From the Editors: Programmers against sloppy security



Email    print   
April 1, 2009 —  (Page 1 of 2)
No honest software developer sets out to write insecure software. Every architect, every programmer, every tester sincerely believes that the code is solid, bug-free and safe.

Yet, of course, we know better, because systems and applications are not secure. Sometimes the architect’s design is flawed. Sometimes the programmer makes assumptions that prove to be false, or forgets to check a buffer or return value. Sometimes a typo creates a vulnerability. Sometimes the testers fail to imagine the creativity of an attack. And sometimes the vulnerability is caused by a dependency that nobody understood.

Consultants and security tools providers, like the well-meaning experts at Cigital and Fortify, are right to continue focusing on this issue. They’re right to offer training and products that can help architects design more secure software, help programmers write more secure software, and help testers spot vulnerabilities that the architects and programmers missed.

To the array of security-awareness tools, we now have the new Building Security In Maturity Model. This initiative has two goals: one spoken, one understood. The spoken goal is to raise awareness. The unspoken goal, of course, is to raise those companies’ visibility and get them more clients and software sales.

The “Building Security In” phrase, in particular, is one that Cigital CEO Gary McGraw has used as a book title and as the topic of numerous lectures and keynotes. It’s a good message, one that needs to be heard.

There are two basic approaches to software security. One is to get software developers to write and deploy more secure software. That’s a never-ending battle, akin to preventing automobile accidents by getting drivers to be more careful. Education can help, but just as no amount of driver’s ed will prevent cars from smashing into each other, no amount of developer training will eradicate all software security defects.

The second approach is to count on tools to protect us from the effects of insecure software. That’s where enterprise IT tends to focus, as it keeps on buying more firewalls, a spam filter, a virus scanner or a source-code analyzer. That too is a never-ending battle, similar to buying cars with more and more airbags, anti-lock brakes, traction control systems, lane-change warnings, backup cameras and so on. These IT security products surely help, but there’s no way they will catch everything that sloppy programmers and malicious hackers toss at the data center.



Related Search Term(s): editorials, security

Pages 1 2 


Share this link: http://sdt.bz/33366
 
Most Read Latest News Blog Resources


Comments


04/01/2009 02:11:12 PM EST

It's not just education vs. tools. There's a third option. We need to make it easier for developers to do the right thing. How about arming all developers with set of good security controls? For the most part developers have to write all their own security controls, virtually guaranteeing vulnerabilities. Check out the OWASP ESAPI project - our mission is to ensure that all developers in every environment have a set of strong and easy to use security controls. Until we do that, it's just another hamster-wheel-of-pain.

United StatesJeff Williams


04/01/2009 03:18:59 PM EST

Good points. Security is an enterprise issue and not to be borne on the shoulders of the development community only. A key initiative for 2009 is for organizations to “do” something to further protect assets and their brands. - Jennifer Sullivan - CMO, Ounce Labs

United StatesJennifer Sullivan


Add comment


Name*
Email*  
Country     


  • Comment
Loading




close
NEXT ARTICLE
Cigital Develops Ready-to-Use Tools for Securing the Smart Grid
Cigital Inc. announced the release of the Guide to Developing a Cyber Security and Risk Mitigation Plan Read More...
 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 

Download Current Issue
FEBRUARY 2012 PDF ISSUE

Need Back Issues?
DOWNLOAD HERE

Want to subscribe?


 
blogs tab
Are you at risk for burnout?
Burnout is a severe problem and it can strike at any time. Here's how to tell if you are nearing the edge.
02/09/2012 02:16 PM EST

Agility, mom, and apple pie
If we're to evaluate the state-of-the-art in software development, we should start with the values espoused in the Agile Manifesto.
02/07/2012 11:57 AM EST

RIM woos developers with free tablet
How do you get more apps ported to the BlackBerry PlayBook? By giving every developer a free tablet, of course!
02/04/2012 01:57 PM EST

GitHire: Use Headhunters to Find Your Perfect Programmer
Are you a hiring manager tired of scouring the job boards? Check out this new service that will find 5 people interested in your jobs.
02/03/2012 12:17 PM EST

Facebook claims hacker cred
Facebook's SEC S-1 filing form includes a short essay on the Hacker Way by Mark Zuckerberg himself.
02/02/2012 08:26 AM EST

Ryan Dahl steps down
Ryan Dahl, creator of Node.js, steps back from his position as gatekeeper for the project.
02/01/2012 04:58 PM EST

 
Events calendar tab
2/13/2012 to 2/16/2012
Santa Clara
TechWeb

2/26/2012 to 2/29/2012
San Francisco
BZ Media

2/27/2012 to 3/2/2012
San Francisco
RSA

3/4/2012 to 3/7/2012
Las Vegas
IBM Tivoli

3/5/2012 to 3/9/2012
San Francisco
TechWeb