Skip to main content

Business > News

Tue, 13 Jan 2009 NSA helps name most dangerous programming mistakes

Top 25 list gives developers a minimum set of coding errors that must be eradicated

Robert McMillan

  • Email to a friend
  • Print this article
  • Bookmark this page
  • RSS feed

A group of more than 30 computer organisations has taken what some are calling a big step toward making software more secure.

Led by experts from the US National Security Agency, the Department of Homeland Security, Microsoft and Symantec, the group published on Monday a blueprint outlining the most dangerous software programming errors.

Question of the day!

Mark Hattersley
Editor in Chief

Do you use Adobe Photoshop with a Wacom tablet?

Question of the day!

Do you use Adobe Photoshop with a Wacom tablet?

% of Macworld readers agree with you

Yes
TBC
No
TBC

How does a Wacom tablet improve the Photoshop experience?

124 characters remaining

Follow the conversation at @TabletChat

paintings & illustrations, mostly, which i upload to flickr.RT @fragmentedm

I draw manga/anime characters. I also do graphic design and photography.RT @spialelo

Yes. I usually put them up on my #deviantart account for feedback on how to improve.RT @spialelo

The list represents the first time the industry has reached consensus on the worst things that can happen when software is being written.

“The top 25 list gives developers a minimum set of coding errors that must be eradicated before software is used by customers,” said Chris Wysopal, chief technology officer with Veracode, in a prepared statement.

More than just a list, however, the document could be used as a negotiating tool between buyers and software vendors, said Alan Paller, director of research with the SANS Institute, a security training group that spearheaded the work.

In fact, New York state is now developing procurement documents that could be used by state agencies to make their vendors certify that their code contains none of these programming errors.

Ultimately that will make the vendor, not the state, responsible when buggy software leads to a security problem, Paller said. “When the software is found to be flawed … all of the economic liability shifts to them.”

Paller expects that this kind of certification, virtually unknown today, will become more common now that such a large part of the industry has agreed on what programming errors are most dangerous.

But he expects it to be used in large custom-coding contracts rather than in the software licensing agreements used for widely distributed software such as Microsoft Windows.

The flaws include things such as allowing for SQL injection or cross-site scripting attacks, sending sensitive information in clear text, which can be easily read, and hard-coding security passwords into programs, where they’re hard to change if discovered.

Two of these bugs led to more than 1.5 million Web site breaches last year, SANS said. And that was just the start: Often, these Web breaches were used by online attackers to then launch more attacks against people who surfed the hacked sites.

Macworld January on sale now! Hot tech tips for 2009 and FREE ultimate Mac games DVD. FREE copy of DocHaven 2.0.5 worth £52 for every reader. For more information click here.

Email A Friend

Email this article to a friend or colleague:



PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

<<prev article | back to news index | next article>>

Comments received


Michael said on Tue, 13 Jan 2009

Microsoft: The fox guarding the hen house.

Disclaimer
Opinions expressed here are those of the writers and do not reflect those of Macworld. Macworld accepts no responsibility legal or otherwise for their accuracy of content.
Click here to read the house rules.

Click here for the latest reader comments

Latest News


More news...