"Build Security In": No more excuses in learning how to write secure code?

For years the secure software development community has discussed how to "Build Security In". On various lists that we belong to we have explored principles and practices while at the same time arguing about how we need to document this for all the understand ourside of our circle of influence.

Gunnar Peterson over at Cigital contacted me over the weekend and informed me about some work he has been part of that is "doing it"... not just talking about it.

The US Department of Homeland Security (DHS) has been supporting a project called "Build Security In", and it is now live. As Gunnar puts it, it is a resource of materials for software developers who want to write more secure code. The site has a ton of artifacts, activities, patterns, and so on that developers and architects can use to address security from the earliest stages of development.

From the official statement:

Build Security In is a project of the Strategic Initiatives Branch of the National Cyber Security Division (NCSD) of the Department of Homeland Security (DHS). The Software Engineering Institute (SEI) was engaged by the NCSD to provide support in the Process and Technology focus areas of this initiative. The SEI team will develop and collect software assurance and software security information that will help software developers, architects, and security practitioners to create secure systems.

I took some time over the weekend to go through the materials and I have to say I am impressed. A lot of thought and effort went into doing this right by going deep in the areas that really matter in building secure software. You can look at the "Process Agnostic Article View" to see how this breaks down, but I can give you a glancing overview by showing you the areas they broke it down into:

• Architectural & Design
  
  • Architectural Risk Analysis
    
  • Threat modeling
    
  • Principles
    
  • Guidelines
    
  • Historical Risks
    
  • Modeling Tools
    
  
  
• Code
  
  • Code Analysis
    
  • Assembly, Integration & Evolution
    
  • Coding Practices
    
  • Coding Rules
    
  • Coding Analysis
    
  
  
• Test
  
  • Security Testing
    
  • White Box Testing
    
  • Attack Patterns
    
  • Historical Risks
    
  
  
• Requirements
  
  • Requirements Engineering
    
  • Attack Patterns
    
  
  
• Fundamentals
  
  • Risk Management
    
  • Project Management
    
  • Training & Awareness
    
  • Measurement
    
  • SDLC Process
    
  • Business Relevance
    
  
  
• System
  
  • Penetration Testing
    
  • Incident Management
    
  • Deployment & Operations
    
  • Black Box Testing
    
  
  

Yep, thats a lot of great content. You need to head over there and dig in and start reading yourself.

Happy reading!