Avoid the Cyber Threat by Using a Safe Programming Language
The Problem
Since the existence of networked, automated information systems, the so-called “Cyber-Threat” has been known to be a major security and business continuity risk. One of the very first worms, the “Morris-Worm”, destroyed the e-mail infrastructure of the early internet. The Cyber Threat is not thoroughly understood even by many executives of the software industry, and the situation amongst the software user community is even worse. An Asian nation-state actor recently subverted the Google Mail login system by exploiting a weakness in internet explorer used by Google employees. The same Asian nation state is also suspected to have illegally downloaded the full design blueprints of the largest European jet engine manufacturer.
The Cyber Threat is real and may have grave long-term consequences for those at the “receiving end” of a cyber attack.
The Solution
Unfortunately there is no “silver bullet” solution to this problem. Rather, a holistic solution comprising technology, business processes, user education and security rule enforcement must be employed to properly secure valuable data. The determined support of the CEO, CIO and CFO is clearly required to achieve that. CFOs understand that there exist strategic business risks, which are very difficult to be quantified in monetary terms, but they know that these risks might kill the whole business if left un-addressed. For example, criminal accounting practices of mid-level managers could kill any company, so the CFO will have to ensure the books are regularly audited by an independent authority. The same amount of diligence will be required to secure the confidential data of companies against the Cyber Threat.
This article is about a key aspect of defending against the Cyber Threat – securing software. It is important to note that, again, there is no “silver bullet” to secure a critical software system, but many of today’s security flaws (such as “Buffer Overflow Exploits”) could be avoided simply by using a Safe Programming Language. This kind of programming languages will make sure that low-level Cyber Attacks are automatically thwarted by the system infrastructure.
What is a “Safe Programming Language”?
As with many subjects in information technology, there is no authoritative definition of the term. Salesmen and consultants bend the term to suit their needs. My definition is simple: A Safe Programming Language (SPL) assures that the program runtime (such as the heap, stack or pointers or machine code) cannot be subverted because of a programming error. An SPL will make sure that a process will immediately terminate upon detecting such a low-level error condition. The Cyber Attacker will not be able to subvert the program runtime and “inject” his own, malicious program code. The programmer can then inspect the “remains” of the terminated process (such as a core file) in a useful manner to analyze and rectify the programming error.
Examples of Safe Programming Languages (in alphabetical order): C#, Cyclone, Java, Sappeur, SPARK Ada, Modula-3, Visual Basic.Net
Examples of Unsafe Programming Languages (in alphabetical order): Ada, Assembly Language, C, C++, Fortran, Modula-2, (Object-)Pascal
What should I do as a Programmer?
Whenever you start a new software development project, select a Safe Programming Language, instead of chosing the “industry standard” of unsafe languages like C or C++. There exist high-performance languages like Cyclone, Modula-3 and Sappeur, which can compete with C/C++ in terms of memory and processing time requirements. Don’t think that you are “one of the few programmers who can write bug-free code”.