Where Does Secure Coding Belong In the Curriculum?

[coley at linus.mitre.org (Steven M. Christey)]

On Tue, 25 Aug 2009, Benjamin Tomhave wrote:

> We should be seeking to innovate outside the box - change the rules of
> the game dramatically - rather than trying to work within the arbitrary
> constructs we've placed around ourselves.

Insert obligatory OWASP ESAPI praise here.  The Enterprise Security API
project is trying to build an API that makes it easier for application
developers to fold in security.  If you need crypto, use the crypto API.
If you need authentication, use the authentication API.

I think ESAPI (or similar APIs) have the potential to be game-changers.
One primary benefit is that programmers aren't trying to implement
security themselves.  One potential selling point to developers would be
saving time - rather than wasting days/weeks/months implementing your own
authentication scheme, use the API.  Obviously there are limitations in
its applicability, but it seems to be off to a great start.

http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API

This kind of thing could be extended to non-web applications, or possibly
introduced to programmers fairly early in education.

Disclaimer: I've participated in the project here and there.

Another way to change the game (besides languages) is to define and adopt
more secure protocols.  Given how slow DNSSEC and IPv6 have been in terms
of adoption, and how rapidly AJAX has grown, I'm not too optimistic for
success in this area without serious customer demand.

Even requiring the use of non-proprietary, well-documented protocols and
data formats, with strict conformance by implementations, could go a long
way - because then you can develop extensive test suites against these
standards and use a whitelist-based approach of refusing anything that
does not conform.  Unfortunately, I'm not too optimistic in this regard,
either.

- Steve