The 25 Most Common Programming Errors

In case you missed it, MITRE and the SANS Institute released a list of the 25 most programming errors, as part of an effort to promote a more secure Web. Funded by the U.S. Department of Homeland Security this list is available on the SANS Institute Web site.

Among the Top 25:

• CWE-89, failure to preserve SQL query structure, which gives rise to SQL injection attacks, one of the favorite attacks of hackers.
  
• CWE-79, which enables cross-site scripting, another common and dangerous vulnerability in a Web application
• Improper authorization, an issue that leads to insider data breaches.
  

Datamation's Kenneth van Wyk weighed in with his thoughts on the list this week.

We all need to also ensure that software developers understand the underlying sound engineering principles that are implicitly referenced in the list. Things like the principle of least privilege, compartmentalization, and so on—think Salzer and Schroeder circa 1975. You know, the things that instantly and irrevocably cure insomnia among software developers. Well, you can use the Top-25 list as a way of drawing attention to those principles in an interesting and engaging way.