A Technical History of the SEI

Secure Coding
The Challenge: Preventing Software Vulnerabilities
Software vulnerabilities open the Department of Defense, other federal agencies, and businesses
to attacks that could compromise their systems’ integrity or expose or modify their critical information.
Software vulnerabilities also put our nation’s critical infrastructure at risk. Successful exploitation
of these vulnerabilities has severe consequences: financial loss, loss or compromise of
sensitive data, damage to critical systems, and loss of productivity.
The traditional, reactive approach of mitigating software
vulnerabilities after the product’s release is expensive
and leaves software users exposed and, frequently, compromised
until a patch is released—if customers can
keep up with patches at all. Some vulnerabilities are
never patched. Preventing the introduction of software
vulnerabilities during software development is a proactive,
efficient way to reduce risk before the software is
ever deployed.
A Solution: Secure Coding Standards
and Practices
The CERT/CC has analyzed and cataloged thousands of
software vulnerabilities and discovered that many share
the same common errors. Deficient or error-prone constructs
in the programming languages were frequently a
factor. In 2003, the SEI formed the Secure Coding Initiative,
whose goals were to enumerate errors in coding
that can result in software vulnerabilities and to develop
and promote mitigation strategies. 35 By engaging more
than a thousand security researchers, language experts,
and software developers, the initiative produced secure
coding standards for common software development
languages such as C and Java. These standards guide
programmers to avoid coding errors that lead to vulnerabilities;
the standards also provide solution examples.
Having standards encourages programmers to follow
uniform coding rules and guidelines determined by the
requirements of a project or organization, rather than by
personal coding preferences or familiarity.
The View from Others
We are thrilled to be the first company
to deliver a CERT C compliant
programming checker as we believe
this new standard will play a
significant role in the development
of higher quality systems that are
more robust and more resistant to
attack.
– Ian Hennell, LDRA
Operations Director
[Businesswire 2008]
I’m an enthusiastic supporter of the
CERT Secure Coding Initiative.
Programmers have lots of sources
of advice on correctness, clarity,
maintainability, performance, and
even safety. Advice on how specific
language features affect security
has been missing. The CERT ® C Secure
Coding Standard fills this
need.
– Randy Meyers,
Chairman of ANSI C
[Seacord 2013]
35 Details about the work of the Secure Coding Initiative can be found at http://www.cert.org/securecoding.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 177
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.