We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byRebecca Garrett
Modified over 3 years ago
© 2006 Carnegie Mellon University CERT Secure Coding Standards Robert C. Seacord
© 2006 Carnegie Mellon University 2 Total vulnerabilities reported (1995-2Q,2005): 19,600 5,000 4,000 3,000 2,000 0 1,000 199719981999200020012002200320042005 311 262 417 1,090 2,437 4,129 3,784 3,780 5,990 6,000 Problem Statement Reacting to vulnerabilities in existing systems is not working
© 2006 Carnegie Mellon University 3 Recent Trends Are No Different 0 250 500 750 1000 1250 1500 1750 2000 FY 2004 Q3 FY 2004 Q3 FY 2004 Q4 FY 2005 Q1 FY 2005 Q2 FY 2005 Q3 FY 2005 Q4 FY 2006 Q1 FY 2006 Q2 FY 2006 Q3TD
© 2006 Carnegie Mellon University 4 Secure Coding Initiative Work with software developers and software development organizations to eliminate vulnerabilities resulting from coding errors before they are deployed. Reduce the number of vulnerabilities to a level where they can be handled by computer security incident response teams (CSIRTs) Decrease remediation costs by eliminating vulnerabilities before software is deployed
© 2006 Carnegie Mellon University 5 Overall Thrusts Advance the state of the practice in secure coding Identify common programming errors that lead to software vulnerabilities Establish standard secure coding practices Educate software developers
© 2006 Carnegie Mellon University 6 CERT Secure Coding Standards Identify coding practices that can be used to improve the security of software systems under development Coding practices are classified as either rules or recommendations Rules need to be followed to claim compliance. Recommendations are guidelines or suggestions. Development of Secure Coding Standards is a community effort
© 2006 Carnegie Mellon University 7 Rules Coding practices are defined as rules when Violation of the coding practice will result in a security flaw that may result in an exploitable vulnerability. There is an enumerable set of exceptional conditions (or no such conditions) where violating the coding practice is necessary to ensure the correct behavior for the program. Conformance to the coding practice can be verified.
© 2006 Carnegie Mellon University 8 Recommendations Coding practices are defined as recommendations when Application of the coding practice is likely to improve system security. One or more of the requirements necessary for a coding practice to be considered a rule cannot be met.
© 2006 Carnegie Mellon University 9 Community Development Process Published as candidate rules and recommendations on the CERT Wiki accessible from: www.cert.org/secure-coding www.cert.org/secure-coding Rules are solicited from the community Threaded discussions used for public vetting Candidate coding practices are moved into a secure coding standard when consensus is reached
© 2006 Carnegie Mellon University 10 Scope The secure coding standards proposed by CERT are based on documented standard language versions as defined by official or de facto standards organizations. Secure coding standards are under development for: C programming language (ISO/IEC 9899:1999) C++ programming language (ISO/IEC 14882-2003 ) Applicable technical corrigenda and documented language extensions such as the ISO/IEC TR 24731 extensions to the C library are also included.
© 2006 Carnegie Mellon University 11 Potential Applications Establish secure coding practices within an organization may be extended with organization-specific rules cannot replace or remove existing rules Train software professionals Certify programmers in secure coding Establish base-line requirements for software analysis tools Certify software systems
© 2006 Carnegie Mellon University 12 System Qualities Security is one of many system qualities that must be considered in the selection and application of a coding standard. System qualities with significant overlap Safety Reliability Availability System qualities that influence security Maintainability Understandability System qualities that make security harder Portability System qualities that may conflict with security Performance Usability
© 2006 Carnegie Mellon University 13 Implementation & Demo Externally accessible system hosted on the CERT web site Software Atlassian's confluence wiki with unlimited named users Hardware One Dell PowerEdge 2850 Two Intel Xeon Processors at 3.0GHz/2MB Cache, 800MHz FSB Memory 2GB DDR2 400MHz (2X1GB Primary Controller Embedded RAID (ROMB) Three 73GB 10K RPM Ultra 320 SCSI Hard Drives
© 2006 Carnegie Mellon University 14 Demo
© 2006 Carnegie Mellon University 15 Future Directions Provide similar products for other languages C++/CLI C# Java Ada Etc. Produce language independent guidance cross-referenced with specific examples from target languages
© 2006 Carnegie Mellon University 16 Questions
© 2006 Carnegie Mellon University 17 For More Information Visit the CERT ® web site http://www.cert.org/secure-coding/ Contact Presenter Robert C. Seacord email@example.com@cert.org Contact CERT Coordination Center Software Engineering Institute Carnegie Mellon University 4500 Fifth Avenue Pittsburgh PA 15213-3890 Hotline: 412-268-7090 CERT/CC personnel answer 8:00 a.m.–5:00 p.m. and are on call for emergencies during other hours. Fax: 412-268-6989 E-mail: firstname.lastname@example.org
© 2007 Carnegie Mellon University Secure Coding Initiative Jason A. Rafail Monday, May 14 th, 2007.
