Re: Is developer education a lost cause?

[Richard Moore <rich () westpoint ltd uk>]

Robert Shields wrote:

A developer only writes code to meet project requirements. The
requirements for a typical project will not mention security, and even
if it did, how would you test whether or not an application is secure? A
typical tester will not be able to test this unless they are specially
trained. Thus, the decision to write secure code needs to made at a
managment level and incorporated into company wide policy.


I tend to agree with this. Basically, I think that a lot of security 
comes down to specifying how invalid input (or state transitions) should 
be handled. A system that isn't designed with the possibility of errors 
in mind is unlikely to ever be a) Stable or b) Secure.


Cheers

Rich.