Software should defend itself: Oracle CSO

Applications will have to defend themselves from attack in the future, according to Oracle's chief security officer Mary Ann Davidson.

At the opening keynote of the AusCERT 2007 conference this morning, Davidson said applications should be more like US Marines.

"Every Marine fights -- whether you are a clerk or a medic, every Marine is first and foremost a Marine, which means they know how to defend themselves. This is an ethos I really think we are going to need in this new world.

"Realistically, why do we need all these [security] products in the first place -- because software can't defend itself," said Davidson.

Davidson also suggested that vendors should state the methods they have used to try and keep their code as bug free as possible.

"Maybe you can't prove that this product is free of defects but at least prove to me that you use these [tools] in its development. You are going to have to have some kind of proof that you paid attention in development -- even to the level of training people and what kind of software lifecycle you have," said Davidson.

Poor understanding of security and sloppy coding practises can also play a part in creating vulnerabilities but "part of it needs to be that products know how to protect themselves, they know what to expect", she said.

Developers should create software for a specific purpose and not try account for every future possibility, according to Davisdon.

"Developers are very creative and often think about usages way in the future ... but by allowing every possible future they are also allow a lot more attack vectors," she said.

Databases are the "Holy Grail" for hackers
Before introducing Davidson to the stage, the general manager of AusCERT Graham Ingram pointed out how important it was that database applications are not breached.

"The databases that you hold, with names, with addresses and in some cases with credit card details, are a very rich target for the people who want to obtain that information in their attacks.

"We cannot leave behind the thinking that the databases and the database applications are, in many cases, the Holy Grail for the attackers," said Ingram.