Feeds

Developers' secure-coding skill put to the test

Flaw reduction push gets industry backing

Using blade systems to cut costs and sharpen efficiencies

A coalition of security companies and organisations announced a plan this week to create assessment tests that would certify programmers' knowledge of secure-coding practices.

The groups, led by the SANS Institute, aim to create a set of four tests covering major programming languages that could give companies a tool to measure software developers' ability to create secure code. The tests would also act as a guide to software buyers of the ability of the developers who created the programs, as well as give coders a way to identify gaps in their knowledge of secure programming techniques, said Alan Paller, director of research for the SANS Institute.

"If we are ever going to get ahead of the security problem, we are going to have to take care of the bugs at the development level," Paller said during a conference call with reporters. "There are at least a million and a half people writing programs and they all need to know this stuff."

Dubbed the Secure Programming Skills Assessment (SPSA), the initiative boasts the support of 362 companies, government agencies and universities, according to the SANS Institute.

Among the participants are government contractor MITRE, University of California at Davis, web security firm SPI Dynamics, code auditing firm Fortify Software, the Open Web Application Security Project (OWASP), and consulting firm Booz Allen & Hamilton. Symantec, the owner of SecurityFocus, has also voiced support for the assessment tests.

The initiative comes as software companies are increasingly being taken to task for the flaws in their programs. Researchers have used month-long release of daily bugs to highlight the security issues in particular classes of software, specific areas of the operating system and specific languages.

Different programming languages hold different pitfalls for programmers. Web applications written in the PHP programming language, for example, likely account for about 43 per cent of the more than 8,000 vulnerabilities recorded in 2006. While developers using languages such as Java tend to create more secure code, a recent study found that sample programs provided with large Java-based projects still contain a significant number of bugs.

According to the SANS Institute, nearly 85 per cent of all vulnerabilities are due to three common developer errors: input validation, buffer overflows, and integer overflows.

Much of the problem is because computer programmers are not trained in secure programming methods in college courses, said Steve Christey, editor of the Common Vulnerability and Exposures (CVE) Project at MITRE.

"Most educational institutions have failed to teach the most fundamental skills in making secure products," Christey said in a statement. "There needs to be a revolution."

Developers can take the Secure Programming Skills Assessment (SPSA) in one of four language areas: C/C++, Java/J2EE, Perl/PHP and .NET/ASP. The tests are being designed to be a reliable gauge of a developer's "expertise in identifying and correcting common programming errors that lead to security vulnerabilities", according to the SANS Institute.

Three different tests will be developed in each area. A proctored test that individuals can take at certified testing stations and which will lead to a Global Information Assurance Certification (GIAC) in secure programming. Another test will be available to corporations that want to test their developers' skills in secure programming. And a third test will be available as a practice exam to programmers that want to determine on what secure-coding topics they might want to focus.

"Test security is being taken seriously," the SANS Institute's Paller said. "We don't want test leakage."

India's software development outsourcing firm Tata has pledged to test its 60,000 programmers.

Microsoft is the initiative's notable holdout. The software giant, which has pioneered the corporate focus on secure coding with its Trustworthy Computing Initiative and the Secure Development Lifecycle (SDL), did not commit to supporting the assessment tests.

"We are pleased that other third parties and vendors are encouraging secure coding practices through certifications, test and services as that broadens the scope of focus on secure coding practices across the industry," Microsoft said in a statement to SecurityFocus. "Microsoft also believes that the best means for ensuring long-term security education is to work collaboratively with academia and experts in that community to make sure that security concepts are integrated as part of a well-rounded program of study."

Microsoft has trained inhouse developers and key partners in its own secure coding methodology, the Secure Development Lifecycle (SDL), as a way to reduce the number of security holes shipped in its products. In March, one of the company's creators of the SDL predicted that the development style will result in half as many flaws in Microsoft's latest operating system, Windows Vista.

The SPSA exam will be piloted in August in Washington DC and then rolled out worldwide during the remainder of 2007.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.