Computer scientists agree on 'Top 25' programming errors

15:04 13th January 2009

IT experts from around the globe have come together to formulate a list of 25 programming errors which lead to the most dangerous security breaches, according to reports today (January 13th).

As part of a project fronted by the US National Security Agency, 30 organisations have arrived at a formal agreement over the biggest and most costly mistakes programmers can make.

The list seeks to invert the traditional security package approach of warning of the consequences of certain errors by offering developers detailed instructions on how to avoid them in the first place.

Mason Brown, director of SANS Institute, commented: "There appears to be broad agreement on the programming errors. Now it is time to fix them."

Three categories - insecure interaction between components (nine errors), risky resource management (nine errors) and porous defences (seven errors) - are highlighted on the list.

The major errors include incorrect input validation, external control of external state data and improper access control.

According to the SANS Institute, two of the mistakes led to over 1.5 million breaches of websites over the course of 2008.