1 ISO/IEC JTC 1/SC 22/WG 23 ISO working group on Guidance for Avoiding Vulnerabilities through language selection and use John Benito, Convener Jim Moore,
UWF Computing Hardware Standards ITS Annual Recommendations for
Addition 1’s to 20.
0 - 0.
NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 1 NASA Earth Science Data Systems (ESDS) Software Reuse Working Group CEOS WIGSS-22 Annapolis, MD September.
Setting up repositories: Technical Requirements, Repository Software, Metadata & Workflow. Repository services Iryna Kuchma, eIFL Open Access program manager,
HIPAA Security Presentation to The American Hospital Association Dianne Faup Office of HIPAA Standards November 5, 2003.
For C Language WG, 2006 March, Berlin 1 A New Standards Project on Avoiding Programming Language Vulnerabilities Jim Moore Liaison Representative from.
Wright Technology Corp. Minh Duong Tina Mendoza Tina Mendoza Mark Rivera.
For SIGAda Conference, 2005 November, Atlanta 1 A New Standards Project on Avoiding Programming Language Vulnerabilities Jim Moore Liaison Representative.
1 Introduction to Safety Management April Objective The objective of this presentation is to highlight some of the basic elements of Safety Management.
Software change management
Discussion on choices for software solution Alberto Pace.
ITT NETWORK SOLUTIONS. Quick Network Facts Constant 100 Mbps operation for users Infrastructure ready for 1000 Mbps operation to the user Cisco routing.
What is valorisation ? Growth €
OLAC Process and OLAC Protocol: A Guided Tour Gary F. Simons SIL International ___________________________ OLAC Workshop 10 Dec 2002, Philadelphia.
©Ian Sommerville 2004Software Engineering, 7th edition. Chapter 27 Slide 1 Quality Management.
Systems Development Project Management Chapter Extension 15.
System Overview Chapter 1. System Overview 1-2 Objectives Understand Overall Schematic Be aware of technical recommendations for new system Learn how.
21 Jan 05 1 Presentation at Bridges for Recognition Leuven January 2005 Mette Beyer Paulsen, Project Manager Cedefop/Thessaloniki EUROPASS - a single.
Massachusetts Digital Government Summit October 19, 2009 IT Management Frameworks An Overview of ISO 27001:2005.
Juniata College Retirement Plan Update Spring 2011 Presented By: Jeffrey Savino.
MULT. INTEGERS 1. IF THE SIGNS ARE THE SAME THE ANSWER IS POSITIVE 2. IF THE SIGNS ARE DIFFERENT THE ANSWER IS NEGATIVE.
Presentation by Rachel Su’a
Blue Pilot Consulting, Inc. 1 A new type of Working Group used for a new SC22 Working Group OWG: Vulnerability John Benito JTC 1/SC 22 WG14.
CERT Centers, Software Engineering Institute Carnegie Mellon University Pittsburgh, PA SEI is sponsored by the U.S. Department of Defense ©
Insert image here © SPEC-Soft SAVINGS AND EXPERTISE FOR YOUR PLANT PFS-Suite Life-cycle Tools For Process Automation PFS-Suite TM.
Checking & Corrective Action
1 Carnegie Mellon University Overview of the CERT/CC and the Survivable Systems Initiative Andrew P. Moore CERT Coordination Center.
1 Welcome Safety Regulatory Function Handbook April 2006.
O X Click on Number next to person for a question.
Code Correctness, Readability, Maintainability Svetlin Nakov Telerik Corporation
Standards Certification Education & Training Publishing Conferences & Exhibits ISA Certified Automation Professional ® (CAP ® ) Rev. 10/2006.
System Overview Chapter 1. System Overview 1-2 Objectives Understand Overall Schematic Review Phase 2 Be aware of technical recommendations for new system.
Networked Systems Survivability CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA © 2002 Carnegie.
DIVIDING INTEGERS 1. IF THE SIGNS ARE THE SAME THE ANSWER IS POSITIVE 2. IF THE SIGNS ARE DIFFERENT THE ANSWER IS NEGATIVE.
IGF Hyderabad 2008 Dimensions of Cyber Security & Cyber Crime Michael Lewis, Carnegie Mellon University & Deputy Director, Q-CERT.
Significance of ISO to the Food Industry
IBM Systems Group © 2004 IBM Corporation Nick Jones What could happen to your data? What can you do about it?
Making the System Operational
EIONET European Environment Information and Observation Network Version * * * Quality assurance of Eurowaternet.
Chapter 24 Quality Management.
Test B, 100 Subtraction Facts
Confidential and Proprietary XBRL in Santander Group Munich, May 10th 2007 Confidential and Proprietary.
© 2017 SlidePlayer.com Inc. All rights reserved.