While most developers are proficient in several languages, today's economic climate coupled with advances in technology has meant that oftentimes developers need to pick up a new language quickly. And although most developers are typically fluent in the security issues surrounding their specific languages and do their best to ensure that the code they produce is secure, security vulnerabilities in new language environments may not be as well understood.
Enter Fortify, a software security company that has organized security issues by both vulnerability category and by language so developers can easily ascertain the types of errors that have an impact on security.
]]> "By better understanding how systems fail, developers will better analyze the systems they create, more readily identify and address security problems when they see them, and generally avoid repeating the same mistakes in the future," the company explains.A Taxonomy of Coding Errors that Affect Security borrows terminology from biology: vulnerability categories (for instance, Cross Site Scripting and Buffer Overflow) are referred to as phyla, and collections of vulnerability categories that share the same theme are referred to as kingdoms (for instance, Input Validation and Representation).
According to the site, vulnerability phyla are classified into "seven plus one" pernicious kingdoms presented in the order of importance to software security:
- Input Validation and Representation
- API Abuse
- Security Features
- Time and State
- Errors
- Code Quality
- Encapsulation
- *. Environment
Important to note, issues 1 - 7 are associated with security defects in source code, while 8 describes security issues outside the actual code.
Languages covered include Cold Fusion, C/C++, C#/VB.NET/ASP.NET, HTML, Java/JSP, Javascript, PHP, PLSQL/TSQL, Visual Basic/VB Script/ASP, Webservices, and XML.
A Taxonomy of Coding Errors that Affect Security was developed by the Fortify Software Security Research Group and Dr. Gary McGraw, and complete descriptions with source code examples can be found here.
]]>