 |
privacy |
||
|
Hangout for experimental confirmation and demonstration of software, computing, and networking. The exercises don't always work out. The professor is a bumbler and the laboratory assistant is a skanky dufus.
Blog Feed Recent Items 
The nfoCentrale Blog Conclave nfoCentrale Associated Sites |
2004-11-30Perfecting Secure CodingDana Epp's ramblings at the Sanctuary : Secure Coding - We can't stop trying. 2004-11-13: Dana Epp makes a number of contributions to an appreciation of secure coding. The first is that "information security is about risk mitigation, not risk avoidance." The second is that we should be dealing with attack-pattern types. There are common patterns in the variety of attacks, and developers should be aware of those patterns, The third consideration that Dana raises is about how vulnerabilities can be obscured by the use of higher-level tools that obscure what is going on. Dana refered to higher-level languages, but I think there is far more to it beyond the confines of a given language. I think this is a very big deal. The fourth consideration is out beyond the code. Dana has in mind Microsoft's SD3+C concept: "Secure by Design, Secure by Default, and Secure in Deployment." [The "+C" is for "Communications" and I am not sure how that is supposed to be parsed in conjunction with the preceding list ];<). Michael Howard has a video on the topic where he speaks about communicating the secure way of doing things, whether sample code or otherwise, and being proactive in communicating security and having customers be aware of security ramifications. Dana argues that we must "reduce, redirect or eliminate the impacts of attacks," and apply that to configuration, deployment, and design. In short, look out over the entire lifecycle of a secure product where it is situated for use. Finally, Dana mentions the SCL list, so now I am going to have to find out what that is!Eureka! I know how November 30 was turned into November 31. (Look ahead to December 1 to see what I am talking about.) When you have used one of those idiot list boxes for numbers like 0 to 59 (duh?) or 1 to 12, if the selection stays there, you can end up manipulating it the next time you use the mouse scroll wheel. This apparently happened on returning from the preview of this entry, somehow, except I was on the alert for it. (Lord, I do hate browser-based applications, I really do.)
|
||
|
You are navigating Orcmid's Lair. |
template
created 2004-06-17-20:01 -0700 (pdt)
by orcmid |