The following introduction was originally published in the BCS Information Security Now Magazine, Spring 2009 issue (Volume 3, Issue 3), which was on the topic of Software Security:
“Secure, stable and reliable software is a rare commodity, and one that most can’t actually buy. Although we may feel that those who profit from selling us software not up to the task should be held liable and sued, doing so could also expose open source developers to unacceptable risks when giving us their software.
Unreliable and insecure software is due to a variety of factors; from the lack of academic focus within software engineering and computer science courses, to the development approach that our IT professionals are expected to adopt when programming in-house systems or commercial applications.
Even the formal accreditation of systems, e.g. Common Criteria, may not detect or prevent software vulnerabilities from arising; it can even compound the issue by forcing a decision to be made between operating a vulnerable but accredited system and an upgraded but unaccredited system.
SANS and CWE have listed the Top 25 Most Dangerous Programming Errors (http://www.sans.org/top25errors/), which covers the actual programming errors made by developers that lead to the vulnerabilities that software may be susceptible to, and provides useful and authoritative information on mitigation.
Security software even provides ready examples of how to not do it and the formal methods of safety critical systems may be overkill for most commercial offerings. Something needs to be done to improve the security, stability and reliability of software where more features are delivered ever more rapidly.
We need a ‘secure by design’ approach, where we seek to minimise the existence and impact of vulnerabilities and other bugs. Secure applications can only come from a top-down design and development ethos, integrated with a robust software development life cycle (SDLC) that includes structured testing.”
A PDF version of the magazine is available online at: