For the U.S., where recent cyber attacks against Google and dozens of other companies have underscored the porousness of computer networks, this is a welcome development.
"We believe that integrity of hardware and software products is a critical element of cybersecurity," The Office of the Director of National Intelligence said in a statement. "Creating more secure software is a fundamental aspect of system and network security, given that the federal government and the nation's critical infrastructure depend on commercial products for business operations. The Top 25 programming errors initiative is an important component of an overall security initiative for our country. We applaud this effort and encourage the utility of this tool through other venues such as cyber education."
Because many cyber threats rely on software vulnerabilities, there's a broad effort to improve computer science education so that programmers become better at writing secure code.
On a phone briefing for reporters, Alan Paller, director of research at the SANS Institute, said that one of the goals of the Top 25 list is to help companies avoid being in the situation faced by Siemens recently.
According to Paller, Siemens in 2008 paid over 100,000 Euros for a software package and found that security wasn't part of the deal. After weeks of negotiations, the company had to pay about 145,000 Euros more to make its custom software secure.
By providing detailed information about common software programming problems, SANS, MITRE and the other security organizations that compiled the list hope that software buyers and software vendors will be able to create contracts that require custom code to be free of the Top 25 errors.
SaaS As Innovation Driver?Software as a service is the clear No. 1 way enterprises consume cloud. InformationWeek's SaaS Innovation Survey reveals three tips to get the most from SaaS: Make it a popularity contest. Have an escape plan. And remember that identity is the new perimeter.