Secure Coding - Not many do it well …….
March 30th, 2007 Drazen Drazic Posted in Applications |
Computerworld US reported on this new initiative the other day:
Are your software programmers coding securely?
How do you criticise a program that tries to address what we see as one of the biggest issues in our field…………….but do we really need another certification?
Don’t get me wrong, developers will learn from this (if they engage), but lets hope organisations don’t get a false sense of security so to speak and continue to neglect important aspects of the SDLC that so lack security consideration/input today. Passing a few exams does not make one a specialist.
On a more positive note, we are seeing a growth in awareness in this field so any steps like this are positive.


March 30th, 2007 at 11:38 am
The IT Industry seems to be driven by the Silver Bullet approach. Marketers create this swift fix mentality that gets bought by compaines.
Something written on certification in 1947 for ABEPP (American Board of Examiners in Professional Psychology) by Carl Rogers is today as relevant for our industry as it was for theirs back then.
It seems after all, that this process is not unique to our industry, but industry in general.
Below is Rogers’ Speech, I’m unable to say it any better and in this light, it can be seen as a simile…..
I am not in any way impugning the motives, the integrity, and the efforts of those who aim toward certification and all that follows from it. I sympathize deeply. I wish there were a way to separate the qualified from the unqualified, the competent worker from the opportunist, the exploiter, and the charlatan. But let’s look at a few facts.
As soon as we set up criteria for certification - whether for clinical psychologists, for NTL group trainers, for marriage counselors, for psychiatrists, for psychoanalysts, or, as I heard the other day, for psychic healers - the first and greatest effect is to freeze the profession in a past image. This is an inevitable result. What can you use for examinations? Obviously, the questions and tests that have been used in the past decade or two. Who is wise enough to be an examiner? Obviously, the person who has ten or twenty years of experience and who therefore started his training fifteen to twenty-five years previously. I know how hard such groups try to update their criteria, but they are always several laps behind. So the certification procedure is always rooted in the rather distant past and defines the profession in those terms.
The second drawback I state sorrowfully: there are as many certified charlatans and exploiters of people as there are uncertified. If you had a good friend badly in need of therapeutic help, and I gave you the name of a therapist who was a Diplomate in Clinical Psychology, with no other information, would you send your friend to him? Of course not. You would want to know what he is like as a person and a therapist, recognizing that there are many with diplomas on their walls who are not fit to do therapy, lead a group, or help a marriage. Certification is not equivalent to competence.
The third drawback is that the urge toward professionalism builds up a rigid bureaucracy. I am not personally aware of such bureaucracy at the national level, but it certainly occurs frequently at the state level. Bureaucratic rules become a substitute for sound judgment. A person is disqualified because he has 150 hours of supervised therapy, while another is approved because he has the required 200. No attention is given to the effectiveness of either therapist, or the quality of his work, or even the quality of the supervision he received. Another person might be disqualified be-cause his excellent psychological thesis was done in a graduate department that is not labeled “psychology.” I won’t multiply the examples. The bureaucrat is beginning to dominate the scene in ways that are all too familiar, setting the profession back enormously.
Then there is the other side of the coin. I think of the “hot-line” workers whom I have been privileged to know in recent years. Over the phone, they handle bad drug trips, incipient suicides, tangled love affairs, family discord, all kinds of personal problems. Most of these workers are college students or those just beyond this level, with minimal intensive “on-the-job” training. And I know that in many of these crisis situations they use a skill and judgment that would make a professional green with envy. They are completely “unqualified,” if we use conventional standards. But they are, by and large, both dedicated and competent.
–Wade