The SANS Institute and MITRE Corp. issued an update to the CWE/SANS Top 25 Programming Errors List last week, focusing mitigation techniques that could be adopted into the security development lifecycle to help avoid multiple security bugs. But one expert says that while the programming error list helps contribute to improving software development, actually getting companies to implement a more secure software development process is a different story.
Developers can become overloaded, said Chris Wysopal, co-founder and chief technology officer of Veracode Inc. Still, many companies can take smaller steps to introduce security into the software building process, said Wysopal, a secure software coder who helped create the first security research think tank known as L0pht Heavy Industries, which later became part of @stake, a consulting and research boutique that was acquired by Symantec Corp. in 2005.

If you were part of a small software development team, how would you apply some of these programming errors?
Chris Wysopal: I think there's two ways to apply the top 25. When you are doing the testing, before you deliver the software or before you deploy it, you can make sure you have a testing process that can check for all the defects or bugs that are in the top 25. Make sure you have software development tools, a manual process or other technologies that can test for those. Automation is always better. On the developer side, both the architects designing the software and the developers building the software should look at that Monster Mitigation list and make sure they are using those techniques because they will prevent many different flaws from getting into the software. You have to be preventative and you have to test to see if anything got in.

The link for this article located at Search Security is no longer available.