Powered by InformationWeek Business Technology Network
Topics:
Security
The List Developers Need To Know
There seems an almost endless number of mistakes that can be made to make applications susceptible to attack. Fortunately, the list of programming mistakes that really matter in today's risk environment is relatively small. Here's that list. The list below was published today by the SANS Institute. The list is based on a consensus gathered by 30 U.S. and international security organizations, including US-CERT, the NSA, and several security vendors. There's no surprises in this list, other than the fact that it was possible for so many organizations to come to a consensus and agree on the top 25 mistakes developers make. What is surprising, however, is that after 20 years since the first widespread Internet attack -- the Morris Worm in 1998 to today's rampant number of security breaches and fraud -- so many junior varsity programming errors are still rampant. There's no excuse for unvalidated inputs, yet there's that programming mistake at the top of the list. Nor is there much of an excuse for the breakdown of SQL Query structure, or the sending of sensitive data in cleartext. Hard-coding of passwords directly into the application, anyone? Ridiculous. It's also on the list. Here they are, the programming gaffes the industry should take every effort possible to eradicate:
« Microsoft's Fear Of BitTorrent | Main | MojoPortal A Solid CMS Option For .NET Shops » |
| Sign Up Now For InformationWeek News Alerts |