Secure coding essential to risk mitigation planning

Andrew Briney, Information Security magazine

This article can also be found in the Premium Editorial Download "Information Security magazine: IDSes takes aim: Emerging "target-based" systems improve intrusion defense."

Download it now to read this article plus other related content.

"The root of the vulnerability problem is that programmers don't know how to code securely. If programmers were taught security in the first place, my job would be 100 times easier."

How many times

    Requires Free Membership to View

have you heard this? All together now, repeat after me: Not gonna happen.

Don't get me wrong. Building secure software is a laudable goal. It boosts productivity and reduces costs. According to one study, it's 6.5 times more expensive to fix a security problem in the implementation phase than in the design phase of a software rollout. By the time you get to the maintenance phase, it's 100 times more expensive.

But we'll burn too much time and energy chasing a totally impractical objective. Secure programming is an oxymoron because none of the parties who could make it happen on a broad scale are properly "incentivized."

Industry leaders care about two things: how to make more money and how to spend less. The notion that secure programming helps them increase efficiency and cut costs in the long run ignores the fact that it's faster and cheaper to build crappy software to get the project rolled out immediately and help the company make its quarterly number.

Academia seems best positioned to influence this issue. But engineering and computer science curricula are developed by faculty who don't have the background, knowledge or interest in developing security coursework. Accreditation bodies aren't forcing the issue, and there's precious little research funding in this area. The result is a vicious cycle: No money, no research, no courses, no students, no workforce training and no matriculating Ph.D.s to break the cycle.

That leaves us with the government, which professes to want to change this problem but is hopelessly mired in bureaucracy. To date, the NSA has designated more than three-dozen universities as Centers of Academic Excellence in Information Assurance Education. Just ask the directors of these centers how much federal money they've actually received under this program, or how uniform their curriculum is compared to other centers. They're struggling, and they're frustrated.

Secure coding is yet another silver bullet. Risk reduction is all about reducing vulnerabilities, mitigating threats and lowering event costs. Secure programming, in theory, solves the vulnerability problem. But since the theory isn't ultimately practical, you have to concentrate your efforts on other vulnerability reduction efforts -- hardening, layering, patching -- while keeping your eye on emerging threats and managing incidents to reduce recovery costs.

About the author
Andrew Briney, CISSP, is editorial director of the TechTarget Security Media Group, which includes Information Security magazine, SearchSecurity.com and the Information Security Decisions conference.

This was first published in January 2004

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.