Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/8/2009
03:11 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Rocky Road To More Secure Code

Secure application development initiatives are all the rage now, but will developers get 'religion'?

Homeland Security's Build Security In, Microsoft's Software Development Lifecycle (SDLC), BSIMM, and now OpenSAMM: Secure application development programs are spreading amid calls for more secure code.

The practice of writing applications from the ground up with security in mind remains in its infancy, even with software giant Microsoft leading the charge by sharing its internal Software Development Lifecycle framework in the form of free models and tools for third-party application developers and customers in the spirit of promoting more secure software. Now financial services firms are comparing notes and sharing their secure coding strategies and experiences in the new Building Security In Maturity Model (BSIMM) program spearheaded by Cigital and Fortify Software.

But in a recession fraught with shrinking budgets, it's unclear whether companies can afford to invest in secure development initiatives. In an as-yet unpublished survey by Forrester Research and Veracode, 45 percent of organizations said that application security is a significant part of their overall security strategy, but that they will likely be scaling back those initiatives in their next budget cycle. Around 18 percent of these organizations said their funding for app security will remain intact.

Funding is just one of the wild cards. Retooling application development also often requires a big cultural shift. While efforts like BSIMM and OpenSAMM have raised the profile of secure code-writing, security experts say, widespread deployment of such efforts within enterprises won't be easy.

"It's a good thing for the marketplace, this heightened security awareness [in application development]. But how do you implement it? It's like the early days of network vulnerability scanning -- there's so much output that you need a security expert to implement it," says Matt Moynahan, CEO of Veracode. "It's a difficult problem to solve."

BSIMM provides benchmarks for establishing an organizationwide software security program, based on real-world security software initiatives at the likes of financial firms Wells Fargo and Depository Trust & Clearing Corp. (DTCC), as well as Adobe, EMC, Google, Microsoft, and Qualcomm, and input from Cigital and Fortify. Jim Routh, CISO for DTCC, says his firm's internal secure development initiative saves the firm money labor and other costs. "This savings is reallocated to higher-value activities," Routh says. "Our controls identify defects or vulnerabilities early in the [development] life cycle."

But Veracode's Moynahan, whose company provides application security testing services, says BSIMM alone isn't enough. "What needs to happen is that appsec secure coding has to find a way into the mass market. The recommendations are a good set of guiding principles," he says. But for organizations with no knowledge of security, limited funds, or a small start-up, will they really go implement these best practices?

Another similar initiative, OpenSAMM (Software Assurance Maturity Model) launched last week, boasts an open-source model aimed at becoming an industry standard for secure software development. Led by OWASP member Pravir Chandra, OpenSAMM was initially funded by Fortify, which later helped develop BSIMM.

These models for building a secure app program, as well as DHS's Build Security In and others, also serve as a reality check that developing safer software takes more than scanning tools and penetration tests. "I think we are coming to the realization that application security requires a significant investment in all phases of the development life cycle, and while many organizations have been hoping that there was some 'silver bullet' for this problem, the publication of these maturity models show that it takes much more commitment," says Cory Scott, vice president of technical security assessment for ABN AMRO Bank.

NEXT: Off to a "good start" Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34390
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow on the size parameter of the tz_map_shared_mem function.
CVE-2021-34391
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel�s tz_handle_trusted_app_smc function where a lack of integer overflow checks on the req_off and param_ofs variables leads to memory corruption of critical kernel structures.
CVE-2021-34392
PUBLISHED: 2021-06-22
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary checks, which might lead to denial of service.
CVE-2021-34393
PUBLISHED: 2021-06-22
Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. This vulnerability might allow an attacker to exploit the deserializer to impact code execution, causing information disclosure.
CVE-2021-34394
PUBLISHED: 2021-06-22
Trusty contains a vulnerability in all TAs whose deserializer does not reject messages with multiple occurrences of the same parameter. The deserialization of untrusted data might allow an attacker to exploit the deserializer to impact code execution.