the security issues in particular classes of software, specific areas of the operating system and specific languages.

Different programming languages hold different pitfalls for programmers. Web applications written in the PHP programming language, for example, likely account for about 43 per cent of the more than 8,000 vulnerabilities recorded in 2006. While developers using languages such as Java tend to create more secure code, a recent study found that sample programs provided with large Java-based projects still contain a significant number of bugs.

According to the SANS Institute, nearly 85 per cent of all vulnerabilities are due to three common developer errors: input validation, buffer overflows, and integer overflows.

Much of the problem is because computer programmers are not trained in secure programming methods in college courses, said Steve Christey, editor of the Common Vulnerability and Exposures (CVE) Project at MITRE.

"Most educational institutions have failed to teach the most fundamental skills in making secure products," Christey said in a statement. "There needs to be a revolution."

Developers can take the Secure Programming Skills Assessment (SPSA) in one of four language areas: C/C++, Java/J2EE, Perl/PHP and .NET/ASP. The tests are being designed to be a reliable gauge of a developer's "expertise in identifying and correcting common programming errors that lead to security vulnerabilities", according to the SANS Institute.

Three different tests will be developed in each area. A proctored test that individuals can take at certified testing stations and which will lead to a Global Information Assurance Certification (GIAC) in secure programming. Another test will be available to corporations that want to test their developers' skills in secure programming. And a third test will be available as a practice exam to programmers that want to determine on what secure-coding topics they might want to focus.

"Test security is being taken seriously," the SANS Institute's Paller said. "We don't want test leakage."

India's software development outsourcing firm Tata has pledged to test its 60,000 programmers.

Microsoft is the initiative's notable holdout. The software giant, which has pioneered the corporate focus on secure coding with its Trustworthy Computing Initiative and the Secure Development Lifecycle (SDL), did not commit to supporting the assessment tests.

"We are pleased that other third parties and vendors are encouraging secure coding practices through certifications, test and services as that broadens the scope of focus on secure coding practices across the industry," Microsoft said in a statement to SecurityFocus. "Microsoft also believes that the best means for ensuring long-term security education is to work collaboratively with academia and experts in that community to make sure that security concepts are integrated as part of a well-rounded program of study."

Microsoft has trained inhouse developers and key partners in its own secure coding methodology, the Secure Development Lifecycle (SDL), as a way to reduce the number of security holes shipped in its products. In March, one of the company's creators of the SDL predicted that the development style will result in half as many flaws in Microsoft's latest operating system, Windows Vista.

The SPSA exam will be piloted in August in Washington DC and then rolled out worldwide during the remainder of 2007.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.