The White Home Workplace of the Nationwide Cyber Director (ONCD) is calling on know-how leaders to work collectively to cut back the software program assault floor by adopting reminiscence secure programming languages.

Reminiscence security bugs are one of the crucial prevalent safety points over the previous couple of many years, based on a report revealed by the workplace. These bugs have an effect on how reminiscence will be accessed, written, allotted, or deallocated. Common examples of reminiscence security bugs embody Morris Worm, Slammer Worm, Heartbleed, and BLASTPASS. 

In response to the ONCD, one of the simplest ways to fight reminiscence security vulnerabilities is to safe the programming languages which might be getting used. Reminiscence secure programming languages — resembling Rust, Go, C#, Java, Swift, Python, and JavaScript — can remove most of those vulnerabilities. 

RELATED CONTENT: What the Nationwide Cybersecurity Technique means for software program suppliers

“Since many cybersecurity points begin with a line of code, one of the crucial efficient methods to handle these points is by analyzing the programming language itself. Making certain {that a} programming language consists of sure properties, resembling reminiscence or kind security, means software program constructed upon that basis robotically inherits the safety these options present,” the report states.

The ONCD can be asking know-how suppliers to discover reminiscence secure {hardware}, and it believes there are a number of promising developments on this space. For instance, a brand new memory-tagging extension that cross-checks the validity of tips that could reminiscence earlier than utilizing them has been developed. One other instance is Functionality {Hardware} Enhanced RISC Directions (CHERI), which adjustments how software program accesses reminiscence.

Along with recommending reminiscence secure software program and {hardware}, one other component of the report is looking for the event of higher methods to measure the safety of software program. The ONCD believes that having higher measurability capabilities will allow know-how suppliers to anticipate and mitigate vulnerabilities earlier than they enter manufacturing. 

“Higher cybersecurity high quality metrics change the equation as a result of they’ll allow data-informed decision-making throughout the provision chain. Whereas the technical executives, just like the CTO, CIO, and CISO, play a defining function in executing this imaginative and prescient, cybersecurity high quality should even be seen as a enterprise crucial for which the CEO and the board of administrators are in the end accountable. Addressing the software program measurability downside would absolutely understand this metric’s utility, closing a significant info hole and incentivizing long-term investments in software program safety. This may permit all ecosystem stakeholders to see their return on funding or clearly perceive the danger of a decrease high quality product,” the report acknowledged. 

That is simply one other step within the White Home’s efforts to enhance cybersecurity. In March 2023, President Biden signed an government order associated to cybersecurity, and since then has created the Nationwide Cybersecurity Technique Implementation Plan and the Nationwide Cyber Workforce and Training Technique.