The Quest For Secure Code

[Tami]

The Quest For Secure Code
By Mary Kirwan

Mary Kirwan is a lawyer on three continents, a writer and IT security expert. She is currently completing a book on IT security for industry, for broad release in 2004.

We live in a world hugely reliant on IT and interconnected, distributed systems.

Yet, extraordinarily, much of the software we rely on to run our businesses, and increasingly our day-to-day lives, is riddled with bugs. Bugs only too easy to exploit — with often-catastrophic results.

Recently, several airports in Southern California had to shut down, and at least one pilot had to take evasive action when airport guidance software malfunctioned. A bug in a Microsoft system combined with human error has been blamed for the episode.

The release of Microsoft Service Pack 2 for Windows XP (SP2), with its various security features, is a mere drop in the ocean and unlikely to result in dramatic change; especially when users of older versions of the Windows operating system must purchase the upgrade.

The U.S.-based SANS Institute, a respected research and education organization, publishes a 'Top 20 Internet Security Vulnerabilities' list. I spoke with Alan Paller, director of research at the SANS Institute, about security, software quality issues and whether legislation is needed to bring about change. He expressed frustration with the fact that everything on the vulnerability list is a result of poor coding, testing and sloppy software engineering. These are not 'bleeding edge' problems, as an innocent bystander might easily assume. Technical solutions exist to them all, but they are simply not implemented.

One of the fixes in SP2 deals with buffer overflows, for example, a problem responsible for many attacks. They have been a known phenomena for over 20 years, but vendors are only getting around to doing something about it now.

Who is to blame?

In Paller's mind, the IT schools bear some responsibility, as teachers 'hate teaching security'. They lean towards teaching coding 'elegance' and reliability in an old sense, with little attention paid to resilience.

Paller believes there is a need to evaluate programmers and create certifications and examinations to ensure a baseline level of competency.

He pointed out that even 'Centres of Excellence in Cybersecurity' — universities sponsored by the U.S. government to carry out cybersecurity research — have no mandatory security courses.

Then I spoke with Dean Randal Bryant, Dean of the School of Computer Science at Carnegie Mellon University (CMU), one of the top academic institutions in the U.S. He is the happy recipient of $20-million from The Bill and Melinda Gates Foundation to help build a new computer science building, the Gates Centre for Computer Sciences. The university has long had close ties with Microsoft. I asked him if schools such as CMU could do more to produce graduates with quality code writing acumen.

He said they do try to teach it, but are limited in the undergraduate programme as to what they can achieve. He said, however, with admirable candour, that they could probably "do better," and were committed to trying.

Professor Jeannette Wing, Head of the Computer Science Department at CMU and a member of the Trustworthy Computing Academic Advisory Board to Microsoft, reiterated that CMU does try to teach good software engineering practices. But she fears many students rapidly abandon what they have learned when they go into the workplace, as their ability to deliver a quality product is not valued.

She said that even mandates to require courses in secure coding would only go so far. The practical realities are that newly minted programmers and software engineers will do what the company tells them to do, even if that means learning bad habits and writing sloppy code, just to get the job done and earn their bonus.

According to Professor Wing, this prevailing attitude amongst employers must change or we can expect little in the way of improvement.

But even if companies writing custom code clean up their act, this fact alone will do little to help millions of companies, especially SMEs that rely on off-the-shelf software. They can do little to ease their plight. Their ability to tweak product is grossly limited by the terms of their software licences, and they don't expect any concessions from the big guys.

What are the software vendors doing to fix the problem?

According to Professor Wing, Team Microsoft is indeed sincere in its desire to build better quality widgets. The programmers understand they are an important component of a larger system, and they don't want to be the 'weak link'.

She said that at Microsoft interviews, aspiring programmers are examined on their ability to recognize buffer overflows, and told they will be evaluated on their ability to deliver quality code - and identify and fix bugs.

However, it is 'an enormous problem" that can't be fixed easily.

Compounding it, according to Professor Wing, is the fact Microsoft has legacy systems to maintain and must ensure backwards compatibility.

I put it to her that sceptics might be a tad cynical about such pure motives when one looks to the fact that Microsoft sells solutions to problems they help create, such as patch management services.

She suggested that Microsoft is well aware of the paradoxes in its positioning, but wants to show customers it is "doing something" to deal with the gnarly problem, however quixotic the result.

What are the incentives for software vendors to get it right?

Of course, without any liability or any binding obligation to deliver quality code, it is hard to imagine any economic incentive to do so, until customers stage their own version of Mutiny on the Bounty.

However, regulators around the world are concerned about the role buggy code plays in exposing critical information systems to cyber attack in dangerous times.

In past years, the EU Commission has tried to mandate security requirements for software and hardware, but in the face of intense lobbying from the software industry, had to climb down. Similar suggestions have been made in the U.S. by respectable scientific bodies and government entities, but have met the same fate.

Alan Paller pointed out that the software vendors spend in excess of $100-million in Washington DC alone lobbying against change, are very good at it and get results.

Why don't they just do the right thing, I asked, stating what seemed to be the obvious.

He believes my brethren in the legal profession are to blame. They are concerned about liability.

What liability I asked? They have none.

Paller said that it is the old floodgates argument. Give us an inch, and we will take a mile. Admit that writing secure code is possible (right now the industry will say 100-per-cent pure code is impossible, hence they should not be beholden to try at all), and they are on the slippery slope to litigation hell.

Thus, they have vociferously fought suggestions that they be at least held accountable for known but undisclosed defects, even with a cap placed on potential damages. They have also successfully skirted the rules around unfair terms in consumer contracts, although their position in that respect is less secure in Europe.

Meanwhile, customers pay hefty support fees for products that in many instances contain known defects.

Where will it all end?

In the United States, Rep. Adam Putnam (R-Fla.), chairman of the House subcommittee in charge of cybersecurity policy, believes that "we need a pride in security campaign in this country," and that time is running out to address the issues before disaster strikes.

He is widely expected to table new legislation to kick-start the process.

Industry will inevitably fight back and argue that self-regulation is working. Around and round the merry go round goes.

Alan Paller believes that existing legislation such as the U.S. Federal Information Security Management Act of 2002 (FISMA) will have a big effect on software quality issues as the penny drops that almost every major software vendor is affected by it.

The FISMA rules require that US Federal government agencies take security seriously and oversee contractors and other third parties responsible for federal data. The agencies must also set 'minimally acceptable system configuration requirements' for systems they connect.

Paller believes that the tough FISMA rules, if enforced, will result in U.S. federal government agencies demanding delivery of safe FISMA compliant products from the vendors.

As Paller points out, the US government spends $40-billion on IT annually, and everyone wants a piece of that particular pie.

At the end of the day, maybe Paller is right and only greed will put it all right.

It wouldn't be the first time, and it won't be the last.

source