I read a recent press release in which a security vendor (names removed to both 
protect the innocent along with the fact that it doesn't matter for this 
discussion ) partnered with a prominent outsourcing firm. The press release was 
carefully worded but if you read into what wasn't said, it was in my opinion 
encouraging something that folks here tend to fight against. The outsourcing 
firm would use this tool in an auditing capacity for whatever client asked for 
another service but it would not become part of the general software 
development lifecycle for all projects. 

- It didn't mention any notion of all developers within the outsourcing firm 
having tools on their desktop to audit as they develop

- It didn't mention any notion of training all developers within the 
outsourcing firm on secure coding practices

- It did hint that one time periodic audits from a metrics perspective would be 
useful to clients that wanted this new service but didn't say how developers 
would be able to iterate on the code and reduce bugs. I would think that any 
offering that removes developers from the feedback loop while developing code 
and instead focusing on management-oriented (non-developer metrics) is 
generally a bad idea.

- It didn't mention even how many folks from their security practice were to 
receive training in secure coding practices

- Should we think of security as an extra "service" or something that should be 
incorporated into the SDLC in a consistent sustainable manner?

I am far offbase and drunk too much of Ken Van Wyk's Kool-aid from his 
wonderful training course by thinking that this type of initiative does more 
harm than good?

This communication, including attachments, is
for the exclusive use of addressee and may contain proprietary,
confidential and/or privileged information.  If you are not the intended
recipient, any use, copying, disclosure, dissemination or distribution is
strictly prohibited.  If you are not the intended recipient, please notify
the sender immediately by return e-mail, delete this communication and
destroy all copies.

Secure Coding mailing list (SC-L) SC-L@securecoding.org
List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l
List charter available at - http://www.securecoding.org/list/charter.php
SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com)
as a free, non-commercial service to the software security community.

Reply via email to