Secure Coding - is it possible?
In one of my earlier Cyber Security article, I made a claim that creating vulnerability free code doesn't seem possible. Surprisingly, most people (including some really talented coders themselves) who read the article did not dispute this fact. I still believe given the easily foreseeable future, secure coding doesn't seem possible. However, we all know inventions happen out of necessity and so it possible that we "invent" Secure Coding relatively soon?
Predicating future is always a risky proposition but I feel optimistic today for a more secure Cyber world due to following:
- Automatic Programming - Though limited but there are lot of successful examples of Automatic Programming already available. As automation for code development increases, I am sure we will have less vulnerable software.
- Machine Learning - We already know how machine learning is being successfully used to detect malware or identify unusual user activity. I strongly feel that soon code analysis software will incorporate machine learning to detect code with vulnerabilities and we will reach a "nirvana" where vulnerable code never makes it past development stage. To get machine learning started we need enough sample data to identify patterns and in this case enough vulnerable code examples are already available.
- Artificial Intelligence - Next progression from Automatic Programming and Machine Learning would be the stage where through use of artifical intelligence we can directly produce secure applications and hopefully term "vulnerable software" will become a thing for folklore.
Apart from these advancements to how we create applications, I feel there is another important change starting to happen which will further improve overall application security and cyber security. This change is the move to cloud - I know it sounds cliche´ that cloud is the solution for everything but in my next article I will provide more details.
In an FPGA
Do it in hardware