Test the Safety Smarts of Your Developers
How solidly does your development staff write its code? A new testing process could help.
IDG News Service (London Bureau) — How solidly does your development staff write its code? How can you judge the security skills of a potential developer you'd like to hire? A new testing process could help: Amid growing Internet crime enabled in part by faulty programming, the SANS Institute will introduce a series of four exams for developers to test how well they can craft secure code.
The exams will cover C/C++, Java/J2SE, Perl/PHP and .Net/ASP, according to SANS, which runs a computer security training institute. A pilot exam program will start in August in Washington, D.C., and the program will be extended worldwide by year's end.
The exams can identify gaps in a programmer's training, then eventually enable developers to gain GIAC Secure Software Programmer (GSSP) status through the Global Information Assurance Certification (GIAC) program, part of SANS.
The program arose from grassroots need: The IT industry has told SANS it doesn't know how well its programmers write secure code, says Steven Crofts, director of vendor and media programs at SANS. "This is the first large-scale attempt to validate if the people inside an organization know what they are doing," Crofts says.
According to Johannes Ullrich, chief technical officer of the Internet Storm Center, a part of SANS that monitors security vulnerabilities and the Internet’s health, Web applications, such as those used for e-commerce, are one area where programmers often need added training on the security implications of some programming language features.
