Feeds

Experts reboot list of 25 most dangerous coding errors

Heal thy apps

Choosing a cloud hosting partner with confidence

Computer experts from some 30 organizations worldwide have once again compiled a list of the 25 most dangerous programming errors along with a novel way to prevent them: by drafting contracts that hold developers responsible when bugs creep into applications.

The list for 2010 bears a striking resemblance to last year's list, which was the first time a broad cross section of the world's computer scientists reached formal agreement on the most common programming pitfalls. The effort is designed to shift attention to the underlying mistakes that allow vulnerabilities to happen in the first place.

The updated list was spearheaded by the not-for-profit MITRE Corporation, the Sans Institute, the National Security Agency, and the US Department of Homeland Security's National Cyber Security Division. Topping the vulnerabilities list are XSS (cross-site scripting), SQL injection, and buffer-overflow bugs. The 25 flaws are the cause of almost every major cyber attack in recent history, including the ones that recently struck Google and 33 other large companies, as well as breaches suffered by military systems and millions of small business and home users.

Its release on Tuesday coincided with a renewed push for customers to hold software developers responsible for the security of their products. Security experts say business customers have the means to foster safer products by demanding that vendors follow common-sense safety measures such as verifying that all team members successfully clear a background investigation and be trained in secure programming techniques.

"As a customer, you have the power to influence vendors to provide more secure products by letting them know that security is important to you," the introduction to Tuesday's list states. It includes this draft contract with other terms customers should request. ®

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.