Dailies
- Beast or Buddha
- Caoine
- Echoica
- Jina Bolton
- Lifehacker
- Overclockers Australia
- RiskAnalys.is
- Rory.Blog
- Schneier on Security
- Security Catalyst Community
- Security Ripcord
- Securosis.com
- Slashdot
- Whirlpool
Photos
Categories
- Books
- Computers
- Family
- Forensics
- General
- GTD
- Movies
- Music
- Privacy
- Profession
- Risk
- Security
- University and Studies
- Web Development
Monthly archives
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- December 2006
- June 2006
- May 2006
- April 2006
- March 2006
- August 2005
- July 2005
- June 2005
- May 2005
- April 2005
- February 2005
- October 2004
- September 2004
- August 2004
- July 2004
- June 2004
- May 2004
- April 2004
- March 2004
- February 2004
- January 2004
- December 2003
- November 2003
- October 2003
- September 2003
- August 2003
- July 2003
- June 2003
- May 2003
- April 2003
- March 2003
- February 2003
- January 2003
- December 2002
- November 2002
- October 2002
Search
Developing Secure Code
I book marked this article quite a while back and only now got to have a read of it. The 8 Simple Rules for Developing More Secure Code by Michael Howard over on the msdn is a list of habits of secure developers. I know it’s a little old now, but oh well.
Paraphrased to:
- Take responsibility of your code
- Never trust data
- Use threat modelling against your code
- Stay one step ahead - or keep up to date with emerging vulnerabilities and threats
- Use fuzz input testing
- Don’t write insecure code (I found this point rather over-arching but his comments are good)
- Recognise the strategic asymmetry - be aware that an attacker can spend much more dedicated time finding weaknesses than you can provide 100% secure code
- Use the best tools you can
What I like about Michael’s list is that is applicable to any software development environment using any methodology. From PHP apps developed by a sole-developer for a small company to large, multi-tier, thick-client apps developed by a team of developers. It’s all good.
Posted by Christian 
22 July 2007
2 Responses to “Developing Secure Code”
Hi, Super Nintendo Chalmers! Says:
August 15th, 2007at
10:56 pm
# Never trust data
# Use threat modeling against your code
# Use fuzz input testing
These are about the only good things he has to say. I mean really ‘write secure code’?
Stay one step ahead - This is silly! 90% of the attacks on [badly written] applications are due to poor input validation. He could at least talk to the software development lifecycle and introduce aspects of security within such a framework, rather than the 8 half arsed steps to looking like you know both security and software development. At what point does MH get the security requirements for his application? Where does he assess the risk of the threats he has identified? I could carry on but I’m lazy and you can do your own research!
Tools tools tools… liek if we fuzz the shit out of the application we will have secure code coz the leet haxors wont be able to break it! Sure fuzzing is the flavour of the month and has helped many a hacker, security professional and code monkey find flaws that would have previously taken vast amounts of time to find but it is not a panacea.
Now you say that these principals apply to everyone from you one man band to your big Indian development houses. Do you really envisage a one man band to go get the latest fuzzing tool to test on their dodgy PHP application? Do you think that apart from the aforementioned three salient points that a big software shop is going to tell its developers “don’t write insecure code”? For crying out loud he even uses a double negative! I would rather we as security professionals tell people to write secure code. It is almost like telling Ralph not to pick his nose!….Fucking futile endevour if you ask me.
Check out SP 800-64, it might be a bit longer than a blog post on the official MSDN blog but it will be more worthwhile.
For Developers, an Ounce of Prevention is Worth a Pound of Cure - Network Sentry Says:
October 18th, 2007at
3:04 am
[...] This un-excogitate posting summarizes an earlier article at MSDN Magazine that delineates eight rules software writers should follow in order to create secure code. On the list: “never trust data”; use threat modeling and keep abreast of emerging threats and vulnerabilities; and use fuzz input testing. (A response to the post said these three were the only worthwhile tips.) [...]
Post A Comment