Everhart, Glenn From: Sweren, Scott Sent: Wednesday, January 13, 1999 11:15 AM To: Trevey, Brian; Everhart, Glenn Subject: FW: Learning security [SUMMARY] FYI Scott Sweren Information Security (302) 985-8989 - voice (302) 985-8638 - fax (888) 608-9467 - pager scottsweren@firstusa.com -----Original Message----- From: Aleph One [SMTP:aleph1@UNDERGROUND.ORG] Sent: Thursday, December 17, 1998 2:22 PM To: BUGTRAQ@NETSPACE.ORG Subject: Re: Learning security [SUMMARY] This is a summary of the many (and I do mean many) replies. Thanks to everyone that contributed. Why do programmers write unsafe code? There is no curriculum that addresses computer security in most schools. Programming books/classes do not teach secure/safe programming techniques. No one uses formal verification methods. C is an unsafe language. The standard C library string functions are unsafe. Programmers do not think ‘multiuser’. Programmers are human. Humans are lazy. Most programmers are simply not good programmers. Most programmers are not security people. Most security people are not programmers. Most computer security models suck. Lots of legacy code that is broken. Consumers don’t care about security. Cost in extra developing time. Cost in extra testing. What secure programming resources are available? Conferences: SANS ID’99 “How Attackers Break Programs, and How to Write Programs Securely” by M. Bishop. < http://www.sans.org/ > Classes: UC David ECS153 “Introduction to Computer Security” (M. Bishop) EnGarde’s Secure Programming Tutorial < http://engarde.com/tutorials/tutorials_secprog.html > Articles: “Designing Secure Software” by Peter Galvin < http://www.sunworld.com/sunworldonline/swol-04-1998/swol-04-security.html > “The Unix Secure Programming FAQ” by Peter Galvin < http://www.sunworld.com/sunworldonline/swol-08-1998/swol-08-security.html > “A Lab engineers check list for writing secure Unix code” by AUCERT < ftp://ftp.auscert.org.au/pub/auscert/papers/secure_programming_checklist > “How to find security holes” by Kragen Sitaker < http://www.dnaco.net/~kragen/security-holes.txt > < http://www.dnaco.net/~kragen/security-holes.html > “setuid - checklist for security of setuid programs” < http://www.homeport.org/~adam/setuid.7.html > “perlsec - Perl security” < ftp://ftp.digital.com/pub/plan/perl/CPAN/doc/manual/html/pod/perlsec.html > Papers: “Robust Programming” by M. Bishop < http://seclab.cs.ucdavis.edu/~bishop/classes/ecs153-98-winter/robust.html > < http://seclab.cs.ucdavis.edu/~bishop/classes/ecs153-98-winter/Pdf/robust.pdf > < http://seclab.cs.ucdavis.edu/~bishop/classes/ecs153-98-winter/Postscript/robust.ps > “How to Write a Setuid Program” by M. Bishop < http://seclab.cs.ucdavis.edu/~bishop/scriv/1986-loginv12n1.ps > “Security Code Review Guidelines” By Adam Shostack < http://www.homeport.org/~adam/review.html > Talks & Tutorials: “Writing Safe Privileged Programs” by M. Bishop < http://seclab.cs.ucdavis.edu/~bishop/scriv/1997-ns97.pdf > < http://seclab.cs.ucdavis.edu/~bishop/scriv/1997-ns97.ps > “UNIX Security: Security in Programming” by M. Bishop < http://seclab.cs.ucdavis.edu/~bishop/scriv/1996-sans-tut.pdf > < http://seclab.cs.ucdavis.edu/~bishop/scriv/1996-sans-tut.ps > “Shifting the Odds: Writing (More) Secure Software” by Steve Bellovin < http://www.research.att.com/~smb/talks/odds.pdf > < http://www.research.att.com/~smb/talks/odds.ps > Books on writing secure software: “Practical Unix and Internet Security” from O’Reilly & Associates Chapter 22 “Writing Secure SUID and Network Programs” < http://www.oreilly.com/catalog/puis/ > Books on writing bug free software: “Writing Solid Code” by Steve Maguire < http://www.amazon.com/exec/obidos/ASIN/1556155514/ref=sim_books/002-7935989-4651662 > “Code Complete” by Steve McConnel < http://www.amazon.com/exec/obidos/ASIN/1556154844/o/qid=913914934/sr=2-1/002-7935989-4651662 > -- Aleph One / aleph1@underground.org http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01