Secure Coding: Principles and Practices

1.4. A Call to Arms

You probably knew that the security of Internet software was a mess before you started this book. How do we extricate ourselves?

In addition to advocating the widespread adoption of the techniques and practices described in this book, we also call for advances in three particular areas: education, standards, and metrics.

Education

Clearly, we must do a better job of educating engineers about the principles and techniques of secure coding.^[15]

^[15] Professor Spafford told Congress the state of security education means we are facing "a national crisis." See "One View of A Critical National Need: Support for Information Security Education and Research," 1997.

We must also ensure that the public understands the demonstrably poor security of Internet software today, and that the various facets of government comprehend the magnitude of the disasters that can strike us if we don't make drastic improvements.

We also need to convince the press that those who attack systems are not geniuses; they're merely criminals. It would help, too, if the media would stop publicizing dramatic names for the various vulnerabilities and exploitation programs, such as (to invent an example) the "Red Slammer." Will it take a decade or more of severe or deadly incidents to change public attitudes about computer attackers?

Standards

Many people have compared the software vulnerability situation today to the carnage endured before the advent of mandatory seat belts in private automobiles. ...