Experts reveal top 25 programming errors

An industry panel of more than 30 US and international cyber security organisations has published a list of the top 25 programming security errors, and warned that the next generation of developers is still not being trained to deal with the problems.

The warning came from experts at the Sans Institute, the US Department of Homeland Security's National Cybersecurity Division and the National Security Agency's Information Assurance division, as well as from private companies like Symantec and Microsoft.

"There appears to be broad agreement on the programming errors. Now it is time to fix them," said Sans Institute director Mason Brown.

"First we need to make sure that every programmer knows how to write code that is free of the top 25 errors, and then we need to make sure that every programming team has processes in place to find, fix or avoid these problems, and has the tools needed to verify that their code is as free of these errors as automated tools can verify."

Common errors include making software barriers much less porous, poor resource allocation and insecure interaction between software tools. Just two of the errors were responsible for an estimated 1.5 million web site security breaches last year.

"With the top 25 we can spend less time working with police after the house has been robbed and instead focus on getting locks on the doors before it happens," said Paul Kurtz, a principal author of the US National Strategy to Secure Cyberspace (PDF) and executive director of the Software Assurance Forum for Excellence in Code.