Darkreading: Secure Coding Certification

[coley at linus.mitre.org (Steven M. Christey)]

> Maybe the test shouldn't focus on code at all? If we can agree that many
> flaws are found at design time even before code is written (Yes, most
> folks still use waterfall approaches but that is a different debate)
> then why can't questions occur at this level?

It was decided early on that this test would have a heavy emphasis on
coding, since programmers who've just entered the workplace (the target
examinees) are not likely to be heavily involved in design.  While this
decision was not unanimous, many of the core contributors agreed with this
philosophy.  Obviously this leaves a few gaps with respect to secure
software development, which I'm sure will be addressed by someone
somewhere, sometime.

- Steve