For the U.S., where recent cyber attacks against Google and dozens of other companies have underscored the porousness of computer networks, this is a welcome development.
"We believe that integrity of hardware and software products is a critical element of cybersecurity," The Office of the Director of National Intelligence said in a statement. "Creating more secure software is a fundamental aspect of system and network security, given that the federal government and the nation's critical infrastructure depend on commercial products for business operations. The Top 25 programming errors initiative is an important component of an overall security initiative for our country. We applaud this effort and encourage the utility of this tool through other venues such as cyber education."
Because many cyber threats rely on software vulnerabilities, there's a broad effort to improve computer science education so that programmers become better at writing secure code.
On a phone briefing for reporters, Alan Paller, director of research at the SANS Institute, said that one of the goals of the Top 25 list is to help companies avoid being in the situation faced by Siemens recently.
According to Paller, Siemens in 2008 paid over 100,000 Euros for a software package and found that security wasn't part of the deal. After weeks of negotiations, the company had to pay about 145,000 Euros more to make its custom software secure.
By providing detailed information about common software programming problems, SANS, MITRE and the other security organizations that compiled the list hope that software buyers and software vendors will be able to create contracts that require custom code to be free of the Top 25 errors.
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
2017 State of IT ReportIn today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.