February/March Edition of the Secure Coding Newsletter
This newsletter provides language standards updates and introduces Bob Schiela, the new head of the Secure Coding Team.
Our New Certificate Programs Help You Improve Your Software's Security
Our new certificate programs, one for C and C++ the other for Java, enable software developers to eliminate security vulnerabilities before products ship.
New Secure Coding in Java Course
Fred Long and David Svoboda have built a four-day course on Secure Coding in Java, based on the CERT Oracle Coding Standard for Java.
Research into API Usability and Security
We're studying how to design APIs that are usable by programmers for developing secure code.
Compiler-Enforced Buffer Overflow Elimination
The Compiler-Enforced Buffer Overflow Elimination tool is a research prototype that prevents buffer overflows in multithreaded code and has additional features not found in other memory safety mechanisms.
Secure Coding in C and C++ Course
We offer this four-day course to help you identify and prevent common programming errors in C and C++, plus understand how these errors can lead to code that is vulnerable to exploitation.
Our Mission: We reduce the number of vulnerabilities to a level that can be fully mitigated in operational environments. This reduction is accomplished by preventing coding errors or discovering and eliminating security flaws during implementation and testing.
The CERT Division has been extremely successful in the development of secure coding standards, which have been adopted at corporate levels by companies such as Cisco and Oracle, and the development of the Source Code Analysis Laboratory (SCALe), which supports conformance testing of systems against these coding standards. The success of the secure coding standards and SCALe contributed to the impetus for including software assurance requirements in the National Defense Authorization Act (NDAA) for Fiscal Year 2013.
Eliminating vulnerabilities during development can result in a two to three orders-of-magnitude reduction in the total cost of repairing the code versus making the repairs afterwards. To achieve these goals, it is necessary to determine how to develop verifiably secure code within budget and on schedule.