As Security Problems Grow, Time for Software Assessment Is Now
By Gary McGraw
June 1, 2006 —
(Page 1 of 4)
When I started working on software security 10 years ago, I couldn’t convince even my mother of its importance, much less network security guys and developers. Things have come a long way since then. Today, everyone seems to agree that we need to do something to address the security problem at the software level, and a number of companies are even starting to do something about it.
It’s still the early days for software security, though, and it’s a very good time to assess the state of the problem, how far we’ve come to address it, and how far we have to go. In general, I am very optimistic about the state we’re in, especially considering the progress that leading software producers are making.
Why Software Security
By almost any measure, it’s clear that the software security problem is growing. The Trinity of Trouble—connectedness, complexity and extensibility, the three major factors that make the problem a continuously evolving challenge—does its part to keep things interesting. CERT reports that the serious software vulnerability problem continues to grow, with an increase since 2000 of more than 500 percent. In 2005, there were 5,690 software security vulnerabilities that resulted in widespread security attacks.
What’s critical to understand is that not all of these problems happen at the “application level” as some security vendors wish you to believe. Software security problems show up in router code, in operating system code, in cell phone code and even in code for public key cryptosystems. Sure, Web-based applications suffer from serious software security problems too, but declaring that the problem applies only to Web-based software running over HTTP is naive at best, and dangerous at worst.
If software plays an essential role in your business, you need to concern yourself with software security.
Best Practices
When I wrote “Building Secure Software” with John Viega six years ago, we spent much of our energy describing the problem. This was important philosophical ground-breaking, and I am very happy with the result, but the time has come to stop wringing our hands about the problem and start doing something about it.
Share this link: http://sdt.bz/29343
Most Read Latest News Blog Resources
Zeichick’s Take: Radio moves from analog waveforms to digital packets
Streaming radio highlights the need for streaming applications to be designed to take up as little bandwidth as possible
|
|
Taking enterprise architecture to the business side
Startup Corso is bringing out a cloud-based planning platform that ties into business plans
|
|
Appcelerator Acquires Cocoafish to Add Instant Mobile Cloud Capabilities to its Industry Leading Titanium Platform
Appcelerator Offers Messaging, Social, Location and Storage Mobile Cloud Services to All Mobile App Publishers
|
|
ComponentOne Releases a Collection of 40+ UI Widgets Powered by HTML5 and jQuery
ComponentOne has announced the 2012 release of Wijmo: a kit of UI widgets for HTML5 and jQuery development
|
Taking enterprise architecture to the business side
Startup Corso is bringing out a cloud-based planning platform that ties into business plans
|
|
Top five apps to manage your workload
Web applications offer new ways to track your “to-do” lists
|
|
Not so fast when it comes to testing in the cloud
Developers face outsourcing, virtual lab management and mobile devices as obstacles
|
|
Xceed releases UX-focused suite for Microsoft’s WPF
"Blendables" helps match user experiences to developer visions
|
Are you at risk for burnout?
Burnout is a severe problem and it can strike at any time. Here's how to tell if you are nearing the edge.
|
|
Agility, mom, and apple pie
If we're to evaluate the state-of-the-art in software development, we should start with the values espoused in the Agile Manifesto.
|
|
RIM woos developers with free tablet
How do you get more apps ported to the BlackBerry PlayBook? By giving every developer a free tablet, of course!
|
|
GitHire: Use Headhunters to Find Your Perfect Programmer
Are you a hiring manager tired of scouring the job boards? Check out this new service that will find 5 people interested in your jobs.
|
The Hidden Costs of Software Licensing
Moving beyond paper-based software licensing to more flexible, software-based licensing is a business decision. There is a growing trend tow...
|
|
Case Study: You May Need a Development Mechanic
As a contractor for a major financial player in Germany, SOBEGE, a German-based consultancy specializing in embedded IT and web services, wa...
|
|
Ensuring Software Quality at a Major International Bank
One of the world’s leading international banks has adopted AgitarOne technology for delivering generated unit tests for their Java software...
|
|
Load Testing Adobe Flex Applications
Adobe Flex applications may be different from applications you’ve worked with before. For classic HTML web applications, the server does all...
|