Network Computingwww.networkcomputing.com

Microsoft says it will equip its Visual Studio .Net with a plug-in from security software vendor Sanctum designed to catch common security vulnerabilities at development time. This new feature is intended to let programmers check their code more often for security flaws, helping them release code free of common exploits.

Join other NWC readers in discussing this article.

Although documenting test cases and performing unit tests on code is not the most exciting part of development, such tedious tasks are necessary to ensure that the underlying code does not contain defects--especially defects that could cause security breaches.

Introducing an automated method of scanning for vulnerabilities during development is the correct course of action, but if companies are unwilling or unable to create and enforce the necessary coding and QA practices that would ensure compliance, how can they enforce the use of such a tool?

Besides, an automated tool cannot replace due diligence. It can only assist in a company's efforts to reduce its product's security vulnerabilities. Those efforts should include a closer examination of code and better training for developers--and perhaps tougher punishment than a slap on the wrist for developers who continue to introduce exploits.

Anyone familiar with Microsoft's history of developing software vulnerable to buffer-overflow exploits is sure to sense the irony. We can only hope Microsoft's endorsement of Sanctum's product by including it with the Microsoft development environment means the programmers responsible for developing Microsoft's other products will be using it, and using it often.

Visit www.nwc.com/buzzcut/ to find more technology news analysis and post your own opinions.