New certification addresses software assurance

The leading organization for certifying information technology professionals today announced the launch of a new certification that will address the quality and reliability of software throughout its life cycle, from development through disposal.The International Information Systems Security Certification Consortium Inc., known as (ISC)2, plans to offer the first exams for the Certified Secure Software Lifecycle Professional (CSSLP) in June 2009, although an initial class of coders, who will receive the certification by virtue of their professional experience, is being recruited now. This initial group will help in developing the educational programs and four-hour examination for future candidates.'This is not going to be an easy exam to pass,' said executive director W. Hord Tipton. 'They are going to have to know a lot of things about a lot of steps in the software [development] life cycle.'The program is intended to address longstanding security concerns about the quality of software development. Operating systems have long been the targets of hackers who exploit vulnerabilities in the code to take control of the host computer or execute malicious code. In recent years Web browsers, applications and a growing host of third-party online apps and tools have become popular targets and vectors for delivering malicious code. A number of companies, such as Microsoft, have initiatives to improve software quality. But although there are accepted best practices for secure software development and tools for assessing the quality of programs, practices have not been formally institutionalized across the industry.'All too often, security is bolted on at the end of the software life cycle as a response to a threat or after an exposure,' said Howard A. Schmidt, an (ISC)2 board member and president of the Information Security Forum. 'New applications lacking basic security controls are being developed every day, and thousands of existing vulnerabilities are being ignored.'Schmidt, a former White House cybersecurity advisor, said the CSSLP certification will fill the need for a proactive program that could produce testable, replicable and sustainable improvements in software quality.The certification will be code-language neutral and would apply to any kind of software, from operating system to application, backend to client, including firmware.The CSSLP grew out of efforts to improve software security by the Software Assurance Forum, a program created by the Homeland Security Department, Defense Department and the National Institute of Standards and Technology together with industry and academic organizations.'We've been working on this for about two years,' Tipton said. 'We gathered the smartest people we could find' among users as well as software developers to develop the program.The goal was not only to have a solid body of knowledge and practices behind the certification, but also broad industry support. (ISC)2 said that it has received commitments from a number of organizations to have personnel certified through the program, including Microsoft, SRA International, Xerox, Frost & Sullivan, the SANS Institute, SAFEcode and the National Association of Software Services Companies of India.Although the U.S. government has not given a formal endorsement, it has cooperated in the development of the CSSLP program, Tipton said.'We have validation of the need and of the track we are on,' he said.The CSSLP exam will cover the software lifecycle, vulnerabilities, risk, information security fundamentals and compliance. Candidates must have at least four years of professional experience or three years of experience and a bachelor's degree or equivalent in information technology. The certification will cover seven domains:(ISC)2 in August began accepting applications from professionals to receive the first batch of certifications based on professional experience and expertise, and will accept applications for the experience assessment through March of 2009. These applicants will undergo rigorous evaluation of their careers and successful candidates will help assess and do final development of the certification exam. Education seminars for the exam are expected to begin in the first quarter of next year with the first test set for late June.Schmidt said he expected about 1,000 developers to be in the initial class of CSSLP recipients, with several thousand more taking training for the first tests. The United States, Germany and India, the primary centers of software development, will be the initial target markets for the certification although it will be offered worldwide.How long before the certification could have an impact on software quality would depend on the rate of its adoption in industry, how quickly business practices are changed, the length of development cycle for a piece of software and the refresh cycle for products now deployed.Given the level of initial support for the program, 'I think it will come pretty quickly,' Tipton said. But it could be a year or more before software developed under CSSLP practices begins coming out of the pipeline, and legacy applications will continue to remain in operation for years.