Expert: Hold developers liable for flaws

Iria · Oct 12, 2005, 06:38 PM

Software developers should be held personally accountable for the security of the code they write, Howard Schmidt, former White House cybersecurity advisor, said.

Speaking Tuesday at the SecureLondon 2005 conference, Schmidt, who is now the CEO of R&H Security Consulting, also called for better training for software developers. He said he believes many developers don't have the skills needed to write secure code.

"In software development, we need to have personal quality assurances from developers that the code they write is secure," said Schmidt, who cited the example of some developers he recently met who had created a Web application to talk to a back-end database using SSL.

"They had strong authentication, strong passwords, an encrypted tunnel. The stored data was encrypted. But when that data was sent to the purchasing office, it was sent as a plain text file. This was not an end-to-end solution. We need individual accountability from developers for end-to-end solutions, so we can go to them and say: 'Is this completely secure?'" Schmidt said.
__________
Read More / Source: ZDNet

Oct 12, 2005, 06:38 PM	#1
Iria DriverHeaven Extreme Member Join Date: Apr 2004 Posts: 7,275 Rep Power: 89	Expert: Hold developers liable for flaws Software developers should be held personally accountable for the security of the code they write, Howard Schmidt, former White House cybersecurity advisor, said. Speaking Tuesday at the SecureLondon 2005 conference, Schmidt, who is now the CEO of R&H Security Consulting, also called for better training for software developers. He said he believes many developers don't have the skills needed to write secure code. "In software development, we need to have personal quality assurances from developers that the code they write is secure," said Schmidt, who cited the example of some developers he recently met who had created a Web application to talk to a back-end database using SSL. "They had strong authentication, strong passwords, an encrypted tunnel. The stored data was encrypted. But when that data was sent to the purchasing office, it was sent as a plain text file. This was not an end-to-end solution. We need individual accountability from developers for end-to-end solutions, so we can go to them and say: 'Is this completely secure?'" Schmidt said. __________ Read More / Source: ZDNet