http://www.gcn.com/online/vol1_no1/45811-1.html 

By William Jackson
GCN.com
02/13/08

An information technology industry group formed to develop and share 
best practices for secure software development has released its first 
paper, outlining the core practices being used by member companies.

The Software Association Forum for Excellence in Code (SAFECode) was 
announced in October as a way to enhance communications between software 
companies. Many companies have internal programs to improve the quality 
of the code they are producing, but a lack of communications has limited 
their effectiveness, said former White House cybersecurity adviser Paul 
Kurtz, executive director of SAFECode.

The paper [1], titled Software Assurance: An Overview of Current 
Industry Best Practices, is the groups first product.

As the initial step in our efforts, SAFECode has identified the 
assurance best practices that have proven to be effective across its 
member companies, Kurtz said.

Founding members of SAFECode are EMC, Juniper Networks, Microsoft, SAP 
and Symantec.

The group acknowledged the difficulty of prescribing security processes 
across the technology industry. Not surprisingly, there is no single 
method for driving security and integrity into and across the globally 
distributed processes that yield technology products and services, the 
report said. Yet, regardless of the method used, there is a core set of 
best practices for software assurance and security that apply to diverse 
development environments.

?By sharing this information, we hope to encourage the adoption of these 
types of practices by other software developers and respond to the 
growing customer desire for greater visibility into the steps technology 
vendors are taking to continually improve the security of their 
products, Kurtz said.

The paper identifies and explains security best practices and controls 
currently used by SAFECode members:

    * Security training: A prerequisite to coding secure software is for 
      engineers to be knowledgeable about information security issues 
      affecting users.

    * Defining security requirements: Requirements must be defined in 
      the early stages of product development.

    * Secure design: The early design phase must identify and address 
      potential threats to the application and ways to reduce those 
      risks.

    * Secure coding: The product development team must implement secure 
      programming practices.

    * Secure source code handling: The integrity and confidentiality of 
      source code must be protected.

    * Security testing: Specialized validation should be implemented to 
      ensure that security requirements, secure design and coding 
      guidelines are followed.

    * Security documentation: Documentation for users should help 
      customers understand how to optimally configure security controls, 
      and how configuration options could produce potential security 
      vulnerabilities.

    * Security readiness: Prior to releasing a product, the application 
      developer must evaluate, document and assess risks posed by 
      potential security gaps in the product.

    * Security response: An incident response mechanism must be in place 
      to relay reports of security vulnerabilities (exploited or not) 
      after the product is released to the product development or 
      sustaining teams for mitigation.

    * Integrity verification: Products must offer customers methods to 
      verify that the software they have acquired is from their trusted 
      vendor.

    * Security research: Ongoing research should be conducted into new 
      threat vectors and ways to mitigate them.

    * Security evangelism: Leaders in the area of software assurance 
      should promote the use of best practices by discussing their 
      practices and findings in open forums, articles, papers and books.

Vendors who have implemented these best practices have seen dramatic 
improvements in software product assurance and security, Kurtz said.

Beyond development by the vendor, the paper also outlines the 
responsibilities of integrators, who must work with vendors to mitigate 
vulnerabilities that could be introduced when an application is 
integrated into a heterogeneous environment; operators, who must ensure 
that systems remain properly configured and patched and protect them 
from intrusion; and end users, who should report bugs and not introduce 
untrusted software into systems.

[1] http://www.safecode.org/publications/SAFECode_BestPractices0208.pdf 


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn