Comments on: Developing Secure Code http://un-excogitate.org/archives/2007/07/22/developing-secure-code/ what was I thinking? (Christian Frichot's ad-lib on security and what-not) Wed, 10 Mar 2010 00:27:08 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: For Developers, an Ounce of Prevention is Worth a Pound of Cure - Network Sentry http://un-excogitate.org/archives/2007/07/22/developing-secure-code/comment-page-1/#comment-8085 For Developers, an Ounce of Prevention is Worth a Pound of Cure - Network Sentry Wed, 17 Oct 2007 19:04:29 +0000 http://un-excogitate.org/archives/2007/07/22/developing-secure-code/#comment-8085 [...] This un-excogitate posting summarizes an earlier article at MSDN Magazine that delineates eight rules software writers should follow in order to create secure code. On the list: “never trust data”; use threat modeling and keep abreast of emerging threats and vulnerabilities; and use fuzz input testing. (A response to the post said these three were the only worthwhile tips.) [...] [...] This un-excogitate posting summarizes an earlier article at MSDN Magazine that delineates eight rules software writers should follow in order to create secure code. On the list: “never trust data”; use threat modeling and keep abreast of emerging threats and vulnerabilities; and use fuzz input testing. (A response to the post said these three were the only worthwhile tips.) [...]

]]> By: Hi, Super Nintendo Chalmers! http://un-excogitate.org/archives/2007/07/22/developing-secure-code/comment-page-1/#comment-7394 Hi, Super Nintendo Chalmers! Wed, 15 Aug 2007 14:56:35 +0000 http://un-excogitate.org/archives/2007/07/22/developing-secure-code/#comment-7394 # Never trust data # Use threat modeling against your code # Use fuzz input testing These are about the only good things he has to say. I mean really 'write secure code'? Stay one step ahead - This is silly! 90% of the attacks on [badly written] applications are due to poor input validation. He could at least talk to the software development lifecycle and introduce aspects of security within such a framework, rather than the 8 half arsed steps to looking like you know both security and software development. At what point does MH get the security requirements for his application? Where does he assess the risk of the threats he has identified? I could carry on but I'm lazy and you can do your own research! Tools tools tools... liek if we fuzz the shit out of the application we will have secure code coz the leet haxors wont be able to break it! Sure fuzzing is the flavour of the month and has helped many a hacker, security professional and code monkey find flaws that would have previously taken vast amounts of time to find but it is not a panacea. Now you say that these principals apply to everyone from you one man band to your big Indian development houses. Do you really envisage a one man band to go get the latest fuzzing tool to test on their dodgy PHP application? Do you think that apart from the aforementioned three salient points that a big software shop is going to tell its developers “don't write insecure code”? For crying out loud he even uses a double negative! I would rather we as security professionals tell people to write secure code. It is almost like telling Ralph not to pick his nose!....Fucking futile endevour if you ask me. Check out SP 800-64, it might be a bit longer than a blog post on the official MSDN blog but it will be more worthwhile. # Never trust data
# Use threat modeling against your code
# Use fuzz input testing

These are about the only good things he has to say. I mean really ‘write secure code’?

Stay one step ahead – This is silly! 90% of the attacks on [badly written] applications are due to poor input validation. He could at least talk to the software development lifecycle and introduce aspects of security within such a framework, rather than the 8 half arsed steps to looking like you know both security and software development. At what point does MH get the security requirements for his application? Where does he assess the risk of the threats he has identified? I could carry on but I’m lazy and you can do your own research!

Tools tools tools… liek if we fuzz the shit out of the application we will have secure code coz the leet haxors wont be able to break it! Sure fuzzing is the flavour of the month and has helped many a hacker, security professional and code monkey find flaws that would have previously taken vast amounts of time to find but it is not a panacea.

Now you say that these principals apply to everyone from you one man band to your big Indian development houses. Do you really envisage a one man band to go get the latest fuzzing tool to test on their dodgy PHP application? Do you think that apart from the aforementioned three salient points that a big software shop is going to tell its developers “don’t write insecure code”? For crying out loud he even uses a double negative! I would rather we as security professionals tell people to write secure code. It is almost like telling Ralph not to pick his nose!….Fucking futile endevour if you ask me.

Check out SP 800-64, it might be a bit longer than a blog post on the official MSDN blog but it will be more worthwhile.

]]>