market for training CISSPs how to code (Matt Parsons)

[cew at ACM.ORG (Craig E. Ward)]

On Wed, Mar 17, 2010 at 6:17 PM, ljknews <ljknews at mac.com> wrote:
> At 7:27 PM +0200 3/17/10, AK wrote:
>
> > Regarding training non-developers to write secure code, what are ?the
> > circumstances that a non-developer would create code that would
> > *require* security? I am assuming that system administrators know the
> > basics of their trade and scripting language of choice so security there
> > is taken care of
>
> Scripting languages should not be used for security-sensitive
> programs.

That statement is so broad as to be nonsense. You might as well say,
"Programming languages should not be used for security-sensitive
programs." (I might go along with "Imperative programming languages
should not be used for security-sensitive programs.")

Every programming language has its own peculiar security issues and
these need to be considered when choosing an implementation language.

-- 
Internet: cew at ACM.ORG
"If a program has not been specified, it cannot be incorrect; it can
only be surprising." (Young, Boebert, and Kain)