To write secure code, you do have to think like an attacker

Flask Data provides a one-stop cloud subscription for EDC, data management and statistics.

A security checklist for a developer might make it look like writing secure code is kids stuff, but even kids think like attackers sometimes.

Microsoft are doing some interesting work on SDL – Secure Development Lifecycle. I’m just not sure I agree with dumbing it all down to a checklist and letting developers work without attacker hard hats.

Today,  we got an email out of the blue from a security consulting firm asking for a phone call to discuss  “deep technical information for a client who is buying a threat modeling tool”.   A little poking around clarified  the motivation. First – the proximity to the Microsoft pre-announcement of their SDL 3.0 (Microsoft to Share Its Secure Development Blueprint, Threat Modeling Tool) on September 19, 2008 (the tool will be released some time in November). Then a visit to the GRC (governance risk and compliance) firm’s Web site showed some pre-announcements of their own for a IT risk assessment tool that seemed to have a good deal of similarity in it’s marketing messaging to PTA – Practical Threat Analysis – our free risk assessment tool.

I think they say imitation is a form of flattery but when a competitor (a big one like Microsoft or a smaller one like this GRC consultancy) copies ideas without sharing and attributing (as in Creative Commons sharing and attribution) it is annoying.

Still – it isn’t enough to copy ideas – you do actually have to have some original ideas of your own, as Microsoft definitely do.

Adam Shostack – who is Program Manager at Microsoft for SDL was quoted in Dark Reading that

“This [tool] allows us to start from the point of view of the software engineer… and to pull them through the process that doesn’t require them to think like an attacker or delve into anything they don’t know.”

I don’t think so.

If you want to develop secure code – start thinking like an attacker. If anything, use tremendous resources of the Microsoft Developer community to HELP them delve into stuff they don’t know. The more you learn about how your code can be used (or mis-used) – the better code you will write.

I just don’t think there is any other way to do it.

Related Posts Plugin for WordPress, Blogger...

Flask Data is a technology company with a strong people focus. We are a diverse group of computer scientists and clinical operations specialists based in Israel, the US and India. We are accomplished at providing our customers with the most effective way to achieve high quality clinical data and assure patient safety. There is no single solution that works for every clinical trial. We work hard to understand your unique situation. We work with your team to develop the best solution to achieve high quality clinical data and assure patient safety the same day you engage with patients.

Flask Data – same data data and safety solutions for clinical trials.

Contact us to learn more

Tell your friends and colleagues about us. Thanks!
Share this

Leave a Reply