BSIMM: Confessions of a Software Security Alchemist (informIT)

[coley at linus.mitre.org (Steven M. Christey)]

On Wed, 18 Mar 2009, Gary McGraw wrote:

> Many of the top N lists we encountered were developed through the
> consistent use of static analysis tools.

Interesting.  Does this mean that their top N lists are less likely to
include design flaws?  (though they would be covered under various other
BSIMM activities).

> After looking at millions of lines of code (sometimes constantly), a
> ***real*** top N list of bugs emerges for an organization.  Eradicating
> number one is an obvious priority.  Training can help.  New number
> one...lather, rinse, repeat.

I believe this is reflected in public CVE data.  Take a look at the bugs
that are being reported for, say, Microsoft or major Linux vendors or most
any product with a long history, and their current number 1's are not the
same as the number 1's of the past.

- Steve