Securing Software Requires Design, Testing, And Improvement

Software makers need to adopt secure development methodologies and make their processes more transparent to assure customers that security is a shared goal, experts told attendees at the RSA Conference in San Francisco last week.

On a panel of vulnerability-assessment firms, software companies, and customers, speakers stressed that software developers should take the initiative, design for security from the start, frequently test their products, and communicate vulnerabilities and risks to the customer. While adding security to the development cycle is an expense, software makers should educate customers about the advantages of their secure software development, the panelists said.

Utilities, for example, do not necessarily know what is a good measure of security for software, so raising the topic with such firms makes security part of the procurement discussion, said panelist Nadya Bartol, senior cybersecurity strategist for the Utilities Telecom Council.

"The dialogue between those who buy software and those who supply software is a fledgling process," Bartol said. "So, for us, it's a question of how do we manage the risk of what we buy and ask the right set of questions?"

The Building Security In Maturity Model (BSIMM) is a good place to start, panelists said. The group behind BSIMM surveyed 67 real software security development processes, encompassing 112 different security activities, and organized them by the most common practices to the most rare. A developer looking to improve its software security process can use the document as a cookbook from which to take popular recipes for security.

[How can software developers build more secure applications? Here are five pitfalls to avoid. See The Five Most Common Security Pitfalls In Software Development.]

Yet establishing a secure methodology is not enough. While the panelists discussed the secure development process, the main focus of the discussion was ways of measuring software security -- not just as a customer requirement, but as an internal control. While developers need to be given clear guidelines for creating secure software, code has to be tested regularly to gauge how well the company is progressing with security, said Steven Lipner, director of software security at Microsoft

"It is not enough to have a process," Lipner said. "You have actually have to implement the process, and know you have implemented it."

In addition, communicating the state of software security is important, but can be conundrum for vendors, said Eric Baise, senior director in the product security office at EMC. Giving too much information about the security testing and state of a product could give attackers a guide of where to look for vulnerabilities, he said.

"The question for me is what characteristics of the software development process that we can measure and publish as a vendor, and share with our customers, that does not not put our customers at risk, but gives them the right information to practice proper risk management," Baise said.

In many ways, the process is similar to healthcare, the panelists concluded. Just because a person exercises does not mean he should not go to the doctor regularly, and just because he has an annual checkup does not mean he can stop exercising.

While software security, and showing that software development is secure, may seem to be a complex task, the security industry has taken on more difficult problems, said Chris Wysopal, co-founder and chief technology officer of Veracode.

"We do measure security, and if someone wants to see the third-party report for the security of an infrastructure, I would argue that that is more complex than the security of a single product," Wysopal said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.