Feeds

Don't blame Willy the Mailboy for software security flaws

In defense of developers

Reducing security risks from open source software

Uncertain certification

There is Sun/Oracle's Java Certified Programmer, for example. But certification is of questionable use to the employer, as certification involves rote learning without requiring a true understanding of the subject. For programmers, certification is also risky, quickly outdated. And it can be costly. Anyone out there still have a Certified Novell Engineer docket stapled to their yellowing CV?

Then there are more general-purpose, rigor-oriented qualifications for coders: the all-encompassing SWEBOK offers an IEEE-stamped certification. But - more's the pity - employers care little for such things. Invariably, they return to the time-honored qualification - the university or college degree. But even that tends to be a guideline: hands-on experience ends up being more important for many employers.

Nevertheless, security vendors such as Fortify would like to train - and certify - your entire IT workforce to be more aware of SQL and LDAP injection attacks, cross-site scripting, and so forth. Such vendors thrive on the corporate paranoia brought about by high-profile web front-end attacks and customer data-loss snafus. Their Fortify 360 product will act as a gateway to your source control system and monitor any code commits for security vulnerabilities.

While I have some reservations about Fortify 360's usefulness, it's a good example of how management should be taking the lead to impose processes on development, rather than blaming the programmers for a breakdown in process. It's good to see that QA - which this really is - has come back into fashion, despite being re-branded in the guise of security and the paranoia of an "unseen enemy that cannot be defined".

The vulnerabilities highlighted by Fortify's Audit Workbench are good and worthy flaws, and there's a good chance that your organization will be more secure if they embrace Fortify wholeheartedly. At the very least, your chief executive will sleep better. But there's a whole category of bugs and rules that look like they really are just there to tuck your CEO in at night. For example, the following code is incredibly insecure and may bring down all of civilization, apparently:

public void login(String username, String password) {
}

First, the password is called "password," so someone scanning the compiled code could find that quite easily. Second, it's stored in a String, and Java likes to intern all its Strings in a big reusable cache - so a wily hacker will head straight for the String table and scan it for passwords. So whatever you do, store your passwords in char arrays, and obfuscate your variable names to throw hackers off the scent - "absolutelyNotAPasswordNoWay," perhaps.

There we have an example that managers will love because it seems profound, and it allows them to impose a process while still blaming programmers. But let's face it, if the user has sufficient access to the JVM to trawl the String table, then he's already pwned your organization, and it has siphoned several billion of your corporate dollars into his suburban Jacuzzi extension project.

A far more insidious problem is with insider programmers who hack the system to launder funds - the recent TJX hack case being a case in point.

But in such cases, we still have the traditional "after the event" fallback known as "the law," and preventative, compulsory regulations such as PCI Compliance, which instructs management to put barriers in their organization to prevent the wrong people from seeing credit card numbers or personal account details.

In most cases, the onus is on management to enforce regulatory procedures, which means there's no need for programmers' heads to be on the block. But as long as there are security consultants and conferences to speak at, developers will continue to be blamed for breakdowns in process and QA. ®

Matt Stephens is co-author of Use Case Driven Object Modeling with UML: Theory and Practice, and the upcoming Design Driven Testing: Test Smarter, Not Harder.

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.