prevention Archives - Code Curmudgeon

Shift-left is more than just a phrase

Posted on January 17, 2019 by Code Curmudgeon

Female doctor holding a tablet with the text: Prevention is Better Than Cure

You hear people talking about shifting left all the time these days. But what do they really mean, and should anyone care? Will it...

Better Living Through Security Coding Standards

Posted on September 19, 2018 by Code Curmudgeon

Time for Standards 3d words on a clock face to illustrate guidelines and regulations for measuring performance or quality

Security for IoT and embedded devices is essentially a mess. If you’re not aware of it by now, stop and take a minute to...

Prevent Automotive Software Bugs with Static Analysis

Posted on February 4, 2016 by Code Curmudgeon

We all knows that automotive software is becoming increasingly complex. It’s gotten to the point that high-end cars not only have more code than...

Closing the Barn Door – Software Security

Posted on October 23, 2014 by Code Curmudgeon

In the second part of my series on what we can do to contain and combat the recent rash of security breaches I’d like...

1 2 3 Next ›

Definitioner

CWE: CWE stands for "Common weakness enumeration" and is a way to define a particular security issue in programming code. CWE is a security effort lead by the US government and industry to define a taxonomy for coding problems that lead to security vulnerabilities. Each vulnerability reported has an CVE ID and should be linked to the underlying CWEs that lead to the issue. There are currently approximately 800 items defined in CWE and efforts are underway to map their technical impacts to what kinds of problems the weakness may cause, as well as ISO 27010. CWE is often known for it's CWE Top 25 and On the Cusp lists of the most common software security problems. See https://cwe.mitre.org
CAN (Controller Area Network): Controller Area Network aka CAN aka CAN Bus is a wiring standard for vehicles that enables communication between various components and devices without having a host computer. For example doors, brakes, transmission.
denial-of-service: Attackers try to make a computer, network, or application unavailable to end-users. For example by overloading it with too much traffic as in a distributed denial of service.
code review: Code review is a process where programmers look at each others code and evaluate it's fitness for the intended purpose. It can find mistakes in design and implementation beyond simple syntax problems and improve quality.
peer code review (code review): Code review is a process where programmers look at each others code and evaluate it's fitness for the intended purpose. It can find mistakes in design and implementation beyond simple syntax problems and improve quality.
BASIC: Beginners All Purpose Symbolic Instruction Code. A programming language designed specifically for beginners.
static analysis: Any form of software analysis that can be done on the code without actually executing the code. Encompasses techniques like pattern-based analysis, metrics, code review, etc.