Training the key to avoiding software security flaws

Stephen Withers
Friday, 27 August 2010 16:40

Business IT - Security

The same types of exploits have remained the most common for at least three years. Are developers slow to learn?

The Open Web Application Security Project (OWASP) list of the top ten attacks has changed little between 2007 and 2010, while code reviews conducted by Microsoft's internal IT operation reveal five types of flaw that keep cropping up.

"This happens because it [software] is complicated," said Rocky Heckman, senior security architect at Microsoft, explaining that software has a tendency to do unintended and undesirable things.

The five common flaws he sees involve cross-site scripting (XSS), SQL injection, buffer overflows, canonicalisation, and cross-site request forgeries (XSRF).

There are established ways of avoiding these issues, including input validation, stored SQL procedures, managed code, and encrypted unique session IDs, so why do they keep appearing?

"Big organisations are like the Titanic - difficult to turn around," Heckman told iTWire. A general reluctance to touch old code contributes to the problem.

Training is the key - see page 2.