Software Assurance Forum for Excellence in Code - Build Security In
Software Assurance Forum for Excellence in Code - Build Security In
Software Assurance Forum for Excellence in Code - Build Security In
- No tags were found...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Software</strong> <strong>Assurance</strong> <strong>Forum</strong> <strong>for</strong><strong>Excellence</strong> <strong>in</strong> <strong>Code</strong>Stacy SimpsonMarch 1, 2011
Challenge<strong>In</strong>dividual companies are implement<strong>in</strong>g better methods <strong>for</strong>develop<strong>in</strong>g and deliver<strong>in</strong>g more secure software, hardwareand servicesBUT<strong>In</strong>dustry lacked a common framework or trusted <strong>for</strong>um toadvance or share these ef<strong>for</strong>ts
Who We AreThe <strong>Software</strong> <strong>Assurance</strong> <strong>Forum</strong> <strong>for</strong> <strong>Excellence</strong> <strong>in</strong><strong>Code</strong> (SAFE<strong>Code</strong>) is a global, <strong>in</strong>dustry-led ef<strong>for</strong>tto identify and promote best practices <strong>for</strong>develop<strong>in</strong>g and deliver<strong>in</strong>g more secure andreliable software, hardware and services
MissionSAFE<strong>Code</strong>’s MissionAs a center of excellence <strong>for</strong> vendor software assurance practices,SAFE<strong>Code</strong> unites subject matter experts with unparalleled experience <strong>in</strong>manag<strong>in</strong>g complex global processes <strong>for</strong> software sourc<strong>in</strong>g, developmentand delivery to:1.Foster a trusted exchange of <strong>in</strong>sights that advance software assurancepractices2.Encourage broad <strong>in</strong>dustry adoption of proven software security, <strong>in</strong>tegrityand authenticity practices3.Drive clarity <strong>for</strong> customers and other key stakeholders on vendorsoftware assurance practices to help empower them to better manage risk4
SAFE<strong>Code</strong>’s View of<strong>Software</strong> <strong>Assurance</strong><strong>Software</strong> <strong>Assurance</strong>: Confidence that software, hardware andservices are free from <strong>in</strong>tentional and un<strong>in</strong>tentional vulnerabilitiesand that the software functions as <strong>in</strong>tended.<strong>In</strong> practice, software vendorstake action <strong>in</strong> three key,overlapp<strong>in</strong>g areas to achievesoftware assurance—security, authenticity and <strong>in</strong>tegrity.<strong>Security</strong>ASSURANCEAuthenticity<strong>In</strong>tegrity
Our Work to Date<strong>Security</strong>Secure <strong>Software</strong>DevelopmentTra<strong>in</strong><strong>in</strong>gASSURANCEAuthenticity<strong>In</strong>tegrity<strong>Software</strong> <strong>In</strong>tegrityControls<strong>Software</strong> <strong>In</strong>tegrityFramework
<strong>Software</strong> <strong>Assurance</strong>:<strong>Security</strong><strong>Security</strong>: <strong>Security</strong> threats to the software are anticipated and addresseddur<strong>in</strong>g the software’s design, development and test<strong>in</strong>g through secureeng<strong>in</strong>eer<strong>in</strong>g practices. This requires a focus on code quality and functionalrequirements to reduce un<strong>in</strong>tentional vulnerabilities <strong>in</strong> the code.<strong>Security</strong>ASSURANCEAuthenticity<strong>In</strong>tegrity
Latest ReleaseDownload Todayatwww.safecode.org• ―Fundamental Practices <strong>for</strong> Secure<strong>Software</strong> Development: A Guide to theMost Effective Secure DevelopmentPractices <strong>in</strong> Use Today‖• The 2 nd Edition is here!
Key Authors• Mark Belk, Juniper Networks• Matt Coles, EMC Corporation• Cassio Goldschmidt, Symantec Corp.• Michael Howard, Microsoft Corp.• Kyle Randolph, Adobe Systems <strong>In</strong>c.• Mikko Saario, Nokia• Reeny Sondhi, EMC Corporation• Izar Tarandach, EMC Corporation• Antti Vähä-Sipilä, Nokia• Yonko Yonchev, SAP AG
What’s New• What’s New?• It grew from 19 pages to 51 pages!• Ref<strong>in</strong>ed focus to design, development and test<strong>in</strong>g• Expanded and updated the guidance and references• Added Common Weakness Enumeration (CWE) references• Added Verification guidance
Secure Design Pr<strong>in</strong>ciples• Secure Design Pr<strong>in</strong>ciples‣ Threat Model<strong>in</strong>g‣ Use Least Privilege‣ Implement Sandbox<strong>in</strong>g
Secure Cod<strong>in</strong>g Practices• Secure Cod<strong>in</strong>g Practices‣ M<strong>in</strong>imize Use of Unsafe Str<strong>in</strong>g and Buffer Functions‣ Validate <strong>In</strong>put and Output to Mitigate CommonVulnerabilities‣ Use Robust <strong>In</strong>teger Operations <strong>for</strong> Dynamic MemoryAllocations and Array Offsets‣ Use Anti-Cross Site Script<strong>in</strong>g (XSS) Libraries‣ Use Canonical Data Formats‣ Avoid Str<strong>in</strong>g Concatenation <strong>for</strong> Dynamic SQL Statements‣ Elim<strong>in</strong>ate Weak Cryptography‣ Use Logg<strong>in</strong>g and Trac<strong>in</strong>g
TechnologyRecommendations• Technology Recommendations‣ Use a Current Compiler Toolset‣ Use Static Analysis Tools
Change language