What not to code
January 13, 2009 Leave a comment
The NSA, with contributions from, among others, :
- Aspect Security
- iDefense Labs at VeriSign
- Oracle Corporation
- Red Hat Inc.
- Fortify Software
- Breach Security
- Security Division of EMC Corporation
- Apple Product Security
- Department of Homeland Security (DHS) National Cyber Security Division
have published a list of the 25 most dangerous programming errors that lead to security bugs and that enable cyber espionage and cyber crime.
Shockingly, most of these errors are not well understood by programmers; their avoidance is not widely taught by computer science programs; and their presence is frequently not tested by organizations developing software for sale.
These Top 25 Errors are divided in three categories:
- Category: Insecure Interaction Between Components (9 errors)
- Category: Risky Resource Management (9 errors)
- Category: Porous Defenses (7 errors)
The list will be constantly updated and augmented with resources to help combat/prevent these errors.
Full article here : http://www.sans.org/top25errors/
Full list here : http://cwe.mitre.org/top25/