"Why Can't Johnny Develop Secure Software?"

"Why Can't Johnny Develop Secure Software?"

What a great article from darkreading.com. It points out what I've been saying all along and has some nice insight too. Not that I need or want validation -- I know the truth about developers and the lack of secure programming -- it is just nice to see bigger names and bigger press about the issue. The more we see about this, the more likely things are to change.

Best quote of the article:

But nearly all experts agree that no matter how strong the training effort, the average developer will never be very security-savvy. "They're always going to be more focused on code quality and trying to meet their deadlines," Sima says. "If I'm a developer, as soon as I've been assigned a project, I'm already behind. If there's a faster way to do something, they're going to take it, because for them speed is more important than security."

Top Groups Say Devs Should Be Liable

I love this! I'm not the only one saying this stuff. SANS and Mitre are now saying it out loud too -- developers should be held responsible for their product's security.

"Vendors Should Be Liable for Code Security (February 16 & 17, 2010) The 2010 CWE (Common Weakness Enumeration)/SANS Top 25 Most Dangerous Programming Errors list points to cross-site scripting (XSS), SQL injection, and buffer overflow vulnerabilities as the causes of nearly all major cyber attacks in recent years. The consortium behind the list, headed by the SANS Institute and Mitre Corp., is also publishing draft language to use in procurement documents that would hold software development organizations liable for product security."

http://www.sans.org/top25-programming-errors/

http://www.computerworld.com/s/article/9157218/Hold_vendors_liable_for_buggy_software_group_says