Securing an insecure world

Why do we have insecure software? That is a question Edward Roback, a computer security expert, is often asked. "There are many answers," said Roback, chief of the computer security division at the National Institute of Standards and Technology. The first is that anything to do with software is complex, he said, and security is no exception. A second reason is a lack of standards for secure software. Consequently, everybody tends to have unique ideas about it, Roback told Federal Computer Week.

But even where standards for secure software exist, software testing reveals that programmers often fail to translate standards into correct code, Roback said. Most software is not adequately tested before it is sold and used.

And why is software not thoroughly tested before people start using it? In part, Roback said, because there are few tests available for examining software that are quick, cheap and fast.

Read Full Story