NEWS
Security experts from US government agencies, multinational companies and academia have released a list of what they consider to be the 25 most critical errors made while coding software.
Participants from more than 30 organisations worked together to agree on the 25 "most dangerous" errors, the Sans Institute said in a statement on Monday. They included experts from the US National Security Agency, the US Computer Emergency Response Team, Mitre and the Sans Institute, as well as from Apple, Microsoft and Oracle.
Security from A to Z
Click on the links below to find out more...
A is for Antivirus
B is for Botnets
C is for CMA
D is for DDoS
E is for Extradition
F is for Federated identity
G is for Google
H is for Hackers
I is for IM
J is for Jaschan (Sven)
K is for Kids
L is for Love Bug
M is for Microsoft
N is for Neologisms
O is for Orange
P is for Passwords
Q is for Questions
R is for Rootkits
S is for Spyware
T is for Two-factor authentication
U is for USB sticks/devices
V is for Virus variants
W is for Wi-fi
X is for OS X
Y is for You
Z is for Zero-day
The list was released so programmers can check their code for the most common errors that produce security vulnerabilities.
Alan Paller, director of the Sans Institute, told silicon.com sister site ZDNet UK: "[The list] is going to change the way organisations buy software, right away."
The top-two coding errors were improper input validation and improper encoding or escaping of output, according to Steven Christey of Mitre, who said those particular errors "earned the top rating for good reason".
Christey said in a statement: "In 2008, hundreds of thousands of innocent, and generally trusted, web pages were modified to serve malware by automated programs that burrowed into databases using SQL injection.
"The attack worked because countless programmers made the exact same [input validation and improper output encoding] mistakes in their software."
The full list of coding errors, and information on how to fix them, is available from the Sans Institute website.
Comments
There are 3 comments. Join the discussion
1. anonymous
Most of these only apply to web development and not all 'coders' develop web/distributed stuff!
2. misceng
That input validation is still a problem is an indictment of the training of programmers of today. In the 1960s when programming was in Basic I was taught how to validate input and had subroutines written to limit length and check the characters in the input. Surely the techniques have advanced since then and should be inbuilt in all programs.
3. Karen Challinor
misceng - I was taught that too, we called it 'bombproofing'