Monday, January 12, 2009
"Most IT security woes, from software patching to cyberespionage and cybercrime, can be traced to the devastating effects wrought by the Top 25 programming errors made in software, according to a broad consensus of government and security firms.
"These programming errors include improper input validation, improper encoding or escaping of output, failure to preserve SQL query structure (SQL injection), and failure to preserve Web page structure (cross-site scripting). These are among the worst of the worst in the list of the Top 25, published Monday by MITRE Corp. and The SANS Institute, participants in what's called the Common Weakness Enumeration (CWE) project organized by the U.S. Department of Homeland Security's National Cybersecurity Division."
Big list of lulz at NetworkWorld...