Code checking leads to sea change in Navy programming

Until recently, the only way to patch software was to deploy it first and identify its vulnerabilities later. However, this opened the code to zero-day exploits as well as advanced persistent threats designed to take advantage of vulnerable software.

Few options existed for testing code for vulnerabilities before deploying it. In addition to compromising data, finding problems using computer forensics became a very labor intensive process. At best this was done on an ad hoc basis with teams of developers working together. At worst, it was near impossible.

"Most of the time we would find out about a problem with application security after the fact and after someone did something they weren't supposed to be able to do,” said Kurt Wendelken, Commanding Officer of the Naval Supply Systems Command (NAVSUP) Business Systems Center.

Wendelken has been a Navy Supply Core officer for the past 26 years. His NAVSUP command is responsible for building and maintaining over 180 systems that make up the Navy's supply chain and finance systems, so there are thousands of applications under its purview.

After an security incident, NAVSUP would normally try to repair the compromised system, document how an attack or exploit occurred and make sure that it couldn't happen again. "I don’t think that we were doing anything differently than anybody else," he said.

Not only was this labor intensive, but Wendelken said his primary job is keeping data inside Navy systems secure. That means that any after-the-fact work to patch a compromised system meant that at some level, that goal had already been lost. The situation has only been exacerbated by a rise in the number and intensity of attacks in the last few years.

"Over the past year or two there have been lots of incidents that have really put an emphasis on this space," Wendelken said. "So we looked at application security and wanted to find a way to make the code better before it got deployed."

In looking for tools to break out of the traditional programming mold, NAVSUP found HP's Fortify Software Security Center product, a suite of tightly integrated programs designed for identifying, prioritizing and fixing security vulnerabilities in software before it hits the production environment.

The tool helps find vulnerabilities and trace them back to their source, including common errors like cross-scripting as well as deeper vulnerabilities that are much harder to detect. Looking at the code that will eventually go into Navy systems, and fixing any errors before it gets deployed has led to a sea change for NAVSUP.

"All code is now scanned through the Fortify tool, and it emerges highlighted showing problem areas," Wendelken said. "We can then go in and fix the problems before they become an issue.”

“This has lead to a fundamental change in our process, he added. “Before, if an application was able to run repeatedly, that was enough. Now we are fixing problems with the code before it becomes part of a Navy system."

Right now, NAVSUP is using Fortify to look at code, much of it submitted from contractors, to check for errors. However, the tool can also be deployed even farther back in the chain.

Fortify can run as an app on a programmer's desktop, with the ability to scan code as it's being written. That alerts the programmer to make changes and fix problems, not unlike the spell check function on word processors.

"The idea is that if programmers constantly see the mistakes they are making and are prompted to fix them, they will eventually become better programmers," said HP Enterprise Security Federal CTO Rob Roy. "They can learn from their mistakes, which is not unlike having a coding and security tutorial right at their fingertips."

Because NAVSUP works with many outside contractors, it ahs not yet deployed or required companies to use any type of error-checking tool. However, given the success NAVSUP is seeing in fixing code pre-deployment, Wendelken said it's possible they may ask contractors to have a protocol deployed to cut back on mistakes before code is submitted to the Navy.

"If we had run our code through the Fortify tool and not found any problems, I would have been both pleased and disappointed," Wendelken said. "It's like installing an alarm system on your home. You hope that it never gets used, but you are also happy if it works when needed. With an error checking tool, we have found a lot of coding errors and have been able to fix them pre-deployment."

Another advantage to using the Fortify tool is that it allows Wendelken to document up the chain of command what he and his staff are doing. Fortify reports can show vulnerable code that would have gone into a Navy system as well as the clean code produced after it had been checked.

And although the tool also saves his staff some time, Wendelken said that is not his primary concern.  "If the code is secure before it's deployed, then we can keep someone from penetrating a Navy system," he said. "That is the most important thing, and using the tool allows us to do that."