Ben,Your point is a good one -- the software security community needs to be vigilant in reaching out to developers and spreading "the word".
FWIW, some dev conferences have done this. I spoke at SD West in 2006, and there was a significant security track there. Still, it'd be great to see that sort of thing at more dev-specific conferences.
Cheers, Ken van Wyk SC-L Moderator On Mar 12, 2008, at 5:31 PM, Benjamin Tomhave wrote:
First, thanks for that Bill, it exemplifies my point perfectly. A couplethoughts... one, targeting designers is just as important as reaching out to the developers themselves... if the designers can ensure that securityrequirements are incorporated from the outset, then we receive an addedbenefit...two, a re-phrasing around my original thought... somehow we need to get security thinking and considerations encoded into the DNA of everyone inthe business, whether they be designers, architects, coders, analysts, PMs, sysadmins, etc, etc, etc. Every one of those topics you mention could (should!) have had implicit and explicit security attributes included... yet we're still at the point where secure coding has to be explicitly requested/demanded (often as an afterthought or bolt-on)... How do we as infosec professionals get people to the next phase of including security thoughts in everything they do... with the end-goalbeing that it is then integrated fully into practices and processes as abona fide genetic mutation that is passed along to future generations? To me, this seems to be where infosec is stuck as an industry. There seems to be a need for a catalyst to spur the mutation so that it can have a life of its own. :) fwiw. -ben -- Benjamin Tomhave, MS, CISSP [EMAIL PROTECTED] LI: http://www.linkedin.com/in/btomhave Blog: http://www.secureconsulting.net/ Photos: http://photos.secureconsulting.net/ Web: http://falcon.secureconsulting.net/ [ Random Quote: ] Augustine's Second Law of Socioscience: "For every scientific (or engineering) action, there is an equal and opposite social reaction." http://globalnerdy.com/2007/07/18/laws-of-software-development/ William L. Anderson wrote:Dear Ben, having just been at SXSW Interactive (I live in Austin, TX) Idid not see many discussions that pay attention to security, or any other software engineering oriented concerns, explicitly.There was a discussion of scalability for web services that featured the developers from digg, Flickr, WordPress, and Media Temple. I got thereabout half-way through but the discussion with the audience was about tools and methods to handle high traffic loads. There was a question about build and deployment strategies and I asked about unit testing(mixed answers - some love it, some think it's strong-arm micro-mgt (gofigure)).There was a session on OpenID and OAuth (open authorization) standards and implementation. These discussions kind of assume the use of securetransports but since I couldn't stay the whole time I don't know if secure coding was addressed explicitly.The main developer attendees at SXSW would call themselves designers and I would guess many of them are doing web development in PHP, Ruby, etc.I think the majority of attendees would not classify themselves as software programmers.To me it seems very much like at craft culture. That doesn't mean that a track on how to develop secure web services wouldn't be popular. In factit might be worth proposing one for next year. If you want to talk further, please get in touch. -Bill Anderson praxis101.com Benjamin Tomhave wrote:I had just a quick query for everyone out there, with an attached thought. How many security and/or secure coding professionals are prevalentlyinvolved with the SXSW conference this week? I know, I know... it's a big party for developers - particularly the Web 2.0 clique - but I'm justcurious. Here's why: I'm increasingly frustrated by the disconnect between business/dev and security. I don't feel like we're being largelysuccessful in getting the business and developers to include security aspart of their standard operating procedures. Developers are still oftentimes lazy and sloppy, creating XSS and CSRF and SQL injection holes. I then look at SXSW from afar and think: a) shouldn't I be there evangelizing security? and, b) shouldn't a major thread to all theseconferences be about how security is integrating with dev processes andpractices, making it better? Maybe I'm just too idealist. I'm curious what everyone else thinks. cheers, -ben
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Secure Coding mailing list (SC-L) SC-L@securecoding.org List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l List charter available at - http://www.securecoding.org/list/charter.php SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com) as a free, non-commercial service to the software security community. _______________________________________________
