NSA Veteran Speaks On Software Security
May 26th, 2008 Anthony TowryAusCERT has concluded and the boys over at Risky Business Podcast have posted quite a few one on one interviews with some of the speakers. One such interview is with Brian Snow, former Technical Director of IAD for the National Security Agency.
Mr. Snow talks about some of the challenges that software development firms face when considering the gravity of the risks being accepted by not weaving security into the SDLC. Snow goes on to say that developers participating in a given project cannot be objective enough to accurately determine it's defects.
I can go with Snow on the result, but not on the cause. Most developers aren't in any position to determine whether or not their code is secure. That said, it's not a result of being too close to the product. It's that software security training never comes up for most developers. Not in college, not on the job, not on their own. It never shows up.
I believe that Developers CAN learn to locate issues in their own code. The act of writing tests and rolling boundary cases through an application isn't a completely foreign concept. Security bugs are a defect like anything else. Nothing magical or mysterious, just another class of software defect that needs to be addressed and given the proper amount of attention to prevent.
Mr. Snow goes on though to talk about issues that absolutely are at the heart of the problem, such as the rush to market and the inability of firms to consider targeted malice. Business unit pressure for time and costs often squeeze out the feature of adequate security testing.
There's nothing really earth shattering about this talk, but I get a little excited when application security is getting air time.
