|
Welcome to the Spring 2016 edition of the CERT Secure Coding Standards newsletter!
We have some exciting news about CERT Secure Coding standards. We just released the freely downloadable online snapshot publication (PDF) of the SEI CERT C Coding Standard, (2016 Edition). This edition reflects two years of research and insight gained since the previously released edition. Being freely available, this online edition enables developers to share it widely and use it in training, documentation, tool development, professional guides, and other environments. We plan to release other standards in this format as well.
Save the date! We are planning to hold a Secure Coding Symposium on September 8, 2016 in the Arlington, VA area. Registration will open in the next several weeks. We are inviting speakers from government, industry, and academia to talk about future trends that will affect secure coding. If you have ideas for a speaker or a topic you think is particularly relevant, please send us a note at info@sei.cmu.edu. If you're interested in attending the symposium, let us know at info@sei.cmu.edu, and we'll be sure to contact you when registration opens.
To better focus attention on the CERT C++ Coding Standard, we hid the Recommendations section from the main landing page and reordered them to be within The Void in the wiki page tree view. While reviewing the Recommendations, we determined their content wasn't of sufficient quality to justify such prominent placement in the coding standard. We intend to update that content at a later date, at which point, we'll return it to the C++ landing page.
I'd love to hear how you are using the newsletters or will use the newly released SEI CERT C Coding Standard (2016 Edition). Send me a note at info@sei.cmu.edu.
Thank you all for your continued interest and engagement in the SEI CERT Secure Coding Initiative. Have a great summer!
Language Standards Updates
CERT C Coding Standard
Editors: Martin Sebor (Red Hat, Inc.) and Aaron Ballman (SEI/CERT)
Added
CERT C++ Secure Coding Standard
Editors: Martin Sebor (Red Hat, Inc.) and Aaron Ballman (SEI/CERT)
Added
Changed
- Due to the release of Clang 3.8, all automated detection sections that previously listed a check as "Clang 3.8 (pre-release)" are now listed as "Clang 3.8" instead.
- ERR56-CPP. Guarantee exception safety
Substantially edited for clarity, completing the rule. Removed the work-in-progress warning. - EXP58-CPP. Pass an object of the correct type to va_start
Added further information about default argument promotions, added another NCCE/CS pair, and performed some minor wordsmithing. Changed the title to be more vague because the scope of the rule was expanded; was previously called EXP58-CPP. Do not pass a reference or nontrivially copyable type to va_start. Updated the wording of the rule to refer to DCL50-CPP, which prohibits defining a variadic function, except when it's an extern "C" function. - CON51-CPP. Ensure actively held locks are released on exceptional conditions
Previously only mentioned one type of lock object; added the two others that are appropriate. Clarifies that lock objects are not required, but are preferred. - CTR51-CPP. Use valid references, pointers, and iterators to reference elements of a container
Clarified that references and pointers should be treated the same, despite the C++ Standard giving more latitude for pointers under certain circumstances. - CTR58-CPP. Predicate function objects should not be mutable
No longer requires predicate function objects to implement pure function call semantics, which barred reasonable practices such as IO and accessing other global state. - CTR57-CPP. Provide a valid ordering predicate
Corrected the description of the asymetical property of a strict weak ordering. - DCL53-CPP. Do not write syntactically ambiguous declarations
Added another NCCE/CS pair based on real-world code examples.
Removed
- The Recommendations section has been removed from the landing page and temporarily moved into The Void within the wiki page tree view. It will be returned to the landing page at a later date, after the content has been appropriately reviewed and updated.
- DCL55-CPP. Overloaded postfix increment and decrement operators should return a const object
Was converted from a rule to a recommendation. Is now DCL21-CPP. Overloaded postfix increment and decrement operators should return a const object.
New Clang Checkers
CERT Oracle Secure Coding Standard for Java
Editors: Brad Senetza (Oracle) and David Svoboda (SEI/CERT)
Changed
No Java rules were added or removed.
CERT Secure Coding Standard for Android
Editors: Fred Long (Aberystwyth University) and Lori Flynn (SEI/CERT)
No Android rules were added, removed, deprecated, or substantively changed.
CERT Perl Secure Coding Standard
Editor: David Svoboda (SEI/CERT)
No Perl rules were added, removed, deprecated, or substantively changed.
Mark Sherman will present "Risks in the Software Supply Chain," at Abstractions on August 18-20, 2016 in Pittsburgh, PA.
Lori Flynn was co-chair of MobileSoft 2016 (IEEE/ACM International Conference on Mobile Software Engineering and Systems), which took place May 16-17 and was co-located with ICSE in Austin, TX. On April 11, Mark Sherman and Bob Schiela, along with Chris Valasek (Uber ATC) and Chris Alberts, Hasan Yasar, and Chris King (all from SEI CERT), delivered the Lessons Learned from the Jeep Hack: How to Reduce Software Vulnerabilities in Cyber-Physical Systems webinar. If you missed it, you can watch a recorded version.
Our People
In the eNewsletter, we highlight staff members behind our secure coding research. This month we feature David Svoboda.  David Svoboda is a software security engineer at at the CERT Division of the SEI. He co-authored or contributed to four books, including The CERT C Coding Standard and The CERT Oracle Secure Coding Standard for Java. He also maintains the SEI CERT Coding Standard wikis and has taught Secure Coding in C and C++ all over the world to various groups in the military, government, and banking industries. David is also involved in several ISO standards groups: the JTC1/SC22/WG14 group for standardizing C, and the JTC1/SC22/WG21 group for standardizing C++.
David has been the primary developer on a diverse set of software development projects at Carnegie Mellon University since 1991. His projects have ranged from hierarchical chip modeling and social organization simulation to automated machine translation (AMT). His KANTOO AMT software, developed in 1996, is still in production use at Caterpillar.
|
