Top 25 Software Programming Errors

Network World — Most IT security woes, from software patching to cyberespionage and cybercrime, can be traced to the devastating effects wrought by the Top 25 programming errors made in software, according to a broad consensus of government and security firms.

These programming errors include improper input validation, improper encoding or escaping of output, failure to preserve SQL query structure (SQL injection), and failure to preserve Web page structure (cross-site scripting). These are among the worst of the worst in the list of the Top 25, published Monday by MITRE Corp. and The SANS Institute, participants in what's called the Common Weakness Enumeration (CWE) project organized by the U.S. Department of Homeland Security's National Cybersecurity Division.

"It's been a three-year project to collect all the things that can go wrong in software architecture, design or code," says Bob Martin, CWE project leader at MITRE, known for its role in federal research projects.

After more than 700 types of problems were identified for CWE inclusion last year, MITRE and SANS asked experts in security organizations, firms and academia to help narrow the list down to the 25 worst. The goal was not only to get industry to focus on the worst software mistakes but also to provide a common vocabulary to address them with training and tools.

Several tools vendors, including Breach Security, Fortify Software, Veracode, Ounce Labs, and Core Security Technologies, are backing the Top 25 and CWE categorization. "This is the first serious attempt at building a taxonomy of software security weaknesses and flaws with an emphasis on practical application of identifying, preventing and fixing or mitigating the issues they pose," said Ivan Arce, CTO at Core Security Technologies in a prepared statement.

In all, about thirty firms and organizations have voiced basic consensus around the Top 25. These supporters include vendors, such as Microsoft, Apple, Red Hat and Oracle; security firms McAfee, Symantec and EMC; the National Security Agency and U.S. Department of Energy; organizations such as the Computer Emergency Response Team and the Open Web Application Security Project; plus academic institutions Purdue University, Kentucky University and the University of California at Davis.

SANS director of research Alan Paller anticipates the impact of the Top 25 list will go beyond simply providing a foundation for better software training and tools or speaking in a common language about software weaknesses. It is likely to work its way into software contract negotiations as well as testing of programmers, he says.

In software procurements, the Top 25 could well become a factor requiring software vendors to certify their software does not include these problems, Paller says. If it turns out software has such flaws, the vendor will have to take on extra work, without cost to the software buyer, to fix them.

Some users say the Top 25 will prove a boon.

"The CWE/SANS Top 25 effort is extremely valuable and will provide many organizations with a tangible way to begin addressing software security problems," said Michael Klosterman, SCADA operations, Western Area Power Association, U.S. Dept. of Energy, in prepared remarks.