Top 25 software screw-ups

Most IT security woes, from software patching to cyberespionage and cybercrime, can be traced to the devastating effects wrought by the Top 25 programming errors made in software, according to a broad consensus of government and security firms.

These programming errors include improper input validation, improper encoding or escaping of output, failure to preserve SQL query structure (SQL injection), and failure to preserve Web page structure (cross-site scripting). These are among the worst of the worst in the list of the Top 25, published Monday by MITRE Corp. and The SANS Institute, participants in what's called the Common Weakness Enumeration (CWE) project organized by the U.S. Department of Homeland Security's National Cybersecurity Division.

"It's been a three-year project to collect all the things that can go wrong in software architecture, design or code," says Bob Martin, CWE project leader at MITRE, known for its role in federal research projects.

After more than 700 types of problems were identified for CWE inclusion last year, MITRE and SANS asked experts in security organizations, firms and academia to help narrow the list down to the 25 worst. The goal was not only to get industry to focus on the worst software mistakes but also to provide a common vocabulary to address them with training and tools.

Several tools vendors, including Breach Security, Fortify Software, Veracode, Ounce Labs, and Core Security Technologies, are backing the Top 25 and CWE categorization. "This is the first serious attempt at building a taxonomy of software security weaknesses and flaws with an emphasis on practical application of identifying, preventing and fixing or mitigating the issues they pose," said Ivan Arce, CTO at Core Security Technologies in a prepared statement.