Pete Finnigan's Oracle Security Weblog

I came across this interesting news article written by Grant Gross and published on ComputerWorld this evening. The title is "Security expert: More developer education needed - Many programmers don't understand how code errors cause vulnerabilities" - The article starts:

"AUGUST 11, 2005 (IDG NEWS SERVICE) - WASHINGTON -- Software vendors need to create security education programs for their programmers in order to deliver software products that are more secure to their customers, an Oracle Corp. security expert said today.

Developer education and pressure from large buyers such as the U.S. government are two key ingredients in better software security, said Adam Jacobs, Oracle's principal product manager, during a presentation at the InfraGard National Conference in Washington. "

This is a very interesting article for some of the comments. It says just after the above quotes that Jacobs agreed with a Microsoft spokesman that off the shelf software vendors ignore security in favour of ease of use issues at least until recently? Adam Jacobs also agreed that the numbers of security bugs are rising not going down, he goes on to suggest brilliant designs are made insecure by developers. He said that many developers do not understand buffer overflows and SQL Injection and that universities are not teaching much about these subjects and issues. A key insight into Oracles coding strategy is disclosed. Jacobs said developers are rewarded with bonuses for delivering buggy code on time and also for delivering fast code that later has many bugs in it.

He then goes on to say that Oracle have developed a one day internal security training program that all developers go on, he also said a lot of developers complained about the course, why?

He also talks about developers having responsibility for the code they produce. The article finishes with some interesting comments that Oracle isn't going to invest time in making secure products if competitors make cheaper products.

It sounds like an industry truce is needed for all database software vendors where they will all agree to have minimum coding standards for security. That way they can all compete on a level playing field and we can all get secure software.