The United States Department of Homeland Security unveiled a detailed guide to help software developers and vendors avoid common security errors in their applications.
Homeland Security’s Cyber-Security Division worked with the security training and research organization SANS Institute and the non-profit technology research company Mitre to create a list of common software vulnerabilities along with a scoring system to prioritize flaws, a risk analysis framework to evaluate the seriousness of the flaws and a list of top 25 dangerous software errors. The guide was released June 27 and is intended to help organizations hold their developers and vendors accountable for problems in the application.
The CWE (Common Weakness Enumeration) list contains high-level overviews and examples of widespread software vulnerabilities as well as consequences, likely attack vectors and potential ways to mitigate attacks. Unlike other lists of common vulnerabilities, CWE 2.0 provides detailed explanations of the exact programming errors to avoid.
“This will allow agencies and organizations to take a tactical approach to addressing vulnerabilities,” Will Pelgrin, director of the Multi-State Information Sharing and Analysis Center, a collaborative cybersecurity effort that includes state and local governments, said on a conference call.
The CWSS (Common Weakness Scoring System) version 0.8 will assign a standard score to the software, giving organizations a clear understanding of its security. From a vendor standpoint, the company will be motivated to address the common issues to bring up the score, or customers won’t be willing to buy the software.
From a customer standpoint, they can look at the scores and prioritize which software vulnerabilities need to be addressed. The scoring system considers potential technical and business impacts of the weakness when it is exploited, the operational layer the attacker may access, the effectiveness of available defenses, the privilege level needed to access the vulnerability, and the likelihood an exploit.
Basic vulnerabilities such as SQL injection and cross-site scripting still account for a majority of security flaws in Web applications, Rafal Los, a security evangelist at HP, recently told eWEEK. Organizations are finally realizing how important it is to regularly check their code for programming errors, and investing in technology to help them find those flaws, Los said.
The CWRAF (Common Weakness Risk Analysis Framework) will provide a way for organizations to evaluate risk as they pertain to the industry. The framework will include “vignettes” for specific industries highlighting which programming errors have the potential to affect them the most. For example, a security flaw in an application may be a bigger threat to the banking industry because of specific technology being used than in manufacturing, which might not use it.
“I see this as a management tool to focus the team on things that are the greatest threat and that have the greatest consequences,” Pelgrin said.
The DHS effort focused on applications and software in this voluntary guide, which is timely considering the string of high-profile Web attacks in recent months. Many of the attacks used basic vulnerabilities, such as SQL injection, to compromise the site. These attacks have highlighted how costly software flaws can be, with attackers relying on common bugs to steal credit card information and login credentials from various government and banking sites.
The SANS Institute also released its annual list of the top 25 Web vulnerabilities. The most significant flaws were the ones that could be exploited by SQL injection attacks, according to the list. In a SQL injection, attackers insert database commands into a form on the Web page and trick it to executing them. Other top vulnerabilities include operating system command injection, classic buffer overflow, and cross-site scripting.
SANS Institute and Mitre collaborated with software security experts in the United States and Europe to create the list.