# Presentation: 449287

## Secure Coding Initiative

**Jason A. Rafail**
**Monday, May 14****th****, 2007**

## Increasing Vulnerabilities

- Reacting to vulnerabilities in existing systems is not working

## Vulnerabilities Cost Vendors

- A study based on real vulnerability announcements in 1999-2004 revealed: an average **drop** of  the concerned vendor's **stock price**  of **0.6%** after each vulnerability announcement
*Tehang / Wattal, Carnegie Mellon Univerisity, 2004*
*"Impact of Software Vulnerability Announcements on the Market Value of Software Vendors – an Empirical Investigation"*
- ... not to mention the damage to the vendor's reputation

## Most Vulnerabilities caused by Programming Errors

- 64% of the vulnerabilities in NVD in 2004 are due to programming errors
- 51% of those due to classic errors like buffer overflows, cross-site-scripting, injection flaws
*Heffley/Meunier (2004): **Can Source Code Auditing Software Identify Common Vulnerabilities and Be Used to Evaluate Software Security?*
- Cross-site scripting, SQL injection at top of the statistics (CVE, Bugtraq)  in 2006
- "We wouldn't need so much network security if we didn't have such bad software security"*	**  --Bruce Schneier*

## Unexpected Integer Values

- Unexpected values are a common source of software vulnerabilities (even when this behavior is correct).

## Fun With Integers

**char x, y; ****x = -128; ****y = -x; **
**if (x == y) puts("1"); ****if ((x - y) == 0) puts("2"); **
**if ((x + y) == 2 * x) puts("3"); **
**if (x != -y) puts("4"); **

## CERT Vulnerability Analysis

## CERT Secure Coding Initiative

- Work with software developers and software development organizations to eliminate vulnerabilities resulting from coding errors before they are deployed.
- Reduce the number of vulnerabilities to a level where they can be handled by computer security incident response teams (CSIRTs)
- Decrease remediation costs by eliminating vulnerabilities *before* software is deployed

## Overall Thrusts

- Advance the state of the practice in secure coding
- Identify common programming errors that lead to software vulnerabilities
- Establish standard secure coding practices
- Educate software developers

## Current Capabilities

- Secure Coding in C and C++
- Addison-Wesley book
- Training
- Secure coding web pages_[www.cert.org](http://www.cert.org/secure-coding/)__[/secure-coding/](http://www.cert.org/secure-coding/)_
- Secure string and integer library development
- Involvement in international standards activities:
- ISO/IEC JTC1/SC22/WG14 C programming language international standardization working group
- ISO/IEC JTC1/SC22 OWG Vulnerabilities

## Current and Planned Efforts

- CERT Secure Coding Standards
- C and C++ Programming Language
- Community development process
- Training courses
- Direct offerings
- Partnered with industry
- Software Validation and Verification
- Partner with software tool vendors to validate conformance to secure coding standards
- Partner with software development organizations to evaluate the application of secure coding standards

## CERT Secure Coding Standards

- Identify coding practices that can be used to improve the security of software systems under development
- Specific objectives include
- avoiding undefined behaviour
- avoiding implementation defined behaviour
- improving clarity for review and maintenance
- providing a consistent style across a program or set of programs
- avoiding common programmer errors
- incorporating good practice, particularly with regard to ‘future proofing’

## Scope

- The secure coding standards proposed by CERT are based on documented standard language versions as defined by official or *de facto* standards organizations.
- Secure coding standards are under development for:
- C programming language (ISO/IEC 9899:1999)
- C++ programming language (ISO/IEC 14882-2003 )
- Applicable technical corrigenda and documented language extensions such as the ISO/IEC TR 24731 extensions to the C library are also included.

## Secure Coding Web Site (Wiki)

**Secure Coding Web Site (Wiki)**

## Rules and Recommendations

- Coding practices are classified as either rules or recommendations
- Rules need to be followed to claim compliance.
- Recommendations are guidelines or suggestions.

## Rules

- Coding practices are defined as rules when
- Violation of the coding practice will result in a security flaw that may result in an exploitable vulnerability.
- There is an enumerable set of exceptional conditions (or no such conditions) where violating the coding practice is necessary to ensure the correct behavior for the program.
- Conformance to the coding practice can be verified.

## Recommendations

- Coding practices are defined as recommendations when
- Application of the coding practice is likely to improve system security.
- One or more of the requirements necessary for a coding practice to be considered as a rule cannot be met.

## Community Development Process

- Published candidate rules and recommendations at:
- _[www.securecoding.cert.org](http://www.securecoding.cert.org/)__ _

- Rules are solicited from the community

- Threaded discussions for public vetting

- Candidate coding practices are moved into a secure coding standard when consensus  is reached

- Secure coding standards development is a community effort

## Priorities and Levels

- L3 P1-P4

- L1 P12-P27

- L2  P6-P9

- High severity, likely,
- inexpensive to repair flaws

- Low severity, unlikely,
- expensive to repair flaws

- Med severity, probable, med cost to repair
- flaws

## Applications

- Establish secure coding practices within an organization
- may be extended with organization-specific rules
- cannot replace or remove existing rules
- Train software professionals
- Certify programmers in secure coding
- Establish base-line requirements for software analysis tools
- Certify software systems

## Questions

**Questions**

## For More Information

**Visit CERT****®**** web sites:    **
- _[http://www.cert.org/secure-coding/](http://www.cert.org/secure-coding/)_
- _[https://www.securecoding.cert.org/](https://www.securecoding.cert.org/)_
**Contact Presenter**
- Jason A. Rafail      jrafail@cert.org
**Contact CERT Coordination Center:**
- Software Engineering Institute
- Carnegie Mellon University
- 4500 Fifth Avenue
- Pittsburgh PA 15213-3890
- USA
- Hotline**: +1 412 268 7090****	**
**CERT/CC personnel answer 24x7, 365 days per year**
- Fax:       **+1 412 268 6989**
- Mailto: **cert@cert.org**