Top 25 software screw-ups

Most IT security woes, from software patching to cyberespionage and cybercrime, can be traced to the devastating effects wrought by the Top 25 programming errors made in software, according to a broad consensus of government and security firms.
##CONTINUE##
These programming errors include improper input validation, improper encoding or escaping of output, failure to preserve SQL query structure (SQL injection), and failure to preserve Web page structure (cross-site scripting). These are among the worst of the worst in the list of the Top 25, published Monday by MITRE Corp. and The SANS Institute, participants in what's called the Common Weakness Enumeration (CWE) project organized by the U.S. Department of Homeland Security's National Cybersecurity Division.

The Top 25 programming errors

1.	Improper input validation
2.	Improper encoding or escaping of output
3.	Failure to preserve SQL query structure (SQL injection)
4.	Failure to preserve Web page structure (cross-site scripting)
5.	Failure to preserve operating system command structure (OS command injection)
6.	Cleartext transmission of sensitive information
7.	Cross-site request forgery
8.	Race condition
9.	Error message information leak
10.	Failure to constrain operations within the bounds of a memory buffer
11.	External control of critical state data
12.	External control of file name or path
13.	Untrusted search path
14.	Failure to control generation of code (code injection)
15.	Download of code without integrity check
16.	Improper resource shutdown or release
17.	Improper initialization
18.	Incorrect calculation
19.	Porous defenses
20.	Use of a broken or risky cryptographic algorithm
21.	Hard-coded password
22.	Insecure permission assignment for critical resource
23.	Use of insufficiently random values
24.	Execution with unnecessary privileges
25.	Client-side enforcement of server-side security
For in-depth definitions about these Top 25 software-programming errors, visit the Web sites of The SANS Institute and MITRE Corp. at www.sans.org and www.mitre.org
SOURCE: SANS and MITRE

"It's been a three-year project to collect all the things that can go wrong in software architecture, design or code," says Bob Martin, CWE project leader at MITRE, known for its role in federal research projects.

Several tools vendors, including Breach Security, Fortify Software, Veracode, Ounce Labs, and Core Security Technologies, are backing the Top 25 and CWE categorization. "This is the first serious attempt at building a taxonomy of software security weaknesses and flaws with an emphasis on practical application of identifying, preventing and fixing or mitigating the issues they pose," said Ivan Arce, CTO at Core Security Technologies in a prepared statement.

In all, about thirty firms and organizations have voiced basic consensus around the Top 25. These supporters include vendors, such as Microsoft, Apple, Red Hat and Oracle; security firms McAfee, Symantec and EMC; the National Security Agency and U.S. Department of Energy; organizations such as the Computer Emergency Response Team and the Open Web Application Security Project; plus academic institutions Purdue University, Kentucky University and the University of California at Davis.

SANS director of research Alan Paller anticipates the impact of the Top 25 list will go beyond simply providing a foundation for better software training and tools or speaking in a common language about software weaknesses. It is likely to work its way into software contract negotiations as well as testing of programmers, he says.

In software procurements, the Top 25 could well become a factor requiring software vendors to certify their software does not include these problems, Paller says. If it turns out software has such flaws, the vendor will have to take on extra work, without cost to the software buyer, to fix them.

Some users say the Top 25 will prove a boon.

"The CWE/SANS Top 25 effort is extremely valuable and will provide many organizations with a tangible way to begin addressing software security problems," said Michael Klosterman, SCADA operations, Western Area Power Association, U.S. Dept. of Energy, in prepared remarks.

-----------------------------
BY Ellen Messmer
Source：Network World